SubImage
Purpose
Syncs SubImage platform metadata into the graph: tenants, team members, API keys, Neo4j users, configured modules, and compliance frameworks. Enables cross-tenant visibility when Cartography maps multiple SubImage deployments.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
subimage_client_id |
Yes | WorkOS M2M client ID |
subimage_client_secret |
Yes | WorkOS M2M client secret |
subimage_tenant_url |
No | SubImage tenant URL (e.g. https://acme.subimage.io) |
subimage_authkit_url |
No | AuthKit URL for OAuth2 token exchange (default https://auth.subimage.io) |
Setup Steps
- Create a WorkOS M2M application with admin scope in your SubImage tenant settings. Note the client ID and client secret.
- In SubImage, fill in:
subimage_client_id— the client ID (or its AWS Secret ARN)subimage_client_secret— the client secret (or its AWS Secret ARN)subimage_tenant_url— your tenant URLsubimage_authkit_url— override only if using a custom AuthKit endpoint
- Save the module and run an initial sync.
What Gets Synced
| Resource | Neo4j Label | Description |
|---|---|---|
| Tenants | SubImageTenant |
Organizational tenants |
| Team Members | SubImageTeamMember |
Users and their roles |
| API Keys | SubImageAPIKey |
M2M and service API keys |
| Neo4j Users | SubImageNeo4jUser |
Database user accounts |
| Modules | SubImageModule |
Configured sync modules and status |
| Frameworks | SubImageFramework |
Compliance frameworks and rule counts |