Island
F Island Enterprise Browser management API
Workloads automate Island's management console and SIEM feed with a static API key sent in an api-key header. No federation exists. Keys get a role (Read-Only up to Full Admin), but Island's docs are login-walled and nothing public shows expiry, a key-management API or last use, and GitHub does not revoke leaked keys. Outbound, Microsoft Purview uses Entra admin consent, but Google SecOps and Claude Compliance want static keys.
Low confidence. Island's docs and API reference redirect to its console login. Grades rest on third-party integration guides; expiry, rotation API and last-used fail as not publicly verifiable, and export authentication is unknown. Publishing the documentation is how a vendor gets credit.
Docs: documentation.island.io · Checked 2026-10-22 · source YAML · dispute via PR
Inbound F
How a workload running anywhere authenticates to this product.
Static API key generated in the Island Management Console (Platform Settings > Integrations > API, or a separate key under the Generic SIEM integration) with a chosen role, sent as an `api-key` header to management.island.io and api.island.io. No OIDC, workload identity or token-exchange path is documented anywhere public.
- applytosupply.digitalmarketplace.service.gov.uk checked 2026-10-22
“The Island API supports all the key features of the Island Management Console, including the ability to create, read, update and delete policy, policy elements (such as URL lists), users, browser configuration policies, etc.”
- raw.githubusercontent.com checked 2026-10-22
“Authentication uses an API key as the required credential.”
- raw.githubusercontent.com checked 2026-10-22
“The connector sends it verbatim as the lowercase HTTP header `api-key: <key>` (no `Bearer` prefix).”
- raw.githubusercontent.com checked 2026-10-22
“An Island API key is required.”
- docs.hunters.ai checked 2026-10-22
“This key is used to authenticate and connect with API requests.”
- explained.tines.com checked 2026-10-22
“Name the key, choose an appropriate role and click "Generate API Key"”
- docs.panther.com checked 2026-10-22
“Detailed instructions for configuring the Island AWS S3 integration are available in the Island Documentation Portal (requires Management Console login).”
Island's own documentation (documentation.island.io, including the API reference and "Generate and manage API keys") redirects to the Management Console login, and the Swagger endpoints on management.island.io return 401, so this card is graded on public sources only: Island's G-Cloud listing and the setup guides of integrators that call the API (Elastic, ConductorOne, Microsoft Sentinel, Hunters, Tines, Cribl, Panther, Google SecOps). Every one of them uses a console-generated API key; none mentions OIDC, a client-credentials flow or a cloud workload identity. The SIEM Events API (api.island.io) and the v1 management API (management.island.io) take the same kind of key. Anything Island documents behind the login about key lifetime, rotation or federation is not publicly verifiable; if it shows federation the grade moves.
Outbound B
How this product reaches into your cloud, repos, or other SaaS.
Microsoft Purview DLP connects through an Entra application the customer admin consents to (keyless). Pushing logs to Google SecOps means pasting a Google Cloud API key and feed secret into the Generic SIEM webhook URL, and the Claude Compliance API integration needs a non-expiring Anthropic Compliance Access Key. S3, Azure Blob, Snowflake and other SIEM destinations exist but their credential setup is login-walled.
- island.io checked 2026-10-22
“The integration connects the Island Enterprise Browser and Island Extension with Microsoft Purview network data security through an Azure AD consented application via Microsoft Graph API.”
- island.io checked 2026-10-22
“Once an administrator grants consent and configures a Purview network collection or DLP policy, Island begins evaluating browser-level activity against those policies in real time.”
- docs.cloud.google.com checked 2026-10-22
“Chronicle requires an API key for authentication.”
- docs.cloud.google.com checked 2026-10-22
“In the Server URL field, paste the complete webhook URL constructed in the previous step (the Chronicle endpoint URL with the API key and secret key appended as query parameters).”
- island.io checked 2026-10-22
“Island connects to Claude Enterprise via the Claude Compliance API and pulls the session content: chats, uploaded files, and attachments.”
- platform.claude.com checked 2026-10-22
“Compliance Access Keys do not expire on their own.”
- applytosupply.digitalmarketplace.service.gov.uk checked 2026-10-22
“Customers can send their logs to Amazon S3, Snowflake, Azure Blob Storage or any SIEM of their choice during their contract with Island, meaning an export should not be required.”
- docs.panther.com checked 2026-10-22
“Island exports logs to an S3 bucket in your AWS account.”
Provisional, because Island's integration docs are login-walled. Checked: Microsoft Purview (Entra admin consent to an Island app via Graph, keyless under the cohort rule, as on proofpoint-tap); Generic SIEM webhook push to Google SecOps (a Google Cloud API key plus a Chronicle feed secret embedded in the URL Island stores; Google, not Island, gives the restrict-the-key guidance); Claude Compliance API under SaaS API Protection (the Compliance API only accepts Anthropic keys, and Compliance Access Keys never expire, so a static key sits in Island); AWS S3, Azure Blob Storage and Snowflake log export, other SIEM pushes (e.g. Splunk) and the AWS Security Hub Extended integration (all exist per Island and partners, but how they authenticate is not publicly verifiable). Pull-based SIEMs (Sentinel, Elastic, Hunters, Cribl, Panther's S3 reader) use the inbound key, not an outbound one. Okta and Entra connections are human SSO and SCIM, out of scope. If the gated S3 page uses a cross-account role with external ID this stays B; if Purview turns out to need a customer-created app secret it drops to C or lower.
Hygiene for any static credential the product still issues
| ✗ Expiry enforceable | No public source mentions an expiry field, default lifetime or org policy for Island API keys; the creation steps every integrator documents are name, role, generate. Not publicly verifiable, so it fails for lack of a receipt; a documented enforced lifetime would flip it.
|
| ✗ Rotation via API | Every public procedure creates and deletes keys in the console. No key-management endpoint is visible in the public API references integrators link to (users, devices, timeline, admin actions, compromised credentials, SIEM audits). Elastic's note also implies only one management API key can exist at a time, so rotation means downtime rather than overlap. Not publicly verifiable beyond that.
|
| ✓ Scoped keys | Each key is assigned its own role at creation rather than inheriting the creator's access, and a Read-Only role exists, which the rubric counts. It is coarse (console roles, no per-endpoint or per-resource scopes are publicly documented), and the SIEM key guidance asks for an admin-level account.
|
| ✗ Last-used visible | No public source shows a last-used timestamp for API keys. Not publicly verifiable; fails for lack of a receipt.
|
| ✗ Leak revocation | Island does not appear in GitHub's supported secret scanning patterns table, so a leaked key is neither detected nor reported to Island.
|
Notes
Graded on public sources only: documentation.island.io and the API Explorer require a Management Console login. One public hygiene pass (role scoping) puts inbound at F; documented key expiry, a last-used view and a key-management API would lift it to D, and only a federated token path (GitHub Actions OIDC, cloud workload identity or a bring-your-own issuer) would lift it further. The browser's own end-user authentication (SSO through Okta, Entra and others) is human login and out of scope. Island Desktop, Island Network and the MCP Gateway are managed from the same console and were not graded separately.
Badge
[](https://wif.tax/p/island-enterprise-browser/)