My CI job can't scan a profile that a teammate can see. Why?

Why this happens

The Integrations page says it plainly: the scan runs with your permissions and group scope. Your teammate can see the profile because their own role and groups reach it. The CI job does not borrow their view. It uses only what its token owner has.

Groups work as access scopes. A group is a set of profiles, picked by hand or by tag, and grants can be limited to a group.

How to fix it

1. Find out who owns the API token stored in CYBERLOP_API_TOKEN.
2. Compare that user's access with your teammate's. An administrator can read roles and grants in Administration.
3. Check that the owner holds ci:trigger. A trigger call needs it.
4. Ask the administrator to put the profile in a group the owner can reach, or to give the owner the grant. A tag-based group picks up new profiles with that tag.
5. Run the pipeline again. If you changed the token, update the secret first.

Still not working?

Check the profile ID in your workflow too. The snippet on Integrations writes the ID of the profile you choose in its picker. The job can also name a profile by name in the API. Then look at the exact error. A permission message and a "not found" message point to different causes.

Pick a service account or a dedicated user for CI, so a person leaving your team never breaks the pipeline. Read CI scan permissions and how to limit access to profiles, or ask us on the contact page.

Related questions

• Whose permissions does a CI-triggered scan run with?
• Can I give someone access to only some of our targets?
• My CI job can't trigger a scan. What should I check?
• How do I create a group of scan profiles?
• Why does my API call return a permission error?

Full tutorial

How to add security scanning to your CI/CD pipeline

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre