> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Celigo > Connect Celigo integrator.io to Oleria to bring its users, end users, groups, roles, API token, on-premise agents, and audit activity into your identity and access graph. Connect Celigo to Oleria to extend visibility into who has access to your Celigo integrator.io account. Oleria reads users, end users, groups, roles, and the audit log from the Celigo REST API using an API token, so accounts and their access in Celigo are visible alongside the rest of your identity and access graph. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from Celigo: * **Accounts** - the account owner, every invited workspace user, and every end user. Each account carries its Celigo access level (Account owner, Administrator, Manage, Monitor, integration-level access only, or End user), its MFA and SSO requirement where Celigo reports one, and its last sign-in. Celigo runs its own MFA for password sign-ins, so Oleria treats Celigo as an MFA provider. Users who sign in with single sign-on skip Celigo's MFA unless an administrator requires it. * **Groups** - Celigo end-user groups, including which end users belong to each group. * **Roles** - Celigo custom end-user roles, including the groups and end users that hold each role. * **Non-human identities**: * **API token** - the token this integration uses, when it's a Full access service token, with its expiry and the user it acts as. A personal access token isn't shown, because it belongs to a person. * **On-premise agents** - each on-premise agent, with its version, whether it's offline, and its last heartbeat, plus the access token it authenticates with. Oleria never reads the token's value. * **Activity** - the Celigo audit log, including sign-ins with their IP address, access grants, access changes and removals, account enable and disable events, role changes, and API token events. > [!NOTE] > > Celigo is an integration platform (iPaaS). Oleria connects to its identity and access surface only. Integrations, flows, connections, exports, imports, and AI agent steps are out of scope. ## Remediation actions With this integration connected, Oleria can take the following actions in Celigo: | Action | What it does | Revert | | :- | :- | :- | | Disable user | Disables every Celigo access record the user holds, workspace and end user. Celigo can't disable a workspace invitation that hasn't been accepted: Oleria leaves it in place, and refuses the action if that's the only access the user has. Cancel the invitation in Celigo. If Celigo applies only some of the changes, the action fails and can't be reverted; check the user in Celigo. | Re-enables only the records Oleria disabled. | | Enable user | Re-enables every disabled Celigo access record the user holds. If Celigo applies only some of the changes, the action fails and can't be reverted; check the user in Celigo. | Disables only the records Oleria enabled. | | Add user to group | Adds an end user to a Celigo group. If Oleria can't confirm the change afterwards, the action fails and can't be reverted; check the user's groups in Celigo. | Removes the membership Oleria added. | | Remove user from group | Removes an end user's manual membership from a Celigo group. Memberships synced from your identity provider can't be removed. If Oleria can't confirm the change afterwards, the action fails and can't be reverted; check the user's groups in Celigo. | Restores the membership Oleria removed. | | Create user | Invites the person as a Celigo end user, the least-privileged Celigo user, with the name and email address you provide, and adds them to the groups you choose. Fails if the person is already an end user. | Revokes the end-user access Oleria created. If the action fails after Celigo sends the invitation, there's nothing to revert: revoke the end user in Celigo. | | Delete user | Removes every Celigo access record the user holds, workspace and end user, including a pending workspace invitation. | Not supported. Celigo can't restore a deleted user. Invite the user again. | | Create group | Creates a Celigo end-user group with the name you provide. Fails if a group with that name exists. | Deletes the group, only while it has no members, roles, or resource grants. | Oleria never disables or deletes the Celigo account owner or the identity the integration connects as. **Create user**, **Delete user**, and **Create group** need a token that acts as the account owner or an administrator, as Celigo requires for these changes. ## Prerequisites * A Celigo account owner or administrator, to generate a Full access service token or their own personal access token * Your Celigo region: United States (`integrator.io`), Europe (`eu.integrator.io`), Australia (`au.integrator.io`), or Canada (`ca.integrator.io`) * Admin access to the Oleria workspace ## Required permissions Celigo has no granular API scopes for this integration. Every read and every action requires one of these tokens: * A service token with the **Full access** scope, created by an account owner or administrator. We recommend this token, because it belongs to the account rather than a person. * A personal access token of an account owner or administrator. It has its owner's access, stops working while its owner is disabled, and is deleted when its **Auto purge token** period ends, 90 days by default. A **Custom** service token can't read users, groups, roles, or the audit log, so Oleria rejects it when you connect. Oleria also rejects personal access tokens of users with the Manage or Monitor access level, and on-premise agent tokens. ## Generate a service token in Celigo **1. Open API tokens** Sign in to Celigo and go to **Resources** -> **API tokens**. **2. Generate a token** Select **Generate token** and choose **Service token**. Enter a name, such as `oleria`, and choose an **Auto purge token** period. > [!WARNING] > > When the auto purge period ends, Celigo deletes the token and the Oleria sync stops. Choose **Never**, or generate a new token and update the connection in Oleria before the token expires. **3. Grant full access** Under **Token permissions**, set **Scope** to **Full access**, then select **Generate token**. **4. Copy the token** Copy the token. Owners and administrators can show a service token again later with **Reveal token**. > [!NOTE] > > To use a personal access token instead, choose **Personal access token** in the same dialog. It has no scope to set, and only you can reveal it later. Replace it in Oleria before its **Auto purge token** period ends. See Celigo's [authentication documentation](https://developer.celigo.com/api/getting-started/authentication). ## Connect Celigo to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **Celigo**. **2. Complete the connection form** Select **Continue** and provide the following: | Field | Notes | | :- | :- | | Region | Required. The Celigo region your account is in. Tokens only work in the region where they were created. | | API token | Required. The Full access service token (recommended), or an owner's or administrator's personal access token. | **3. Confirm the connection** Select **Authenticate** to validate the token. Find the newly connected Celigo instance on the **Connected** tab of your Oleria **Integrations** page. ## Verify the integration Confirm the Celigo instance appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, you can review the discovered accounts, groups, roles, API token, on-premise agents, and activity in your Oleria workspace. ## Known limitations * **Other API tokens** - Celigo's API doesn't list API tokens, so Oleria discovers only the token this integration uses, when it's a Full access service token, and on-premise agents' tokens. Other tokens appear only as audit events. * **Groups and roles are for end users** - Celigo groups and custom roles apply only to end users, who access the account's MCP servers. Workspace users have an access level and per-integration access instead. * **Per-integration access** - access granted on individual integrations isn't mapped, because integrations are out of scope. * **Pending invitations** - Celigo doesn't let you disable a workspace invitation that hasn't been accepted. Disable user leaves it in place, and fails if it's the user's only access. Cancel the invitation in Celigo. * **One environment per connection** - the integration reads the environment of the token it uses. Celigo sandbox environments have separate access and need their own token and connection. * **No last password change** - Celigo's API doesn't expose password change dates or failed sign-ins. * **Audit retention** - Celigo returns audit events from the last year at most, depending on your Celigo plan. * **Plan requirement** - Celigo's free plan doesn't include API tokens. A trial or paid Celigo plan is required. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.