Add Santa through Workshop

Available on: Enterprise

Firezone syncs Santa host records from North Pole Security Workshop. Use those records to require application allowlisting, check macOS system integrity, and evaluate host activity before granting access.

Before you begin

Complete the shared prerequisites. You need a Workshop tenant, permission to create an API key, and a test Mac running Santa that reports to Workshop.

This integration connects to Workshop at a *.workshop.cloud tenant URL. Installing Santa alone or using a different Santa sync server does not provide the Workshop API that Firezone needs. Firezone's Santa posture fields apply to macOS.

Create a Workshop API key

Open API Keys in Workshop and select Create.
Give the key a descriptive name such as Firezone posture.
Choose the readonly role and an expiry appropriate for your rotation schedule, then create and copy the key.
Record your Workshop tenant URL, such as https://acme.workshop.cloud.

See Workshop's API key documentation for key creation and expiry management. Firezone needs access to /workshop.v1.WorkshopService/ListHosts. The key begins with npsws_sk_.

Add the provider

In Firezone, open Settings → Device Posture → Add posture provider and select Santa.
Enter a Name and the base Workshop URL. Use the tenant origin, without the Santa sync path or an API method path.
Paste the raw key into API Key, without an authorization scheme prefix.
Select Verify Now. After Verified appears, select Create.
Request Sync Now from the provider's actions menu and wait for Last Synced to update.
Open the test Mac's Posture tab and confirm that its Santa record, configured mode, serial number, and last sync time are present.

Firezone matches Santa hosts by hardware serial. Provision an attested serial through Device Trust and enable Require attestation on the Policy to use a proved device identity for this match.

Use Santa evidence in Policies

Santa supplies these simplified checks.

Check	Santa evidence
Application allowlisting enforced	Configured client mode is `LOCKDOWN`.
Secure boot and system integrity	SIP status is `1`.
Recently seen	The host synced with Workshop within seven days.
OS up to date	The reported macOS version meets Firezone's current release check.

Enable checks using the Policy setup steps. The simplified allowlisting check uses the configured mode. The separate last_seen_client_mode field lets a custom rule also require the mode last reported by the host.

For example, require configured and reported Lockdown mode plus a sync within 24 hours in the JSON tab.

{
  "and": [
    { "field": "santa.configured_client_mode", "op": "is", "value": "LOCKDOWN" },
    { "field": "santa.last_seen_client_mode", "op": "is", "value": "LOCKDOWN" },
    { "field": "santa.last_sync_at", "op": "within_last", "value": "PT24H" }
  ]
}

The Santa attribute reference also covers agent versions, tags, temporary mode timestamps, and other host attributes.

Troubleshooting

If verification fails, check the Workshop tenant URL, key prefix, expiry, and read-only role. A key that cannot call ListHosts cannot supply inventory.

If the sync succeeds but a Mac has no Santa record, compare the serial reported by Workshop with the device's attested or Client-reported serial. The Workshop host UUID is not used as an MDM device ID for matching.

If a mode or freshness check fails, inspect the host in Workshop and confirm that Santa has synced its latest configuration. Workshop's host management guide explains how to inspect a host and request a sync. Then use Sync Now in Firezone to fetch the updated record.

Before a key expires, create a replacement in Workshop, edit the Firezone provider, enter the new key, verify, and save. Confirm a successful inventory sync before removing the old key.

Need help? See all support options.