Sentry

Tidal Control's Sentry integration reads the configuration of your Sentry organisation for compliance purposes. It authenticates with a bearer auth token against the Sentry Web API v0 (https://sentry.io/api/0), and because Sentry receives production error payloads, its privacy and access settings are squarely in audit scope.

What this integration monitors

• Organisation access: MFA enforcement, SSO presence, open membership, member invite permissions and the default member role
• Members: Per-member MFA, SSO linkage, IdP provisioning, dormant accounts and stale invitations
• Data scrubbing: Organisation-wide and per-project PII scrubbing, IP address scrubbing, sensitive field lists and crash report storage
• Projects: Owning teams, environments, public visibility, allowed domains and SSL verification
• Client keys: Ingestion rate limits and quota protection
• Releases: Commit and deploy tracking, so an error traces back to a change
• Alerting: Issue alert rules, detectors, workflows and cron monitors, including alerts that route nowhere

Requirements

• Super User role in Tidal Control
• A Sentry account with access to your organisation settings
• Your Sentry organisation slug

Configuration step-by-step plan

We'll create an internal integration in Sentry, copy its token and your organisation slug, then add the connection in Tidal Control.

Configuration steps:

1. Find your organisation slug
2. Create an internal integration token
3. Configure the integration in Tidal Control

Step 1: Find your organisation slug

• Log in to Sentry
• Open Settings > Organization > General Settings and copy the Organization Slug
• You can also find it in the URL: both acme.sentry.io and sentry.io/organizations/acme/ use the slug acme
• Copy only the slug, without https://, .sentry.io or any path

Step 2: Create an internal integration token

• In Sentry, go to Settings > Integrations > Custom Integrations
• Click Create New Integration, choose Internal Integration, then click Next
• Give it a name, for example Tidal Control
• Under Permissions, set the following entries to Read. The scope names identify the corresponding API permissions:

Permission in Sentry	Access	Scope	Covers
Organization	Read	org:read	Organisation settings and data scrubbing policy
Member	Read	member:read	Members, MFA status and pending invitations
Project	Read	project:read	Projects, project settings, client keys and releases
Alerts	Read	alerts:read	Alert rules, detectors, workflows and monitors

• Leave the other permissions at No Access, Continuous Integration (CI) unchecked and webhook fields empty
• Click Save Changes, then scroll to Tokens on the saved integration page
• If the token list is empty, click New Token and follow the dialog to generate one
• Copy the generated token from Tokens. Client ID and Client Secret are different values and cannot be used in the Auth token field

Step 3: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to Sentry
• Fill in the configuration:
  • Name: A descriptive name, for example Sentry
  • Organisation slug: The slug from step 1
  • Auth token: The token from step 2, without Bearer, quotes or surrounding spaces
  • API URL (self-hosted only): Leave empty for Sentry Cloud
• Click "Create" to save the integration

Configuration fields explained

The integration dialog asks for the following values:

Name:

• A descriptive name for this connection
• For example: Sentry, Sentry Production

Organisation slug:

• The short name of your organisation, as it appears in Sentry URLs
• Required

Auth token:

• The internal integration token from step 2
• Required, and stored as a secret

API URL (self-hosted only):

• Only for a self-hosted Sentry, for example https://sentry.example.com/api/0
• Leave empty for Sentry Cloud

Verification

The integration is working when all of the following are true:

• Settings → Integrations shows Sentry under Configured Integrations
• Sentry tests are available in the Tests section
• Test refresh delivers results without authentication errors

Frequently asked questions

Which token type do I need? An internal integration token, created under Settings > Integrations > Custom Integrations. A personal token also works. An organisation auth token does not.

Does Tidal Control read my error data? No. The integration reads configuration only: organisation and project settings, members, keys, releases and alert rules. It does not read event payloads or stack traces.

Are my client key secrets stored? No. The Sentry API returns a secret and a DSN secret on each client key, and the integration maps neither. Only the key's rate-limit and activity settings are kept.

Why do both alert rules and detectors appear? They are two representations of the same alerting configuration, and a live organisation returns both. Neither set being empty is a problem.

Common problems

Tests error with an authentication failure

• Confirm that the saved value comes from Tokens on your internal integration page, rather than Client ID, Client Secret or Organization Tokens
• Paste the complete token without Bearer, quotes or surrounding spaces
• If the token was revoked, create a new token on the internal integration page and update the connection before refreshing the tests

Member MFA results look empty or incomplete

• The token is missing the member:read scope. Add it in the integration's Permissions

Connected integrations evidence is missing

• The API URL points at a regional host such as de.sentry.io. Clear the field for Sentry Cloud

Cron monitor tests report nothing

• Cron monitors are gated by your Sentry plan. On a plan without them, Sentry returns no monitors

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.