​
Overview

The AssetTiger integration reads the people in your AssetTiger account and brings them into LowerPlane Access Reviews. A reviewer then confirms that each person should still be there. LowerPlane uses two read-only API tokens to collect this automatically.
LowerPlane only reads people from AssetTiger. It never creates, changes, or deletes anything in your AssetTiger account.
Connection type: two API tokens (API Token and Auth Token)
AssetTiger is used for Access Reviews only. It does not run automated tests and does not add evidence or rows to the Assets page.

​
Prerequisites

API access requires a paid AssetTiger plan. The free trial does not include API access, so the tokens cannot be generated on a trial account.
You also need access to AssetTiger’s Settings page to generate the tokens.

​
How to Get Your Tokens

1

Open API Configuration

In AssetTiger, go to Settings and open API Configuration.
2

Generate both tokens

Generate the API Token and the Auth Token. You need both. LowerPlane will not connect with only one.
3

Copy the tokens

Copy both tokens and store them securely.

​
Connecting in LowerPlane

1

Open the integration

Go to Integrations in LowerPlane and find AssetTiger.
2

Enter your tokens

Provide the following:
  • API Token: the first token from AssetTiger
  • Auth Token: the second token from the same page
3

Connect

Click Connect. LowerPlane exchanges the two tokens for a temporary access token to read your people. If either token is wrong, or the plan does not include API access, the connection fails and LowerPlane shows the error.

​
What LowerPlane Reads

People

The people in your AssetTiger account, so each one can be listed in an Access Review.

Access Review

A reviewer confirms whether each person should still have access. Results stay in LowerPlane.

​
Frameworks

AssetTiger supports the Access Review for:
  • SOC 2
  • ISO 27001

​
Managing the Integration

  • Sync frequency: set it from the Sync Frequency dropdown on the connected integration. See Connecting Integrations.
  • Disconnecting: open the integration and select Disconnect or Revoke Access. This stops reading people from AssetTiger. Access Reviews already created stay in LowerPlane.
  • Expired or revoked tokens: AssetTiger uses API tokens, not OAuth, so there is no Refresh Tokens step. If AssetTiger rejects a token, the integration shows an error. Generate new tokens in AssetTiger and reconnect with both.

​
Troubleshooting

Check that both tokens were copied in full, with no extra spaces, and that they came from the same API Configuration page.
API access needs a paid plan. Check your AssetTiger subscription, or ask AssetTiger support to enable API access.
Only people in your AssetTiger account are read. Confirm they exist in AssetTiger and that the integration is connected in LowerPlane.

​
Security

LowerPlane uses the two tokens only to read people from AssetTiger. They are stored encrypted when LowerPlane’s encryption key is configured.