Skip to main content
Connect Accela to Oleria to see who works in your Accela Civic Platform agency, which user group they hold in each Civic Platform module, which department they belong to, and who is an inspector. Oleria reads this from the Accela Construct API through an agency app that signs in as a dedicated Civic Platform service user, so you can review agency staff access from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from one environment of your Accela agency:
  • Accounts - every agency staff user in the environment, with their name, email address, login ID, job title, employee ID, and department. Users whose status is Enabled are imported as enabled; every other user, for example a disabled or locked user, is imported as disabled. Users whose department’s division is PUBLIC, such as contract or self-certified inspectors, are shown as external users. Oleria also keeps each user’s department levels, middle name, phone numbers, and any disabled user group memberships with the account, and marks the service user that Oleria signs in as.
  • Account roles - each account is shown as either an Inspector, when the user is one of the agency’s inspectors, or an Agency user.
  • Roles - every Civic Platform user group assigned to at least one user, named after its module and group, for example Building — ADMIN. A user can hold several roles. Oleria shows a user as a member of a user group unless Civic Platform marks that membership as disabled.
  • Groups - every department in the agency, and the users who belong to it. Each group’s description shows the department’s levels, from agency down to office.
Oleria refreshes this data on its regular sync schedule.
Oleria doesn’t import citizen (public) users, records, inspections, parcels, documents, payments, or any other Civic Platform content. This integration covers identity and access governance for agency staff users, user groups, and departments only, so Oleria doesn’t populate Access Inventory or resource-level Access Graph data for Accela.

​
Prerequisites

  • An Accela Civic Platform agency that you can reach through the Accela Construct API.
  • An account on the Accela Developer Portal, to register an agency app.
  • An Accela administrator who can enable that app for your agency in the Accela Construct Admin Portal. For an Accela-hosted agency, this may need Accela support.
  • A Civic Platform administrator, to create the service user and its user group.
  • Admin access to the Oleria workspace.
Oleria signs in as the service user with its password, so the integration stops working if that password expires or changes, or if the user is disabled or locked. Use a dedicated service user rather than an employee’s account, and store the app secret and password as an administrative credential.

​
Set up Accela for Oleria

1

Register an agency app

Sign in to the Accela Developer Portal at developer.accela.com, open My Apps, and register an Agency app. A Citizen app doesn’t work. Copy the app’s App ID and App secret, and store them securely until you’ve connected Oleria.
2

Enable the app for your agency

Ask your Accela administrator to enable the app for your agency in the Accela Construct Admin Portal, under Agencies -> your agency -> Apps. The app must be enabled for the agency and environment you connect. Oleria requests the users, settings, and inspections scopes, and only reads data.
3

Create a service user

In Civic Platform, go to Admin Tools -> Users and create a dedicated service user with a local Civic Platform password. A user that can only sign in through single sign-on can’t be used. On the user, set Password change so that an administrator changes the password, set User must change password at next logon to No, and set the Password time-out time frame and Account disable time frame so that the password doesn’t expire and the account isn’t disabled for inactivity while Oleria is using it.
4

Grant read-only access

Give the service user a user group with these function identifiers (FIDs) set to Read Only:
5

Note your agency name and environment

Note your Accela Construct agency name, and the environment you want to connect, for example PROD or TEST. Ask your Accela administrator, or Accela support for an Accela-hosted agency, if you don’t know them.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Accela’s own documentation.

​
Connect Accela to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Accela.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria signs in as the service user, and checks that the sign-in is for the agency you entered and includes the users and settings scopes. It then checks that it can read the service user’s own account, list agency users, and list departments. Oleria also tries to read a department’s staff and the inspector list. If either of these can’t be read, the connection still succeeds, and the affected details are left out (see Known limitations). The exception is Civic Platform before 9.0: there, department staff is the only source of accounts, so Authenticate fails if it can’t be read. Find the newly connected agency on the Connected tab of your Oleria Integrations page.
If Authenticate fails, Oleria shows the reason. The most common causes:
  • The App ID or App secret is rejected. Copy both again from My Apps on the Accela Developer Portal, and check that the app is an Agency app.
  • The service user’s login ID or password is rejected. Check them in Civic Platform under Admin Tools -> Users. The user needs a local Civic Platform password, and must be enabled and not locked.
  • The app isn’t enabled for the agency and environment. Ask your Accela administrator to enable it in the Accela Construct Admin Portal, and check that the Agency name and Environment match your agency’s configuration.
  • The sign-in is missing a required scope. The agency app must be allowed the users, settings, and inspections scopes.
  • The sign-in belongs to a different agency than the one you entered. Check the Agency name.
  • The service user can’t list agency users or departments. Give its user group FID 0004 (Admin Users) and FID 0045 (Admin Organization Hierarchy) with Read Only access.
  • The agency’s Civic Platform environment doesn’t answer. Check the Environment, or try again later if the environment is down.
  • Accela’s hourly API limit for the app is used up. Try again after the limit resets.
You can connect each environment of an Accela agency to Oleria once. To connect another environment, such as TEST alongside PROD, add it as a separate integration.

​
Verify the integration

Confirm the Accela agency appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, user groups, and departments in your Oleria workspace.
If you rotate the app secret or change the service user’s password, update the integration in Oleria with the new value. To keep a stored secret when you edit the integration, leave the App secret or Service user password field empty. If you change the App ID, enter its App secret again; if you change the Service user login ID, enter its password again. You can’t change the Agency name or Environment of an integration: to connect a different agency or environment, add a new integration.

​
Remediation actions

This integration doesn’t support remediation actions. The Accela Construct API only lets Oleria read agency users, user groups, departments, and inspectors, so make access changes in Civic Platform under Admin Tools -> Users.

​
Known limitations

  • No activity. The Accela Construct API has no audit log, so Oleria doesn’t import sign-ins or administrative changes.
  • No dormancy data. The API doesn’t return a user’s last login, creation date, or last password change, so Oleria can’t detect dormant Accela accounts.
  • No MFA or SSO data. The API doesn’t expose sign-in settings. Oleria shows MFA and SSO status for Accela accounts as unavailable rather than guessing. If you enforce SSO through an identity provider, Oleria shows that through the identity provider’s integration.
  • No administrators flagged. Civic Platform permissions come from the FIDs on each user group, and the API doesn’t return them. Oleria doesn’t mark any Accela account as an administrator, and roles show user group membership, not the FIDs a user group grants.
  • User groups without members. The API only returns user groups as part of each user, so a user group that isn’t assigned to anyone isn’t shown.
  • Disabled memberships. A user group membership that Civic Platform marks as disabled isn’t shown as a role membership. It’s kept with the account instead.
  • Flat departments. Departments are shown as separate groups, without their hierarchy. Each group’s description lists its department levels.
  • Job titles and employee IDs need FID 0045. If the service user can’t read department staff, accounts have no job title or employee ID, and may have a less complete name.
  • Inspectors need the inspections scope. If the inspector list can’t be read, every account is shown as an Agency user for that sync.
  • Civic Platform before 9.0. If your Civic Platform version can’t list agency users, Oleria reads accounts from each department’s staff instead. These users have no status, so every account is shown as enabled. In this case the service user needs FID 0004 and FID 0045, or Authenticate and syncs fail.
  • No apps, API credentials, or AI agents. The API doesn’t list agency apps, their secrets, or AI agents. The service user appears as an ordinary account.
  • Construct Admin Portal and Developer Portal accounts. Accounts that exist only in the Accela Construct Admin Portal or the Accela Developer Portal, without a Civic Platform user, aren’t imported.
  • Password sign-in. Accela access tokens last 15 minutes and refresh tokens 8 hours. Oleria renews the access token with the refresh token, and signs in again with the stored password when the refresh token expires. If the password expires or changes, or the service user is disabled or locked, syncs fail until you update the integration or fix the user. Oleria only signs in through the API, and it isn’t confirmed that API sign-ins update the user’s Last login date, so set the service user’s Account disable time frame so that Civic Platform doesn’t disable it for inactivity.
  • Shared API limit. Accela limits API calls per hour for each app. Oleria paces its requests to about two a second, and when Accela reports that 20 or fewer calls remain, it waits until the limit resets, for up to five minutes at a time.

​
Contact us

For questions about this integration, contact us at support@oleria.com.