Apptega

Overview

Apptega is a governance, risk & compliance (GRC) platform for MSPs and MSSPs. Bumblebee connects through Apptega's Partner Projection API, a read-only projection over the partner's managed organizations and, within each, their compliance programs (frameworks such as NIST CSF, CMMC, SOC 2, ISO 27001, HIPAA, and PCI DSS). Each program is broken into apps (control groups) and subcontrols (controls), and every organization has tasks, audits, audit-requests, a risk register, and roll-up projections (executive dashboard, risk overview).

The integration is read-only — Bumblebee lists and retrieves Apptega data but cannot create or modify records.

Prerequisites & Setup

Apptega provisions API access manually — there is no self-service key screen.

1. Contact your Apptega account manager or Apptega support at support@apptega.com and ask them to issue a Partner API key.
2. Mention the key is for a read-only reporting integration.
3. Copy the key exactly (no leading/trailing spaces).

A single partner key sees every organization it is scoped to — Bumblebee resolves the organization list automatically.

Configure in Bumblebee

1. Go to the Integrations page in Bumblebee
2. Select Apptega
3. Paste your API Key (the Apptega Partner API key)
4. Save the configuration
5. Run a test request (e.g. list organizations) from the validation card

Available Tools

All tools are read-only. Each folds several related endpoints so the agent can retrieve any Apptega resource in one or two calls.

• list_organizations — List the organizations (managed clients) the key can see, or get one. Optional: organization_id (str). Call this first to resolve the organization_id the other tools need.
• list_programs — List an organization's compliance programs (frameworks) with progress scores. Required: organization_id (str).
• list_program_items — Drill into a program: its apps (control groups), all of its subcontrols (controls), or the subcontrols within one app. Provide program_id (str) with item_type "subcontrols" (default) or "apps", or app_id (str) for a single app's subcontrols.
• list_organization_records — One tool over an organization's tasks, risks, audits, and audit-requests. Required: organization_id (str), record_type (str). Tasks also accept status, priority, program_id, app_id; cursor pagination via cursor.
• get_organization_projection — Roll-up projections: the executive-dashboard (scores, program status, top open tasks), the risk-overview (heatmap, with optional cell drill-down), or the cross-organization organization-overview roster.

Each tool accepts an optional response_filter (a JMESPath projection) with a sensible default; pass response_filter="@" to retrieve the full response envelope for a record.

Example questions

• "List the organizations in our Apptega account."
• "How far along is Acme Corp on their compliance programs?"
• "Show me the subcontrols in Acme's NIST CSF program and their progress."
• "What Apptega tasks are open for Acme?"
• "Summarize Acme's risk overview."
• "Give me the executive dashboard for Acme."

Notes

• Research preview. This integration is read-only and covers the Partner Projection API's core read paths (organizations, programs, apps/subcontrols, tasks, audits, risks, projections).
• Scoping. The partner key's visibility determines which organizations and data Bumblebee can read.