Skip to main content
Checkly is a synthetic monitoring and monitoring-as-code platform. Connect your Checkly account to Oleria to see everyone who can reach it, with their role, MFA and single sign-on (SSO) status, and the private locations whose agents run your checks, so you can find over-privileged access and remove it directly from Oleria. Oleria reads this data from the Checkly Public API with an API key. Oleria reads access to the Checkly account itself. It doesn’t import checks, check groups, dashboards, status pages, alert channels, or other monitoring resources. In Checkly, a member’s role applies to the whole account.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Checkly account:
  • Accounts - every member of the account, with their name, email address, role, created date, and whether they’re an administrator (the Owner and Admin roles). Oleria shows whether each member has turned on Checkly’s authenticator-app MFA (TOTP). For members who sign in through SSO without TOTP, MFA is enforced (or not) by your identity provider, so Oleria shows their MFA status as unavailable. Oleria also shows whether each member signed in through SSO, and lists their sign-in methods: SSO, an authenticator app (TOTP), or both. Checkly support staff who have access to the account are shown as external users.
  • Pending invitations - invitations that haven’t been accepted, including expired ones, shown as disabled accounts with the role they grant, their expiry date, and the member who sent them if that member is still in the account.
  • Roles - Checkly’s five built-in roles (Owner, Admin, Read & Write, Read & Run, and Read Only) and any custom role that a member or invitation holds, with each member’s role assignment.
  • Non-human identities - every private location, with its created date and when its agents last checked in.
Oleria refreshes this data on its regular sync schedule.

​
Prerequisites

  • A Checkly API key. Oleria accepts a service API key (recommended) or a user API key. Service API keys are available on the Starter, Team, and Enterprise plans.
  • The right role on the key:
    • Discovery works with any Checkly role. Reading the account, its members, and roles needs account:read and members:read, which every Checkly role includes. Reading private locations needs private-locations:read (every built-in Checkly role has it) and a plan that includes private locations. On a plan without private locations, Oleria skips them and still syncs everything else. If the key can’t read private locations, the sync stops with an error, so private locations Oleria discovered earlier aren’t removed.
    • Remediation actions need members:delete and members:update. Use the user API key of an Owner or Admin, or a service API key with the Admin role.
  • Your Checkly account ID.
  • Admin access on the Oleria platform to add a new integration.
A Checkly API key has no scopes of its own. It acts with the permissions of its role: for a user API key, the role of the user who created it; for a service API key, the role you choose for the key. Each Oleria integration covers one Checkly account. If you have several accounts, add one integration for each.

​
Create an API key

Checkly offers two kinds of API key:
1

Create the key

Service API key: In Checkly, open Settings -> API keys and create a service API key. Choose the Admin role to allow remediation actions.User API key: Sign in to Checkly as an Owner or Admin, open your user API keys, and create a key.
2

Copy the key

Copy the key when Checkly shows it.
Treat the key like a password. Anyone who has it can act in Checkly with the permissions of its role. Store it securely and rotate it per your organization’s security policy.
3

Find your account ID

Open Settings -> Account -> General and copy the account ID. It’s a UUID, such as 00000000-0000-0000-0000-000000000000.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Checkly’s own documentation on API keys.

​
Connect Checkly to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Checkly.
2

Complete the connection form

Provide the following:
3

Authenticate

Select Authenticate. Oleria checks that the key reads the Checkly account with the ID you entered and can list its members before it saves the integration. It doesn’t check private locations here: if the key can’t read them, the sync stops with an error.
If Authenticate fails, check the following:
  • Checkly rejected the API key: check the key, and that it belongs to the account ID you entered.
  • Checkly denied access: the key’s role needs account:read and members:read on the account.
  • The account wasn’t found: check the account ID.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. It’s named after your Checkly account ID, for example Checkly (00000000-0000-0000-0000-000000000000). After the first sync completes, you can review the discovered accounts, roles, and non-human identities in your Oleria workspace.
To rotate the key, edit the integration and enter the new one. If you change Checkly API base URL, enter the API key again. You can’t change the Checkly Account ID of an existing integration, and a new key must belong to the same account. To connect a different Checkly account, add a new integration.

​
Remediation actions

Beyond discovery, Oleria can act on Checkly access to remediate risk. Remediation needs the user API key of an Owner or Admin, or a service API key with the Admin role. Checkly has no way to report a key’s permissions in advance. Before an action runs, Oleria checks that the key reads the account, that the target isn’t the Owner or a pending invitation, and, for a role change, that they’re a current member. If the key’s role is missing a permission, Oleria reports Checkly’s permission error. A few safeguards apply:
  • Oleria won’t remove the account Owner or change their role. Transfer ownership in Checkly first.
  • Oleria can’t act on pending invitations, because Checkly’s API can’t revoke or change them. Remove an invitation in Checkly under Account settings -> Members.
  • The Owner role and custom roles can’t be assigned through Checkly’s API. Assign custom roles in Checkly under Account settings -> Members.
  • Checkly only lets you remove or change the role of members with less access than the key’s role (for a user API key, the role of the user who created it). Otherwise Checkly refuses, and Oleria reports the error.
  • Re-running an action changes nothing, and there’s nothing to revert: removing someone who’s already been removed succeeds without changes, and setting the role a member already holds keeps that role. If someone changed the member’s role in Checkly since the action ran, the revert leaves it as is.
  • Checkly plan limits still apply. For example, on the Hobby plan Checkly doesn’t allow role changes without an upgrade to the Team plan. Oleria reports Checkly’s message.
  • A removed member who signs in through SSO may be able to join again through just-in-time provisioning. Remove their access in your identity provider too.

​
Known limitations

  • No activity. Checkly has no API for its audit log or activity log. The Activity Log is available only in the Checkly app, so Oleria doesn’t import activity.
  • No groups. Checkly has no user groups or teams. Access comes only from each member’s role.
  • User and service API keys aren’t inventoried. Checkly’s API can’t list them, so Oleria doesn’t show them as non-human identities.
  • No last login or password change. Checkly’s API doesn’t report when a member last signed in or last changed their password, so dormant accounts can’t be detected from Checkly data.
  • No owner for non-human identities. Checkly’s API doesn’t name who created or owns a private location or its agent keys.
  • Private-location agent keys aren’t inventoried. Checkly’s API doesn’t list a private location’s agent API keys, so Oleria doesn’t show them and can’t disable private locations or their keys.
  • Sign-in settings are per member. Checkly’s API reports whether each member has turned on authenticator-app MFA (TOTP) and whether they signed in through SSO, but not whether your account enforces SSO or MFA, or whether a member signs in with a password or a Google or GitHub account. Members who sign in through SSO without TOTP show their MFA status as unavailable, because your identity provider decides whether they use MFA. A member with neither TOTP nor SSO shows MFA as not required and their sign-in method as unavailable.
  • Custom role details are limited. Custom roles appear only when a member or invitation holds them, and Checkly’s API doesn’t show the permissions they grant. Holders of a custom role aren’t marked as administrators.
  • API key only. Checkly doesn’t offer OAuth to third-party applications, so Oleria connects with an API key.
  • SAML SSO is Enterprise-only. In Checkly, SAML single sign-on is available only on Enterprise plans and is set up by Checkly support. On other plans, no member shows SSO.
  • One account per integration. Add one integration for each Checkly account.

​
Contact us

For questions about this integration, contact us at support@oleria.com.