> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Attio

> Connect your Attio workspace to Oleria to continuously discover members, access levels, lists and objects with their access, webhooks, and API tokens across your CRM.

Connect Attio to Oleria to gain continuous visibility into who has access to your Attio workspace and what they can do. Oleria reads members, access levels, list and object configuration, and webhooks from the Attio API. It maps every member, list, object, and non-human identity in one place, so you can find over-privileged access and act on it directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Attio workspace:

* **Accounts** - every workspace member, including suspended members, with their name, email, access level (**Admin** or **Member**), and the date they joined. Suspended members appear as disabled accounts. On the Enterprise plan, Oleria also discovers pending invites, each member's last-modified date, and alternate email addresses. Non-human identities appear as their own accounts:
  * **Webhooks** - each webhook, its target address (domain only), its status, the events it subscribes to, and when it was created. Each webhook's signing secret appears as a credential, without its value.
  * **The integration's own access token** - the token Oleria connects with, its scopes, and the member who created it.
  * **Other API tokens, apps, and Attio's system actor** - when they created a list, so the list's creator is always known.
* **Access levels** - the **Admin** and **Member** levels, and which members hold each. Admins can manage every list and object.
* **Teams** - teams and their members, on the Attio Enterprise plan.
* **Lists and objects** - every list and object, including custom objects, with:
  * the members who have direct access to each list, and their level (**Full access**, **Read and write**, or **Read only**);
  * each list's workspace access, shown as access for all workspace members (a list with workspace access set to **No access** is private);
  * read access to every object for every member, because Attio objects have no **No access** level.
* **Activity** - list creation, attributed to the member, token, or app that created the list.

Oleria never reads any token or signing secret value. Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model).

## Prerequisites

* An Attio **workspace admin** to create the access token.
* Admin access on the Oleria platform to add a new integration.

> [!NOTE]
>
> Attio access tokens belong to the workspace, not to the person who creates them, and they don't expire. Attio records changes made with the token as made by the token, not by a person.

### Permissions Oleria needs

Set these scopes on the access token:

| Scope in Attio | Scope name | Used for |
| :- | :- | :- |
| **User Management**: Read | `user_management:read` | Members, access levels, pending invites, and teams |
| **Object Configuration**: Read | `object_configuration:read` | Objects |
| **List Configuration**: Read | `list_configuration:read` | Lists and their access |
| **Webhooks**: Read | `webhook:read` | Webhooks |

Remediation actions need **Read-write** instead of **Read** on the scopes they change:

| Scope in Attio | Scope name | Needed for |
| :- | :- | :- |
| **List Configuration**: Read-write | `list_configuration:read-write` | Revoking list access |
| **Webhooks**: Read-write | `webhook:read-write` | Deleting webhooks |
| **User Management**: Read-write | `user_management:read-write` | Member and team actions (Enterprise plan) |

Leave every other scope set to **Disabled**.

> [!NOTE]
>
> The exact location of these settings can change over time. If the steps below don't match what you see, refer to Attio's documentation on [creating an access token](https://attio.com/help/apps/other-apps/generating-an-api-key).

## Connect Attio to Oleria

**1. Create an access token in Attio**

Sign in to Attio as a workspace admin. Open **Workspace settings**, select **Developers**, and on the **Access tokens** tab select **New access token**. Name the token, for example `Oleria`.

![Attio Workspace settings, Developers page with the Access tokens tab and the New access token button](https://mintcdn.com/oleria/MkMs5NVMHb7HzVzm/images/integrations/attio/step-1-access-tokens.png?fit=max\&auto=format\&n=MkMs5NVMHb7HzVzm\&q=85\&s=e4d0b8fed2419cf98be29358711da514)

**2. Set the scopes**

In the **New access token** dialog, set **User Management**, **Object Configuration**, and **List Configuration** to **Read**.

![Attio New access token dialog with User Management, Object Configuration, and List Configuration set to Read](https://mintcdn.com/oleria/MkMs5NVMHb7HzVzm/images/integrations/attio/step-2-token-scopes.png?fit=max\&auto=format\&n=MkMs5NVMHb7HzVzm\&q=85\&s=519d8d8e269abf7f26f89f2e9c8b698a)

Scroll down and set **Webhooks** to **Read**. To use remediation actions, choose **Read-write** for the scopes listed in [Permissions Oleria needs](#permissions-oleria-needs). Select **Save**.

![Attio New access token dialog scrolled down, with Webhooks set to Read](https://mintcdn.com/oleria/MkMs5NVMHb7HzVzm/images/integrations/attio/step-2-token-scopes-webhooks.png?fit=max\&auto=format\&n=MkMs5NVMHb7HzVzm\&q=85\&s=937fa99f19657df963aa4af72de96955)

**3. Copy the token**

Select the copy icon next to the new token.

> [!WARNING]
>
> Treat the token like a password. Anyone who has it can read your workspace configuration with the scopes you selected.

**4. Find Attio in Oleria**

Go to your Oleria workspace, select **Integrations**, select the **Available** tab, and search for **Attio**.

**5. Connect in Oleria**

Select the **Attio** card, paste the token into **Access token**, and select **Authenticate**. Oleria checks the token against Attio before saving the integration.

## Verify the integration

Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered members, access levels, lists, objects, webhooks, and activity in your Oleria workspace.

> [!NOTE]
>
> If the token is missing one of the four read scopes, Oleria still saves the integration but reports it as unhealthy and names the missing scopes. Without **User Management: Read** the sync fails. Without one of the other three, Oleria skips the lists, objects, or webhooks that scope covers.

## Remediation actions

Beyond discovery, Oleria can act on Attio access to remediate risk. Oleria checks the token's scopes and your Attio plan before running any action.

| Action | Plan | Reversible? |
| :- | :- | :- |
| Revoke permission (list) | Plus or higher; access for individual members needs Pro or higher | Yes - revokes a member's direct access to a list, or makes the list private by removing workspace access. Reversed by restoring the exact previous access. |
| Disable NHI (webhook) | Any plan | No - deletes the webhook. Attio webhooks can't be paused, only deleted, and a deleted webhook can't be restored. Oleria records the webhook's settings so you can re-create it, except the path of its target URL, which can contain tokens. A re-created webhook gets a new signing secret. |
| Disable user | Enterprise | Partly - suspends the member, reversed by reactivating them. Suspending frees the member's seat and deletes their synced email and calendar data unless it was retained in Attio; reactivating doesn't restore that data. For a pending invite, the invite is cancelled and can't be restored. |
| Enable user | Enterprise | Yes - reactivates a suspended member, reversed by suspending them again. Reactivating needs a free seat, unless automatic seat assignment is on. |
| Add user to role / Remove user from role | Enterprise | Yes - makes a member an admin, or demotes an admin to member, reversed by restoring the previous level. Removing the member level isn't supported; use Disable user instead. Suspended members and invites without a level are refused. |
| Add user to group / Remove user from group (team) | Enterprise | Yes - reversed by the opposite team change. |
| Create user | Enterprise | Partly - adds the member right away if their email is on a verified domain, otherwise sends an invite. Reversed by suspending the member or cancelling the invite, because Attio never deletes members. If a suspended member with that email already exists, Oleria refuses; use Enable user instead. |
| Create group (team) | Enterprise | Yes - reversed by deleting the team while it has no members. |

A few safeguards apply to every action:

* Oleria won't suspend or demote the admin who created the integration's access token.
* Oleria won't remove the last member with **Full access** to a list, or make a list private when no member has direct **Full access**, because Attio requires at least one.
* Oleria won't revoke a workspace admin's access to a list, because admins keep access to every list. Remove the admin level first.
* Oleria won't revoke a member's direct access to a list when the list's workspace access gives the member the same level anyway. Revoke the workspace access instead.
* Oleria won't delete its own access token, or an API token, app, or system actor that it only knows from list creation.
* A reversal only undoes the change Oleria made. If someone changed the same list or member in Attio in the meantime, Oleria leaves it as is.

## Known limitations

* **Attio has no audit log API.** Logins, sessions, and configuration changes aren't available, so activity covers list creation only and dormant accounts can't be detected from Attio.
* **MFA, SSO, and sign-in methods aren't available.** Attio signs members in through Google, an emailed one-time password, or SAML SSO on the Enterprise plan, and doesn't expose which one a member uses.
* **Teams, pending invites, and member actions need the Enterprise plan.** They use Attio's SCIM API, which is available on Enterprise only. On other plans Oleria discovers everything else and skips these without failing the sync.
* **Team access to lists and objects isn't available.** You can give a team access to a list or object in Attio, but the Attio API doesn't return it.
* **Object access levels aren't available.** Oleria shows read access to every object for every member, which is the minimum Attio allows.
* **Other API tokens and installed apps are discovered only when they created a list.** Attio has no API that lists them.
* **Individual records aren't imported.** Oleria reads who can access each list and object, not the companies, people, and deals in them.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.