Add Qovery access review driver support

Register Qovery as a connector provider and add a new access review
driver that fetches organization members from the Qovery API.

Extend API key connection handling with a configurable Authorization
token scheme so Qovery can use "Token" while existing providers
continue to default to Bearer.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

apps/console/src/pages/organizations/access-reviews/dialogs/AddAccessSourceDialog.tsx

@@ -151,6 +151,9 @@ function mapAPIKeyExtraSettingToField(
     case "BETTER_STACK":
       if (settingKey === "teamName") return "betterStackTeamName";
       break;
+    case "QOVERY":
+      if (settingKey === "organizationId") return "qoveryOrganizationId";
+      break;
   }
   return null;
 }

packages/ui/src/Atoms/ThirdParties/Qovery.tsx

@@ -0,0 +1,16 @@
+import type { ComponentProps } from "react";
+
+export function Qovery(props: ComponentProps<"svg">) {
+  return (
+    <svg
+      viewBox="0 0 48 46"
+      xmlns="http://www.w3.org/2000/svg"
+      {...props}
+    >
+      <path
+        d="M25.946 44.938c-.664.845-2.021.375-2.021-.698V33.937a2.26 2.26 0 0 0-2.262-2.262H10.287c-.92 0-1.456-1.04-.92-1.788l7.48-10.471c1.07-1.497 0-3.578-1.842-3.578H1.237c-.92 0-1.456-1.04-.92-1.788L10.013.474c.214-.297.556-.474.92-.474h28.894c.92 0 1.456 1.04.92 1.788l-7.48 10.471c-1.07 1.498 0 3.579 1.842 3.579h11.377c.943 0 1.473 1.088.89 1.83L25.947 44.94z"
+        fill="#863BFF"
+      />
+    </svg>
+  );
+}

packages/ui/src/Atoms/ThirdParties/ThirdPartyLogo.tsx

@@ -44,6 +44,7 @@ import { OnePassword } from "./OnePassword";
 import { OpenAI } from "./OpenAI";
 import { PagerDuty } from "./PagerDuty";
 import { PostHog } from "./PostHog";
+import { Qovery } from "./Qovery";
 import { Resend } from "./Resend";
 import { SendGrid } from "./SendGrid";
 import { Sentry } from "./Sentry";
@@ -89,6 +90,7 @@ const thirdParties: Record<string, FC<ComponentProps<"svg">>> = {
   OPENAI: OpenAI,
   PAGERDUTY: PagerDuty,
   POSTHOG: PostHog,
+  QOVERY: Qovery,
   RESEND: Resend,
   SENDGRID: SendGrid,
   SENTRY: Sentry,

packages/ui/src/Atoms/ThirdParties/index.ts

@@ -28,6 +28,7 @@ export { OnePassword } from "./OnePassword";
 export { OpenAI } from "./OpenAI";
 export { PagerDuty } from "./PagerDuty";
 export { PostHog } from "./PostHog";
+export { Qovery } from "./Qovery";
 export { Resend } from "./Resend";
 export { SendGrid } from "./SendGrid";
 export { Sentry } from "./Sentry";

pkg/accessreview/drivers/name_resolver.go

@@ -298,6 +298,60 @@ func (r *tallyNameResolver) ResolveInstanceName(ctx context.Context) (string, er
 	return resp.Name, nil
 }
 
+// qoveryNameResolver resolves the Qovery organization name.
+type qoveryNameResolver struct {
+	httpClient     *http.Client
+	organizationID string
+}
+
+func NewQoveryNameResolver(httpClient *http.Client, organizationID string) NameResolver {
+	return &qoveryNameResolver{
+		httpClient:     httpClient,
+		organizationID: organizationID,
+	}
+}
+
+func (r *qoveryNameResolver) ResolveInstanceName(ctx context.Context) (string, error) {
+	if r.organizationID == "" {
+		return "", nil
+	}
+
+	endpoint, err := url.JoinPath(qoveryAPIBaseURL, "organization", url.PathEscape(r.organizationID))
+	if err != nil {
+		return "", fmt.Errorf("cannot build qovery organization URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return "", fmt.Errorf("cannot create qovery organization request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	httpResp, err := r.httpClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("cannot execute qovery organization request: %w", err)
+	}
+
+	defer func() { _ = httpResp.Body.Close() }()
+
+	// Best-effort: a non-2xx (revoked token, deleted org, stale ID) must not
+	// make the source-name worker retry forever. Give up gracefully and keep
+	// the generic source name; a dead token surfaces on the next ListAccounts.
+	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
+		return "", nil
+	}
+
+	var resp struct {
+		Name string `json:"name"`
+	}
+	if err := json.NewDecoder(httpResp.Body).Decode(&resp); err != nil {
+		return "", fmt.Errorf("cannot decode qovery organization response: %w", err)
+	}
+
+	return resp.Name, nil
+}
+
 // hubspotNameResolver resolves the HubSpot account name.
 type hubspotNameResolver struct {
 	httpClient *http.Client

pkg/accessreview/drivers/name_resolver_test.go

@@ -185,6 +185,76 @@ func TestSentryNameResolver(t *testing.T) {
 	}
 }
 
+func TestQoveryNameResolver(t *testing.T) {
+	t.Parallel()
+
+	t.Run("empty organization id returns nothing without HTTP call", func(t *testing.T) {
+		t.Parallel()
+
+		client := &http.Client{Transport: roundTripperFunc(func(*http.Request) (*http.Response, error) {
+			t.Fatalf("resolver should not make an HTTP call for an empty organization id")
+			return nil, nil
+		})}
+
+		got, err := NewQoveryNameResolver(client, "").ResolveInstanceName(context.Background())
+		require.NoError(t, err)
+		assert.Empty(t, got)
+	})
+
+	cases := []struct {
+		name   string
+		status int
+		body   string
+		want   string
+	}{
+		{
+			name:   "200 returns name",
+			status: http.StatusOK,
+			body:   `{"id":"26ac87db-ae79-4be4-bd33-7f839f0e1647","name":"Acme Inc"}`,
+			want:   "Acme Inc",
+		},
+		{
+			name:   "401 is terminal (no error, no name)",
+			status: http.StatusUnauthorized,
+			body:   `{"error":"unauthorized"}`,
+			want:   "",
+		},
+		{
+			name:   "404 is terminal (no error, no name)",
+			status: http.StatusNotFound,
+			body:   `{"error":"not found"}`,
+			want:   "",
+		},
+		{
+			name:   "500 is terminal (no error, no name)",
+			status: http.StatusInternalServerError,
+			body:   `{"error":"boom"}`,
+			want:   "",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				assert.Equal(t, http.MethodGet, r.Method)
+				assert.Equal(t, "/organization/26ac87db-ae79-4be4-bd33-7f839f0e1647", r.URL.Path)
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(tc.status)
+				_, _ = w.Write([]byte(tc.body))
+			}))
+			defer srv.Close()
+
+			client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+			got, err := NewQoveryNameResolver(client, "26ac87db-ae79-4be4-bd33-7f839f0e1647").ResolveInstanceName(context.Background())
+			require.NoError(t, err)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
 func TestTailscaleNameResolver(t *testing.T) {
 	t.Parallel()
 

pkg/accessreview/drivers/qovery.go

@@ -0,0 +1,164 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+const qoveryAPIBaseURL = "https://api.qovery.com"
+
+type QoveryDriver struct {
+	httpClient     *http.Client
+	organizationID string
+}
+
+var _ Driver = (*QoveryDriver)(nil)
+
+type qoveryMembersResponse struct {
+	Results []qoveryMember `json:"results"`
+}
+
+type qoveryMember struct {
+	ID             string `json:"id"`
+	Name           string `json:"name"`
+	Nickname       string `json:"nickname"`
+	Email          string `json:"email"`
+	LastActivityAt string `json:"last_activity_at"`
+	CreatedAt      string `json:"created_at"`
+	Role           string `json:"role"`
+}
+
+func NewQoveryDriver(httpClient *http.Client, organizationID string) *QoveryDriver {
+	return &QoveryDriver{
+		httpClient:     httpClient,
+		organizationID: organizationID,
+	}
+}
+
+func (d *QoveryDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error) {
+	endpoint, err := url.JoinPath(
+		qoveryAPIBaseURL,
+		"organization",
+		url.PathEscape(d.organizationID),
+		"member",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot build qovery members URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create qovery members request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	httpResp, err := d.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot execute qovery members request: %w", err)
+	}
+
+	defer func() {
+		_ = httpResp.Body.Close()
+	}()
+
+	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
+		return nil, fmt.Errorf("cannot fetch qovery members: unexpected status %d", httpResp.StatusCode)
+	}
+
+	var resp qoveryMembersResponse
+	if err := json.NewDecoder(httpResp.Body).Decode(&resp); err != nil {
+		return nil, fmt.Errorf("cannot decode qovery members response: %w", err)
+	}
+
+	records := make([]AccountRecord, 0, len(resp.Results))
+	for _, member := range resp.Results {
+		if member.Email == "" {
+			continue
+		}
+
+		record := AccountRecord{
+			Email:       member.Email,
+			FullName:    qoveryFullName(member),
+			Role:        qoveryRole(member.Role),
+			IsAdmin:     qoveryIsAdmin(member.Role),
+			MFAStatus:   coredata.MFAStatusUnknown,
+			AuthMethod:  coredata.AccessEntryAuthMethodUnknown,
+			AccountType: coredata.AccessEntryAccountTypeUser,
+			ExternalID:  member.ID,
+		}
+
+		if member.LastActivityAt != "" {
+			if t, err := time.Parse(time.RFC3339, member.LastActivityAt); err == nil {
+				record.LastLogin = &t
+			}
+		}
+
+		if member.CreatedAt != "" {
+			if t, err := time.Parse(time.RFC3339, member.CreatedAt); err == nil {
+				record.CreatedAt = &t
+			}
+		}
+
+		records = append(records, record)
+	}
+
+	return records, nil
+}
+
+func qoveryFullName(member qoveryMember) string {
+	if member.Name != "" {
+		return member.Name
+	}
+
+	if member.Nickname != "" {
+		return member.Nickname
+	}
+
+	return member.Email
+}
+
+func qoveryRole(role string) string {
+	switch strings.ToUpper(role) {
+	case "OWNER":
+		return "Owner"
+	case "ADMIN":
+		return "Admin"
+	case "DEVELOPER":
+		return "Developer"
+	case "VIEWER":
+		return "Viewer"
+	default:
+		return role
+	}
+}
+
+func qoveryIsAdmin(role string) bool {
+	switch strings.ToUpper(role) {
+	case "OWNER", "ADMIN":
+		return true
+	default:
+		return false
+	}
+}

pkg/accessreview/drivers/qovery_test.go

@@ -0,0 +1,119 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestQoveryDriverListAccounts(t *testing.T) {
+	t.Parallel()
+
+	rec := newRecorder(t, "testdata/qovery", "QOVERY_API_TOKEN")
+
+	authValue := ""
+	if token := os.Getenv("QOVERY_API_TOKEN"); token != "" {
+		authValue = "Token " + token
+	}
+
+	client := newVCRClient(rec, authValue)
+
+	orgID := os.Getenv("QOVERY_ORG_ID")
+	if orgID == "" {
+		orgID = "11111111-2222-3333-4444-555555555555"
+	}
+
+	driver := NewQoveryDriver(client, orgID)
+	records, err := driver.ListAccounts(context.Background())
+	require.NoError(t, err)
+
+	// Three members in the cassette; the third has no email and is dropped.
+	require.Len(t, records, 2)
+
+	// Owner: built-in OWNER role → admin; name + both timestamps populated.
+	// Qovery member IDs are the IdP subject (e.g. "google-oauth2|<sub>").
+	assert.Equal(t, "jane.doe@example.com", records[0].Email)
+	assert.Equal(t, "Jane Doe", records[0].FullName)
+	assert.Equal(t, "Owner", records[0].Role)
+	assert.True(t, records[0].IsAdmin)
+	assert.Equal(t, "google-oauth2|100000000000000000001", records[0].ExternalID)
+	require.NotNil(t, records[0].LastLogin)
+	require.NotNil(t, records[0].CreatedAt)
+	assert.Nil(t, records[0].Active)
+
+	// Developer: empty name falls back to nickname; null last_activity_at
+	// leaves LastLogin nil.
+	assert.Equal(t, "john.smith@example.com", records[1].Email)
+	assert.Equal(t, "john", records[1].FullName)
+	assert.Equal(t, "Developer", records[1].Role)
+	assert.False(t, records[1].IsAdmin)
+	assert.Equal(t, "google-oauth2|100000000000000000002", records[1].ExternalID)
+	assert.Nil(t, records[1].LastLogin)
+	require.NotNil(t, records[1].CreatedAt)
+}
+
+func TestQoveryDriverListAccountsError(t *testing.T) {
+	t.Parallel()
+
+	client := &http.Client{
+		Transport: roundTripFunc(
+			func(req *http.Request) (*http.Response, error) {
+				return &http.Response{
+					StatusCode: http.StatusUnauthorized,
+					Body:       io.NopCloser(strings.NewReader(`{"error":"unauthorized"}`)),
+					Header:     make(http.Header),
+				}, nil
+			},
+		),
+	}
+
+	driver := NewQoveryDriver(client, "26ac87db-ae79-4be4-bd33-7f839f0e1647")
+	_, err := driver.ListAccounts(context.Background())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unexpected status 401")
+}
+
+func TestQoveryRole(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		in      string
+		want    string
+		isAdmin bool
+	}{
+		{in: "OWNER", want: "Owner", isAdmin: true},
+		{in: "ADMIN", want: "Admin", isAdmin: true},
+		{in: "DEVELOPER", want: "Developer", isAdmin: false},
+		{in: "VIEWER", want: "Viewer", isAdmin: false},
+		{in: "future_role", want: "future_role", isAdmin: false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.in, func(t *testing.T) {
+			t.Parallel()
+
+			assert.Equal(t, c.want, qoveryRole(c.in))
+			assert.Equal(t, c.isAdmin, qoveryIsAdmin(c.in))
+		})
+	}
+}

pkg/accessreview/drivers/testdata/qovery.yaml

@@ -0,0 +1,40 @@
+---
+# Anonymized from a real GET /organization/{id}/member recording against a
+# Qovery organization (token stripped by the recorder). Real PII (org ID,
+# member IdP subject IDs, names, emails, avatar URL, role IDs) replaced with
+# synthetic values; two extra members were added to keep coverage (nickname
+# fallback when name is empty, and an emailless member that is dropped). The
+# member object shape (id, created_at/updated_at/last_activity_at, name,
+# nickname, email, role, role_name, role_id, invitation_status) mirrors the
+# live response, including the "google-oauth2|<sub>" IdP-subject id format.
+version: 2
+interactions:
+    - id: 0
+      request:
+        proto: HTTP/1.1
+        proto_major: 1
+        proto_minor: 1
+        content_length: 0
+        host: api.qovery.com
+        headers:
+            Accept:
+                - application/json
+        url: https://api.qovery.com/organization/11111111-2222-3333-4444-555555555555/member
+        method: GET
+      response:
+        proto: HTTP/2.0
+        proto_major: 2
+        proto_minor: 0
+        content_length: -1
+        uncompressed: true
+        body: '{"results":[{"id":"google-oauth2|100000000000000000001","created_at":"2025-01-04T12:00:00.000Z","updated_at":"2026-02-18T09:03:11.000Z","last_activity_at":"2026-02-18T09:03:11.000Z","name":"Jane Doe","nickname":"jane","profile_picture_url":"https://example.com/avatar/jane.png","email":"jane.doe@example.com","role":"OWNER","role_name":"Owner","role_id":"22222222-2222-2222-2222-222222222222","invitation_status":"ACCEPTED"},{"id":"google-oauth2|100000000000000000002","created_at":"2025-03-10T08:15:00.000Z","updated_at":"2025-03-10T08:15:00.000Z","name":"","nickname":"john","profile_picture_url":null,"email":"john.smith@example.com","role":"DEVELOPER","role_name":"Developer","role_id":"33333333-3333-3333-3333-333333333333","invitation_status":"ACCEPTED"},{"id":"google-oauth2|100000000000000000003","created_at":"2025-04-01T10:00:00.000Z","updated_at":"2025-04-01T10:00:00.000Z","name":"No Email","nickname":"noemail","profile_picture_url":null,"email":"","role":"VIEWER","role_name":"Viewer","role_id":"44444444-4444-4444-4444-444444444444","invitation_status":"PENDING"}]}'
+        headers:
+            Content-Type:
+                - application/json
+            Strict-Transport-Security:
+                - max-age=31536000; includeSubDomains
+            Vary:
+                - Accept-Encoding
+        status: 200 OK
+        code: 200
+        duration: 563.650542ms

pkg/connector/provider/builtin.go

@@ -51,6 +51,7 @@ func NewBuiltinRegistry() *Registry {
 		openaiRegistration(),
 		posthogRegistration(),
 		pagerdutyRegistration(),
+		qoveryRegistration(),
 		resendRegistration(),
 		sendgridRegistration(),
 		sentryRegistration(),

pkg/connector/provider/qovery.go

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func qoveryRegistration() *Registration {
+	return &Registration{
+		Provider:         coredata.ConnectorProviderQovery,
+		DisplayName:      "Qovery",
+		SupportsAPIKey:   true,
+		APIKeyAuthScheme: "Token",
+		ExtraSettings: []ExtraSetting{
+			{Key: "organizationId", Label: "Organization ID", Required: true},
+		},
+		NewDriver: func(_ context.Context, c *http.Client, conn *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			s, err := coredata.ConnectorSettings[coredata.QoveryConnectorSettings](conn)
+			if err != nil {
+				return nil, fmt.Errorf("cannot read qovery connector settings: %w", err)
+			}
+
+			if s.OrganizationID == "" {
+				return nil, fmt.Errorf("cannot create qovery driver: organization_id is required")
+			}
+
+			return drivers.NewQoveryDriver(c, s.OrganizationID), nil
+		},
+		NewNameResolver: func(ctx context.Context, c *http.Client, conn *coredata.Connector, logger *log.Logger) drivers.NameResolver {
+			s, err := coredata.ConnectorSettings[coredata.QoveryConnectorSettings](conn)
+			if err != nil {
+				logger.ErrorCtx(ctx, "cannot read qovery connector settings", log.Error(err))
+				return nil
+			}
+
+			return drivers.NewQoveryNameResolver(c, s.OrganizationID)
+		},
+	}
+}

pkg/connector/provider/qovery_test.go

@@ -0,0 +1,106 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.gearno.de/kit/httpclient"
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/connector/provider"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func TestQoveryRegistrationMetadata(t *testing.T) {
+	t.Parallel()
+
+	r := provider.NewBuiltinRegistry()
+	reg, ok := r.Get(coredata.ConnectorProviderQovery)
+	require.True(t, ok, "qovery provider must be registered")
+
+	assert.Equal(t, "Qovery", reg.DisplayName)
+	assert.True(t, reg.SupportsAPIKey)
+	assert.Equal(t, "Token", reg.APIKeyAuthScheme)
+	require.Len(t, reg.ExtraSettings, 1)
+	assert.Equal(t, "organizationId", reg.ExtraSettings[0].Key)
+	assert.Equal(t, "Organization ID", reg.ExtraSettings[0].Label)
+	assert.True(t, reg.ExtraSettings[0].Required)
+}
+
+func TestQoveryNewDriver(t *testing.T) {
+	t.Parallel()
+
+	r := provider.NewBuiltinRegistry()
+	reg, ok := r.Get(coredata.ConnectorProviderQovery)
+	require.True(t, ok, "qovery provider must be registered")
+	require.NotNil(t, reg.NewDriver, "qovery NewDriver closure must be wired")
+
+	t.Run("creates driver with valid organization_id", func(t *testing.T) {
+		t.Parallel()
+
+		raw, err := json.Marshal(&coredata.QoveryConnectorSettings{
+			OrganizationID: "c4f2de4d-3e50-4f98-bf00-065778f7f5b5",
+		})
+		require.NoError(t, err)
+
+		conn := &coredata.Connector{
+			Provider:    coredata.ConnectorProviderQovery,
+			RawSettings: raw,
+		}
+
+		drv, err := reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
+		require.NoError(t, err)
+		assert.IsType(t, &drivers.QoveryDriver{}, drv)
+	})
+
+	t.Run("errors when organization_id is missing", func(t *testing.T) {
+		t.Parallel()
+
+		conn := &coredata.Connector{
+			Provider:    coredata.ConnectorProviderQovery,
+			RawSettings: []byte(`{}`),
+		}
+
+		_, err := reg.NewDriver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "organization_id is required")
+	})
+}
+
+func TestQoveryNewNameResolver(t *testing.T) {
+	t.Parallel()
+
+	r := provider.NewBuiltinRegistry()
+	reg, ok := r.Get(coredata.ConnectorProviderQovery)
+	require.True(t, ok, "qovery provider must be registered")
+	require.NotNil(t, reg.NewNameResolver, "qovery NewNameResolver closure must be wired")
+
+	raw, err := json.Marshal(&coredata.QoveryConnectorSettings{
+		OrganizationID: "c4f2de4d-3e50-4f98-bf00-065778f7f5b5",
+	})
+	require.NoError(t, err)
+
+	conn := &coredata.Connector{
+		Provider:    coredata.ConnectorProviderQovery,
+		RawSettings: raw,
+	}
+
+	resolver := reg.NewNameResolver(context.Background(), httpclient.DefaultClient(httpclient.WithSSRFProtection()), conn, nil)
+	require.NotNil(t, resolver, "qovery name resolver must be constructed for a valid connector")
+}

pkg/coredata/connector_provider.go

@@ -62,6 +62,7 @@ const (
 	ConnectorProviderDatadog      ConnectorProvider = "DATADOG"
 	ConnectorProviderOkta         ConnectorProvider = "OKTA"
 	ConnectorProviderZendesk      ConnectorProvider = "ZENDESK"
+	ConnectorProviderQovery       ConnectorProvider = "QOVERY"
 )
 
 var (
@@ -111,6 +112,7 @@ func ConnectorProviders() []ConnectorProvider {
 		ConnectorProviderDatadog,
 		ConnectorProviderOkta,
 		ConnectorProviderZendesk,
+		ConnectorProviderQovery,
 	}
 }
 
@@ -155,7 +157,8 @@ func (v ConnectorProvider) IsValid() bool {
 		ConnectorProviderCursor,
 		ConnectorProviderDatadog,
 		ConnectorProviderOkta,
-		ConnectorProviderZendesk:
+		ConnectorProviderZendesk,
+		ConnectorProviderQovery:
 		return true
 	}
 

pkg/coredata/connector_settings.go

@@ -140,6 +140,10 @@ type (
 	BetterStackConnectorSettings struct {
 		TeamName string `json:"team_name"`
 	}
+
+	QoveryConnectorSettings struct {
+		OrganizationID string `json:"organization_id"`
+	}
 )
 
 // GrantType returns the OAuth2 grant type recorded on the connector's

pkg/coredata/migrations/20260608T617248Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE connector_provider ADD VALUE IF NOT EXISTS 'QOVERY';

pkg/server/api/console/v1/connector_settings.go

@@ -160,6 +160,12 @@ func apiKeyConnectorSettings(input types.CreateAPIKeyConnectorInput) (json.RawMe
 		}
 
 		return json.Marshal(&coredata.BetterStackConnectorSettings{TeamName: *input.BetterStackTeamName})
+	case coredata.ConnectorProviderQovery:
+		if input.QoveryOrganizationID == nil || *input.QoveryOrganizationID == "" {
+			return nil, fmt.Errorf("cannot create qovery connector: qoveryOrganizationId is required")
+		}
+
+		return json.Marshal(&coredata.QoveryConnectorSettings{OrganizationID: *input.QoveryOrganizationID})
 	}
 
 	return nil, nil

pkg/server/api/console/v1/graphql/connector.graphql

@@ -68,6 +68,7 @@ enum ConnectorProvider
     DATADOG @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderDatadog")
     OKTA @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderOkta")
     ZENDESK @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderZendesk")
+    QOVERY @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderQovery")
 }
 
 type ConnectorProviderInfo {
@@ -146,6 +147,7 @@ input CreateAPIKeyConnectorInput {
     posthogInstanceUrl: String
     oktaDomain: String
     betterStackTeamName: String
+    qoveryOrganizationId: String
 }
 
 type CreateAPIKeyConnectorPayload {