> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/enterprise-tier/gitlab-install.md).

# GitLab Install

Nullify integrates with GitLab.com (SaaS) and self-managed GitLab. Connecting Nullify requires two things: an access token so Nullify can call the GitLab API, and a webhook so GitLab streams repository events to Nullify.

Please reach out to our team to assist with your group setup.

## Install Nullify

### 1. Create an access token

Nullify uses a GitLab access token to resolve the group that owns each project, read diffs, and post merge-request reviews. Create either a **group access token** (recommended, so coverage applies to every project in the group) or a personal access token for a service account.

1. In GitLab, navigate to your group's **Settings → Access tokens** (or **Edit profile → Access tokens** for a personal access token).
2. Create a token with the **`api`** scope and the **Maintainer** role.
3. Provide the token to your Nullify representative. Nullify stores it encrypted and uses it for all GitLab API calls.

{% hint style="info" %}
For self-managed GitLab, also share your instance base URL (e.g. `https://gitlab.your-company.com`) so Nullify targets the correct API host.
{% endhint %}

### 2. Add the webhook

Nullify ingests GitLab events at a single endpoint. Add a webhook so GitLab delivers events to it. A **group webhook** covers every project in the group; a project webhook covers one project.

1. Navigate to **Settings → Webhooks** for your group (or project).
2. Set the **URL** to your Nullify webhook endpoint:

   ```
   https://api.<your-organization>.nullify.ai/core/gitlab/webhook
   ```

   Your Nullify representative will confirm the exact host for your stack.
3. Set the **Secret token** to the value provided by your Nullify representative. GitLab sends this in the `X-Gitlab-Token` header and Nullify verifies it on every delivery.
4. Under **Trigger**, enable the following events:
   * **Push events**
   * **Comments**
   * **Merge request events**
   * **Pipeline events**
5. Keep **SSL verification** enabled and click **Add webhook**.

{% hint style="info" %}
Nullify acknowledges deliveries it does not act on (for example pushes with no new commits) with a success response, so unrelated webhook deliveries will still show as delivered in GitLab.
{% endhint %}

### 3. Final steps

6. Wait for your stack to be provisioned by the Nullify team.
7. Once provisioned, you'll receive confirmation and can begin using Nullify to assess your GitLab projects. Open a merge request or push to a branch to trigger the first scan.

## Support

If you encounter any issues during the installation process, please contact our support team for assistance.