What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from Celigo:- Accounts - the account owner, every invited workspace user, and every end user. Each account carries its Celigo access level (Account owner, Administrator, Manage, Monitor, integration-level access only, or End user), its MFA and SSO requirement where Celigo reports one, and its last sign-in. Celigo runs its own MFA for password sign-ins, so Oleria treats Celigo as an MFA provider. Users who sign in with single sign-on skip Celigo’s MFA unless an administrator requires it.
- Groups - Celigo end-user groups, including which end users belong to each group.
- Roles - Celigo custom end-user roles, including the groups and end users that hold each role.
- Non-human identities:
- API token - the token this integration uses, when it’s a Full access service token, with its expiry and the user it acts as. A personal access token isn’t shown, because it belongs to a person.
- On-premise agents - each on-premise agent, with its version, whether it’s offline, and its last heartbeat, plus the access token it authenticates with. Oleria never reads the token’s value.
- Activity - the Celigo audit log, including sign-ins with their IP address, access grants, access changes and removals, account enable and disable events, role changes, and API token events.
Celigo is an integration platform (iPaaS). Oleria connects to its identity and access surface only. Integrations, flows, connections, exports, imports, and AI agent steps are out of scope.
Remediation actions
With this integration connected, Oleria can take the following actions in Celigo:
Oleria never disables or deletes the Celigo account owner or the identity the integration connects as.
Create user, Delete user, and Create group need a token that acts as the account owner or an administrator, as Celigo requires for these changes.
Prerequisites
- A Celigo account owner or administrator, to generate a Full access service token or their own personal access token
- Your Celigo region: United States (
integrator.io), Europe (eu.integrator.io), Australia (au.integrator.io), or Canada (ca.integrator.io) - Admin access to the Oleria workspace
Required permissions
Celigo has no granular API scopes for this integration. Every read and every action requires one of these tokens:- A service token with the Full access scope, created by an account owner or administrator. We recommend this token, because it belongs to the account rather than a person.
- A personal access token of an account owner or administrator. It has its owner’s access, stops working while its owner is disabled, and is deleted when its Auto purge token period ends, 90 days by default.
Generate a service token in Celigo
1
Open API tokens
Sign in to Celigo and go to Resources -> API tokens.
2
Generate a token
Select Generate token and choose Service token. Enter a name, such as
oleria, and choose an Auto purge token period.3
Grant full access
Under Token permissions, set Scope to Full access, then select Generate token.
4
Copy the token
Copy the token. Owners and administrators can show a service token again later with Reveal token.
To use a personal access token instead, choose Personal access token in the same dialog. It has no scope to set, and only you can reveal it later. Replace it in Oleria before its Auto purge token period ends. See Celigo’s authentication documentation.
Connect Celigo to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select Celigo.
2
Complete the connection form
Select Continue and provide the following:
3
Confirm the connection
Select Authenticate to validate the token. Find the newly connected Celigo instance on the Connected tab of your Oleria Integrations page.
Verify the integration
Confirm the Celigo instance appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered accounts, groups, roles, API token, on-premise agents, and activity in your Oleria workspace.Known limitations
- Other API tokens - Celigo’s API doesn’t list API tokens, so Oleria discovers only the token this integration uses, when it’s a Full access service token, and on-premise agents’ tokens. Other tokens appear only as audit events.
- Groups and roles are for end users - Celigo groups and custom roles apply only to end users, who access the account’s MCP servers. Workspace users have an access level and per-integration access instead.
- Per-integration access - access granted on individual integrations isn’t mapped, because integrations are out of scope.
- Pending invitations - Celigo doesn’t let you disable a workspace invitation that hasn’t been accepted. Disable user leaves it in place, and fails if it’s the user’s only access. Cancel the invitation in Celigo.
- One environment per connection - the integration reads the environment of the token it uses. Celigo sandbox environments have separate access and need their own token and connection.
- No last password change - Celigo’s API doesn’t expose password change dates or failed sign-ins.
- Audit retention - Celigo returns audit events from the last year at most, depending on your Celigo plan.
- Plan requirement - Celigo’s free plan doesn’t include API tokens. A trial or paid Celigo plan is required.