Reco
Visualize changes to Reco Accounts, Users, Identity Users, Identity Accounts, Policies, Devices, Applications, and Alerts through queries and alerts.
- Installation
- Authorization
- Data Model
- Types
- Release Notes
Installation
The Reco integration collects accounts, users, identities, devices, applications, policies, alerts, and AI agents from your Reco environment using the Reco API.
Prerequisites
- An active Reco account with Admin-level access.
- Permission to manage API keys in the Reco portal.
Creating an API key in Reco
- Log in to your Reco portal.
- Navigate to Integrations.
- Navigate to API Access Keys.
- Click Add API Access Key to generate a new key.
- Provide a descriptive name for the key (for example,
JupiterOne Integration) and click Add. - Copy the generated API key and store it securely.
You cannot view the full key again after navigating away from the page.
Configuration in JupiterOne
To install the Reco integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Reco. Click New Instance to begin configuring your integration.
Creating an instance requires the following:
-
Account Name — A label used to identify this integration instance in JupiterOne. Ingested entities will have this value stored in
tag.AccountNamewhen the AccountName toggle is enabled. -
Description — An optional description to help distinguish this instance from others.
-
Polling Interval — How often JupiterOne should collect data from Reco. You may leave this as
DISABLEDand trigger the integration manually. -
API Key — The API key generated in the Reco integrations tab (required).
-
Reco Host URL — The URL of your Reco instance (for example,
https://your-company.reco.ai) (required).
Click Create once all values are provided to finalize the integration.
Next steps
Once your integration instance is configured, it will begin running on the polling interval you selected. Continue on to our instance management guide to learn more about working with and editing integration instances.
Permissions
IAM permissions that must be granted to the integration principal for data ingestion.
Show Permissions (1)
PERM_AI_AGENTS_READ
Endpoints
API endpoints that the integration makes requests to.
Show Endpoints (5)
https://<reco-host>/api/v1/asset-managementhttps://<reco-host>/api/v1/asset-management/queryhttps://<reco-host>/api/v1/external-api/ai-agents/listhttps://<reco-host>/api/v1/policy-subsystem/alert-inbox/tablehttps://<reco-host>/api/v1/users
Documentation Links
Links to provider documentation relevant to setup and configuration.
Show Documentation Links (1)
Per-Step Breakdown
Detailed authorization requirements for each ingestion step.
Show all steps (4)
| Step | Endpoints |
|---|---|
| Build Identity Account Has Applications Relationships | https://<reco-host>/api/v1/asset-management/query |
| Fetch Alerts | https://<reco-host>/api/v1/policy-subsystem/alert-inbox/table |
| Fetch Devices | https://<reco-host>/api/v1/asset-management |
| Fetch Identity Account | https://<reco-host>/api/v1/asset-management/query |
Entities
The following entities are created:
| Resources | Entity _type | Entity _class |
|---|---|---|
| Account User | reco_account_user | User |
| Alert | reco_alert | Finding |
| Application | reco_application | Application |
| Device | reco_device | Host |
| Policy | reco_policy | Policy |
| Reco Account | reco_account | Account |
| Reco AI Agent | reco_ai_agent | Application, NHI |
| Reco Identity Account | reco_identity_account | Account |
| Reco Identity User | reco_identity_user | User |
Relationships
The following relationships are created:
Source Entity _type | Relationship _class | Target Entity _type |
|---|---|---|
reco_account | HAS | reco_account_user |
reco_account | HAS | reco_ai_agent |
reco_identity_account | HAS | reco_application |
reco_identity_user | OWNS | reco_device |
reco_identity_user | HAS | reco_identity_account |
reco_policy | TRIGGERS | reco_alert |
Reco Account
reco_account inherits from Account
Reco Account User
reco_account_user inherits from User
| Property | Type | Description | Specifications |
|---|---|---|---|
isSingleSignOn | boolean | ||
lastLoggedInOn | number | ||
roles | array of strings | ||
ssoAppIds | array of strings |
Reco Ai Agent
reco_ai_agent inherits from Application, NHI
| Property | Type | Description | Specifications |
|---|---|---|---|
accountsCount | number | Number of accounts touched by the agent. | |
agentType | string | Reco-assigned agent kind (open string — e.g. OAuth app, automation, copilot). | |
aiModel | string | Underlying AI model the agent uses (e.g. gpt-4). The AIASM-33 nhiAi enricher may use this as an additional platform signal. | |
appDisplayName | string | Human-readable name of the AI agent application. | |
appId | string | Reco identifier for the AI agent. Mirrored on clientId to maximise the AIASM-33 enricher match surface. | |
authorization | string | Authorisation mechanism for the agent (open string — e.g. oauth, api_key, service_account). | |
clientId | string | Reco identifier for the AI agent (alias of appId). | |
connections | number | Number of other resources / SaaS apps the agent is connected to. | |
instance | string | Identifier of the connected SaaS instance the AI agent runs in (e.g. M365 tenant, Slack workspace). | |
owner | string | Identifier of the human owner Reco has associated with the agent (often an email address). | |
risk | number | Reco's risk score for the agent. | |
tools | array of strings | Tools and APIs the agent has access to. | |
visibility | string | Whether the agent is internal- or external-facing (open string). |
Reco Alert
reco_alert inherits from Finding
| Property | Type | Description | Specifications |
|---|---|---|---|
extractionSource | string | ||
instanceId | string | ||
lastExtractedOn | number | ||
lastScannedOn | number | ||
tenantId | string | ||
totalComments | number |
Reco Application
reco_application inherits from Application
| Property | Type | Description | Specifications |
|---|---|---|---|
appCreatedAt | number | ||
appGroups | array of strings | ||
applicationInstances | array of strings | ||
applicationName | string | ||
appOwner | array of strings | ||
authorizationStatus | string | ||
authTypes | array of strings | ||
bkBreachIndex | number | ||
bkBreachIndexLastUpdatedOn | number | ||
bkCyberRating | number | ||
bkCyberRatingLastUpdatedOn | number | ||
bkGradeLetter | string | ||
bkRansomwareIndex | number | ||
bkRansomwareIndexLastUpdatedAt | number | ||
category | string | ||
companySize | string | ||
firstUsedOn | number | ||
isShadow | boolean | ||
isSsoEnabled | boolean | ||
lastThirtyDaysScore | number | ||
lastUsedOn | number | ||
logo | string | ||
numberOfUsers | number | ||
overrodeUsage | string | ||
securityScore | number | ||
securityScoreLetter | string | ||
securityScoreUrl | string | ||
tenantId | string | ||
typeUsage | string | ||
unusedApp | boolean | ||
usesAI | boolean | ||
vendor | string | ||
website | string |
Reco Device
reco_device inherits from Host
| Property | Type | Description | Specifications |
|---|---|---|---|
accountId | string | ||
hasIdentity | boolean | ||
instanceId | string | ||
isRegistered | boolean | ||
lastApiMessageId | string | ||
managementStatus | string |
Reco Identity Account
reco_identity_account inherits from Account
| Property | Type | Description | Specifications |
|---|---|---|---|
accountType | string | ||
adminLabel | string | ||
adminLabelUpdatedAt | number | ||
alerts30Days | number | ||
alertsCount | number | ||
deactivatedOn | number | ||
domainType | string | ||
email | string | ||
hasMfa | boolean | ||
instanceId | string | ||
isActive | boolean | ||
isAdmin | boolean | ||
isGuest | boolean | ||
isInternal | boolean | ||
isPrivileged | boolean | ||
isServiceAccount | boolean | ||
isStandard | boolean | ||
lastLoggedInOn | number | ||
lastSeenOn | number | ||
location | string | ||
locationAnalysis | array of strings | ||
numGroups | number | ||
permissions | array of strings | ||
permissionSets | array of strings | ||
photo | string | ||
relatedEmails | array of strings | ||
roles | array of strings | ||
tenantId | string | ||
userTypeDisplay | string | ||
workspaceId | string |
Reco Identity User
reco_identity_user inherits from User
| Property | Type | Description | Specifications |
|---|---|---|---|
alertsCount | number | ||
appInstanceIds | array of strings | ||
departments | array of strings | ||
hasAccess | boolean | ||
isFormerUser | boolean | ||
jobTitles | array of strings | ||
labelNames | array of strings | ||
lastLoginOn | number | ||
lastSeenOn | number | ||
relatedAccountCount | number |
Reco Policy
reco_policy inherits from Policy
| Property | Type | Description | Specifications |
|---|---|---|---|
openAlerts | number | ||
policyType | string | ||
riskLevel | string | ||
sources | array of strings | ||
status | string | ||
tags | array of strings | ||
totalAlerts | number |
Release Notes
- 2025-06-11 — Added Reco identity user and identity account entity ingestion, with relationships linking users to accounts and applications, and devices to their owning users.
- 2025-06-10 — Added initial Reco integration, ingesting users, policies, and alert entities with policy-to-alert trigger relationships.