> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Automation Anywhere

> Connect your Automation 360 Control Room to Oleria to bring users, bot runners, roles, and Credential Vault access into your identity and access graph.

Connect Automation Anywhere to Oleria to see who builds and runs bots in your Automation 360 Control Room, which unattended runner identities execute them, and who can reach the Credential Vault lockers that hold the passwords your bots use to sign in to other systems. Oleria reads this data from the Control Room API using a dedicated Control Room user. It works with Automation 360 Cloud and with on-premises Control Rooms.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Control Room:

* **Accounts** - every Control Room user, with status, e-mail address, last sign-in, roles, and licenses.
* **Non-human identities** - unattended Bot Runner users, and users that devices run bots as, appear as non-human identities of type **Application**, linked to the user who created them. User API keys appear as credentials of their user, and Credential Vault credentials appear as secrets owned by their Control Room owner. Oleria never reads credential values.
* **User groups** - the directory groups that Active Directory or SSO users belong to.
* **Roles** - system and custom Control Room roles with their permissions, and the license features (such as Bot Creator or Unattended Bot Runner) assigned to each user.
* **Resources** - Credential Vault lockers and credentials, device pools, devices, workload queues, repository folders, and bots in the public workspace.
* **Access** - who owns, manages, participates in, or consumes each locker; credential owners; device pool owners and consumers; each device's default run-as user; workload queue members, participants, and consumers; the folder permissions each role grants; what each role's permissions allow on each kind of resource; and the run-as users listed on the connector user's role (shown as users the connector user can run bots as, although the setup role can't deploy bots).
* **Activity** - sign-ins, failed sign-ins, user and role changes, credential and locker changes, bot runs, and other events from the Control Room audit log.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model).

## Prerequisites

* An Automation 360 Control Room (Cloud or on-premises).
* A Control Room admin who can create users and roles.
* Admin access to the Oleria workspace.

## Create the connector user in Automation Anywhere

**1. Create a role for Oleria**

In the Control Room, go to **Administration** -> **Roles** and create a role with these permissions:

* **View users**
* **View roles**
* **View everyone's audit log actions**
* **Administer ALL lockers**
* **View and manage ALL device pools**
* **View and manage ALL devices**, for devices and their default run-as users
* **View all queues**
* **View my bots**, and **View content** on the public **Bots** folder, for repository folders and public bots
* **Generate API-Key** (under **API**), if you'll sign in with an API key

On the role's **Run as** tab, select the unattended Bot Runner users Oleria should see as run-as users. Without them, Oleria identifies unattended Bot Runner users by their license only, and doesn't show which users the connector user can run bots as. Oleria shows the connector user as able to run bots as each selected user. The role above has no bot-run permission, so the connector user can't deploy bots as them.

To use [remediation actions](#remediation-actions), also add **Edit users**, **Create users**, and **Delete users**. You can assign the `AAE_Admin` role instead of creating one, together with a role whose **Run as** tab lists the Bot Runner users.

**2. Create a dedicated user**

Go to **Administration** -> **Users**, create a user for Oleria, and assign it the role. The user doesn't need a Bot Creator or Bot Runner license.

**3. Generate an API key**

Sign in to the Control Room as the new user, open **My settings**, and select **Generate API-Key**. Copy the key; you'll paste it into Oleria in the next section.

**4. Let Oleria manage lockers (optional)**

To let Oleria remove locker members, add the connector user as an owner or manager of each locker. Go to **Manage** -> **Credentials** -> **Lockers**, edit the locker, and add the user under **Owners** or **Managers**. **Administer ALL lockers** lets Oleria read every locker, but doesn't make the connector user a member of it.

> [!WARNING]
>
> Use a dedicated user for Oleria, not a person's user. Each sign-in as the same user ends that user's previous session, so a person signing in as the connector user interrupts the sync.

Without a permission, Oleria skips the matching data and keeps syncing the rest. For example, without **View everyone's audit log actions** Oleria imports no activity, and without **View and manage ALL devices** it imports no devices.

## Connect Automation Anywhere to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations** -> select **Automation Anywhere**.

**2. Complete the connection form**

Select **Continue** and provide the following:

| Field | Notes |
| :- | :- |
| Control Room URL | Required. Your Control Room address, such as `https://acme.my.automationanywhere.digital`. Must use `https`. |
| Username | Required. The connector user you created. |
| Authentication method | **API key** (default, recommended) or **Password**. |
| API key | Required for API key sign-in. The key you generated. |
| Password | Required for password sign-in. The connector user's password. |

**3. Confirm the connection**

Select **Authenticate**. Oleria signs in to the Control Room and saves the integration.

> [!NOTE]
>
> Community Edition can't generate API keys. Use **Password** there. Community Edition users can't view other users, roles, or the audit log, so Oleria imports much less from a Community Edition Control Room.

> [!NOTE]
>
> Oleria can reach Automation 360 Cloud addresses ending in `.automationanywhere.digital`. If your Control Room uses a custom domain or runs on-premises, contact [support@oleria.com](mailto:support@oleria.com) to allow Oleria to reach it.

## Verify the integration

Confirm the Control Room appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts, bot runners, roles, lockers, and activity in your Oleria workspace.

## Remediation actions

Oleria can take these actions in Automation Anywhere:

| Action | What Oleria does | Can you revert it? |
| - | - | - |
| Disable or enable a user | Turns the user's sign-in off or on. Roles and licenses stay as they are. | Yes |
| Add or remove a role | Adds the role to the user, or removes it. | Yes |
| Disable a non-human identity | Disables an unattended Bot Runner user. | Yes |
| Create a user | Creates the user with the roles you choose, or **AAE\_Basic** if you choose none. The user starts disabled unless you ask Oleria to activate it, and gets no license. | Yes. Oleria deletes the user it created. |
| Delete a user | Deletes the user from the Control Room. | No. Automation Anywhere can't restore a deleted user. |
| Remove access to a resource | Removes a user from a Credential Vault locker. | Yes. Oleria adds the user back with the same locker permissions. |

Keep these limits in mind:

* Changing users needs **Edit users**, creating them needs **Create users**, and deleting them needs **Delete users**. Removing a locker member needs the connector user to be an owner or manager of that locker. See [Let Oleria manage lockers](#create-the-connector-user-in-automation-anywhere).
* Oleria won't act on the connector user itself, and it won't remove a locker's owner.
* Oleria doesn't add or remove license features, and it won't remove a user's last role.
* To stop an API key, disable its user. Oleria doesn't delete Credential Vault credentials, because their values can't be restored.

## Known limitations

* Automation Anywhere has no API for SSO, multi-factor authentication, or password policy settings. Multi-factor authentication for SSO users is enforced by your identity provider.
* Oleria doesn't import bots in private workspaces, schedules, Co-Pilot teams, or OAuth clients.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.