> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Prowler > Connect Prowler so agents can review failed security findings, exposed resources, and compliance status across your cloud accounts Connect Prowler and CloudThinker agents can list failed security checks by severity, show the resources behind them, and report where each compliance framework is failing. Prowler authenticates with an **API key**, and the connection is read-only: agents never start scans, mute findings, or change providers. ## Prerequisites * A **Prowler Cloud** account, or a self-managed Prowler whose API is reachable from the internet. To limit who can reach it, allowlist CloudThinker's egress IPs. These docs don't publish CloudThinker's egress IP list: ask your CloudThinker contact, or [contact us](https://cloudthinker.io/contact). See [Reaching private services](https://docs.cloudthinker.io/guide/connections/overview.md#reaching-private-services) for other options. * At least one cloud account (Prowler calls it a provider) that Prowler has already scanned. Agents read scan results; they can't run a scan. * A Prowler user with the **Manage Account** permission. Prowler requires it to create API keys. * Edit permission on connections in your CloudThinker workspace. ## Setup **1. Create an API key in Prowler** Sign in to Prowler as the user whose access agents should have (see [Required permissions](#required-permissions)). Go to **Profile → Account** and click **Create API Key** to open the form. Name the key `cloudthinker` and optionally set an expiration date. Without one, the key expires after 365 days. Then click **Create API Key** in the form. Prowler shows the new key once. Copy it before you close the dialog. **2. Open Prowler in CloudThinker** In the sidebar, click **More → Workspace settings → Connections**. On the **Builtin Connections** tab, search for **Prowler** and click **Connect**. **3. Enter the key and connect** Fill in the two fields. The form shows them by these exact names: * **PROWLER\_API\_KEY**: the key you copied. * **API\_BASE\_URL**: keep the default for Prowler Cloud, or enter your self-managed Prowler API address. Click **Connect**. **Success state:** the Prowler connection shows a **Connected** status. > [!NOTE] > > **Connected** doesn't prove the key works. Prowler checks the key the first time an agent calls it, so run the verify prompt below right after you connect. ## Connection details | Field | Required | Description | Example | | - | - | - | - | | **PROWLER\_API\_KEY** | Yes | Prowler API key | `` | | **API\_BASE\_URL** | No | Prowler API address. Defaults to `https://api.prowler.com/api/v1` (Prowler Cloud) | `https://prowler.example.com/api/v1` | ## Required permissions A Prowler API key has the same access as the user who created it. | Goal | Prowler setup | | - | - | | Read findings, resources, and compliance | **Unlimited Visibility**, or only the provider groups agents should see | | Create the key | **Manage Account** | > [!TIP] > > Create the key from a dedicated Prowler user. Give that user a role with **Manage Account** (needed to create its own key) plus **Unlimited Visibility** or only the provider groups CloudThinker needs. You can then change or remove its access without affecting anyone else. ## Agent capabilities | Capability | What agents read | | - | - | | **Provider coverage** | The cloud accounts Prowler monitors and an overview of their findings | | **Failed findings** | Failed checks filtered by severity (critical, high, medium, low, informational), grouped, with details | | **Resources** | Resource inventory, one resource's details, and the findings on it | | **Compliance** | Status per framework and the requirements that fail | | **Checks and docs** | What a Prowler check or compliance framework covers, from the Prowler Hub catalog and Prowler documentation | Checks and docs come from the public Prowler Hub and Prowler documentation, not from your tenant. Everything else is read with your API key. Agents can't add or delete providers, start or schedule scans, create or change mute rules, or send findings to Jira. Do those in Prowler. ### Verify the connection Start a chat, type `#` and pick **Prowler**, then ask: ```text theme={null} Summarize my Prowler providers and the count of failed findings by severity ``` **Expected result:** a list of your providers with failed-finding counts per severity. If the key is bad, the agent reports a 401 error instead (see [Troubleshooting](#troubleshooting)). ### Example prompts ```text theme={null} List the critical failed Prowler findings and the resources they affect Which Prowler compliance frameworks have the most failing requirements? Show the Prowler resource inventory for my AWS accounts ``` Agents answer from what they read in the current conversation. A failed Prowler call is reported as an error, never as zero findings. ## Troubleshooting > [accordion] Every request fails with 401 > > Prowler rejected the key. It may be mistyped, expired, or revoked, or its user was removed from the tenant. Create a new key in **Profile → Account** and update the connection. > [accordion] Requests fail with a not-found error > > **API\_BASE\_URL** is wrong. Restore `https://api.prowler.com/api/v1` for Prowler Cloud, or enter your self-managed API address ending in `/api/v1`. > [accordion] Agents see no providers or findings > > The key's user can't see any providers, or Prowler has no scan results yet. Give the user **Unlimited Visibility** or the right provider groups, and check in Prowler that a scan has finished. > [accordion] Some providers or findings are missing > > The key's user sees only the provider groups its role allows. Add the missing provider groups to that role, or give it **Unlimited Visibility**, then ask again. > [accordion] An agent says it can't start a scan or onboard an account > > That's expected. The connection is read-only. Add the cloud account and run the scan in Prowler, then ask again. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - **Revoke, don't delete.** Prowler can't delete an API key. Use **Revoke** to disable a key you no longer need. - **Rotate before expiry.** Keys expire after 365 days by default. Create a new key and update the connection before then. ## Related > [card] [AWS Connection](https://docs.cloudthinker.io/guide/connections/aws.md) > > Inspect and fix the accounts Prowler scans > [card] [Drata Connection](https://docs.cloudthinker.io/guide/connections/drata.md) > > Failing tests, control readiness, and personnel gaps This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.