Axiom

The Corma and Axiom integration keeps your Axiom organization and its members in line with the engineers who rely on it. Axiom describes itself as a data platform designed to collect, store and analyze event and telemetry data at massive scale, and says more than 30,000 organizations use it. Its pricing is usage-based, so the questions for IT are who can query your event data and which tokens can act on it.

Key takeaways

• Axiom Cloud is billed as a platform fee plus usage, and its user limit is 1,000, a soft limit that can be raised on request.
• Axiom's default roles are Owner, Admin, User, Read-only and None, and only Owners hold billing capabilities.
• Axiom personal access tokens have full control over the user's account, while API tokens are limited to the actions chosen for them.
• On Axiom Cloud, RBAC, SAML SSO, Directory Sync (SCIM) and full audit log access are paid add-ons.

Which Axiom credentials need an owner?

Axiom has two kinds of tokens. Requests authenticated with a personal access token can perform every action their user can perform, while API tokens can be restricted to chosen actions and datasets. An API token's privileges cannot be changed after creation, and a token created without an expiry date never expires. Axiom does not document what happens to tokens when the user who created them is removed.

Organizations themselves can appear outside IT's view. An AI agent can create a working Axiom organization with a single unauthenticated request, and the API token issued at that moment keeps working after a person claims the organization. Datasets can also be shared with other Axiom organizations, and deleting a sharing link does not remove access for organizations that already joined.

How Corma governs Axiom

• Members and roles under review: Owner and Admin roles, and anyone allowed to create API tokens, go into automated access reviews.
• Leavers with a token check: a leaver workflow in the IT Workflow Builder removes the person from the Axiom organization and asks an Owner to review the tokens they created.
• Tokens with an owner: API tokens and personal access tokens are non-human identities, so each one needs a named owner and an expiry date where Axiom allows it.
• Usage in the budget: the Axiom Cloud platform fee, add-ons and usage sit in SaaS subscription management.

Frequently asked questions

Does Axiom support SSO and SCIM?

Yes, as paid add-ons on the Axiom Cloud plan. SAML SSO and Directory Sync, labeled Directory Sync (SCIM) in the plan table, both run through WorkOS, and Axiom supports IdP-initiated and SP-initiated SAML flows. Axiom's pages point to WorkOS's list of supported providers rather than naming them. Read how SCIM and SAML differ.

How does Corma connect to Axiom?

Through Axiom's REST API where it fits, which can list members with their roles, add users and remove them from the organization, or through Corma's browser-based agents in Axiom's settings. See also how Corma covers observability tools such as Datadog.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to see how Corma handles Axiom members, roles and leavers? Book a Corma demo.