> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Airtable

> Connect your Airtable Enterprise account to Oleria to continuously discover and map who has access to your workspaces, bases, and enterprise groups.

Connect your Airtable Enterprise account to Oleria to gain continuous visibility into who has access across your workspaces and bases, and to review activity across your Airtable enterprise. Oleria reads identity, access, and audit data from the Airtable Enterprise Admin API, so you can see every account, group, role, and access change in one place. This page provides step-by-step guidance for connecting Airtable to Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Airtable enterprise:

* **Accounts** - enterprise users and service accounts, including admin status, license type, and activity status.
* **Groups** - enterprise user groups and their membership.
* **Roles and permission levels** - the five Airtable permission levels (read, comment, edit, create, owner), modeled as roles, with effective access resolved across direct, group, and workspace-inherited collaboration.
* **Resources** - workspaces and bases, and the collaborators and groups with access to each.
* **Audit activity** - enterprise-wide audit log events such as user creation, permission changes, and login activity, covering a 180-day retention window.

<Note>
  Oleria does not currently discover access granted via Airtable share links (public or
  link-based sharing of a base or view), and does not inventory Airtable personal access
  tokens or OAuth integrations as non-human identities - Airtable's enterprise API exposes
  no endpoint to enumerate them. Airtable service accounts are discovered and appear as
  accounts. Activity performed by PATs or OAuth integrations still appears in audit events.
  If your enterprise relies on share links or on PAT-based automation, that access will not
  appear in Oleria's inventory.
</Note>

## Prerequisites

* Airtable Enterprise Scale plan - the Enterprise Admin and Audit Log API is not available on other plans
* Enterprise admin access in Airtable, to create a Personal Access Token with enterprise scopes
* Your Airtable Enterprise Account ID, found in the Airtable admin panel

## Create a Personal Access Token in Airtable

Oleria connects using a Personal Access Token (PAT) scoped to your Airtable enterprise account.

<Steps>
  <Step title="Open personal access tokens in Airtable">
    Sign in to [airtable.com](https://airtable.com) and go to **Builder Hub** -> **Personal access tokens**.
  </Step>

  <Step title="Create a token with the required scopes">
    Create a new token and give it a recognizable name such as `Oleria connector`. Grant the following scopes:

    | Capability           | Scope                       | Used for                                                         |
    | :------------------- | :-------------------------- | :--------------------------------------------------------------- |
    | Enterprise account   | `enterprise.account:read`   | Discovery                                                        |
    | Users                | `enterprise.user:read`      | Discovery                                                        |
    | Groups               | `enterprise.groups:read`    | Discovery                                                        |
    | Audit log            | `enterprise.auditLogs:read` | Discovery (audit activity)                                       |
    | Workspaces and bases | `workspacesAndBases:read`   | Discovery (resources)                                            |
    | User management      | `enterprise.user:write`     | Remediation (remove user from enterprise, grant or revoke admin) |

    <Note>
      The `enterprise.user:write` scope is only required if you want Oleria to take remediation actions. Omit it for read-only discovery.
    </Note>
  </Step>

  <Step title="Copy your Enterprise Account ID and token">
    Copy and save the following values - you will need them when connecting in Oleria:

    * **Enterprise Account ID** - found in your Airtable admin panel URL. It starts with `ent` (for example, `entXXXXXXXXXXXXX`).
    * **Personal Access Token** - the token value shown when you create the token.

    <Warning>
      The token value is shown only once. Store it securely - if you lose it, you must create a new token and update the connection in Oleria.
    </Warning>
  </Step>
</Steps>

## Connect Airtable to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Airtable**.
  </Step>

  <Step title="Complete the connection form">
    Fill in the connection form:

    | Field                 | Notes                                                                                                                                                |
    | :-------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- |
    | Enterprise Account ID | Required. Paste the Enterprise Account ID from the Airtable admin panel. Starts with `ent` and cannot be changed after the integration is connected. |
    | Personal Access Token | Required. Paste the Personal Access Token you created in Airtable. The form labels this field **API Token**.                                         |
  </Step>

  <Step title="Save the integration">
    Select **Authenticate** to validate and save the integration.
  </Step>
</Steps>

## Verify the integration

Confirm the Airtable instance appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered accounts, groups, roles, resources, and activity in your Oleria workspace.

<Note>
  When you rotate the Airtable Personal Access Token, update the token in Oleria by editing the integration. An expired or revoked token will cause discovery to stop.
</Note>

## Remediation actions

Beyond discovery, Oleria can act on Airtable access to remediate risk. The following actions are supported:

| Action                         | What it does                                                                                                            | Revert                                                                                                  |
| :----------------------------- | :---------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------ |
| Remove User from Enterprise    | Removes the user from the Airtable enterprise account, and from every descendant workspace and base they had access to. | Not supported. The user must be re-invited to Airtable, and their workspace and base access re-granted. |
| Grant Enterprise Admin Access  | Grants the user enterprise admin access.                                                                                | Revokes enterprise admin access.                                                                        |
| Revoke Enterprise Admin Access | Revokes the user's enterprise admin access.                                                                             | Grants enterprise admin access.                                                                         |

<Note>
  Remediation requires a Personal Access Token with the `enterprise.user:write` scope. A read-only token can still perform discovery but will return a permission error when an action runs.
</Note>

<Note>
  Reverting a grant or revoke of enterprise admin access depends on Oleria's record of the original action. If that record is missing, the revert currently reports success without contacting Airtable, so the prior admin-access change would not actually be undone. Confirm the user's admin status directly in Airtable after a revert if you have any doubt.
</Note>

<Note>
  Oleria's Airtable integration governs enterprise-level access only. Adding, removing, or updating a user's collaborator permissions on a specific workspace or base is not yet supported as a standalone remediation action. The one exception is **Remove User from Enterprise**, which cascades to every workspace and base the user could access.
</Note>

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).