> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Checkly > Connect your Checkly account to Oleria to continuously discover members, pending invitations, roles, MFA and SSO status, and private locations as non-human identities. Checkly is a synthetic monitoring and monitoring-as-code platform. Connect your Checkly account to Oleria to see everyone who can reach it, with their role, MFA and single sign-on (SSO) status, and the private locations whose agents run your checks, so you can find over-privileged access and remove it directly from Oleria. Oleria reads this data from the Checkly Public API with an API key. Oleria reads access to the Checkly account itself. It doesn't import checks, check groups, dashboards, status pages, alert channels, or other monitoring resources. In Checkly, a member's role applies to the whole account. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your Checkly account: * **Accounts** - every member of the account, with their name, email address, role, created date, and whether they're an administrator (the **Owner** and **Admin** roles). Oleria shows whether each member has turned on Checkly's authenticator-app MFA (TOTP). For members who sign in through SSO without TOTP, MFA is enforced (or not) by your identity provider, so Oleria shows their MFA status as unavailable. Oleria also shows whether each member signed in through SSO, and lists their sign-in methods: SSO, an authenticator app (TOTP), or both. Checkly support staff who have access to the account are shown as external users. * **Pending invitations** - invitations that haven't been accepted, including expired ones, shown as disabled accounts with the role they grant, their expiry date, and the member who sent them if that member is still in the account. * **Roles** - Checkly's five built-in roles (**Owner**, **Admin**, **Read & Write**, **Read & Run**, and **Read Only**) and any custom role that a member or invitation holds, with each member's role assignment. * **Non-human identities** - every private location, with its created date and when its agents last checked in. Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model). ## Prerequisites * A Checkly API key. Oleria accepts a service API key (recommended) or a user API key. Service API keys are available on the Starter, Team, and Enterprise plans. * The right role on the key: * **Discovery** works with any Checkly role. Reading the account, its members, and roles needs `account:read` and `members:read`, which every Checkly role includes. Reading private locations needs `private-locations:read` (every built-in Checkly role has it) and a plan that includes private locations. On a plan without private locations, Oleria skips them and still syncs everything else. If the key can't read private locations, the sync stops with an error, so private locations Oleria discovered earlier aren't removed. * **Remediation actions** need `members:delete` and `members:update`. Use the user API key of an **Owner** or **Admin**, or a service API key with the **Admin** role. * Your Checkly account ID. * Admin access on the Oleria platform to add a new integration. A Checkly API key has no scopes of its own. It acts with the permissions of its role: for a user API key, the role of the user who created it; for a service API key, the role you choose for the key. Each Oleria integration covers one Checkly account. If you have several accounts, add one integration for each. ## Create an API key Checkly offers two kinds of API key: | Key type | When to use it | | :- | :- | | **Service API key** (recommended) | Belongs to the account, not to a person, so the connection keeps working when the person who created it leaves. Give it the **Admin** role if you want Oleria to take remediation actions. Available on the Starter, Team, and Enterprise plans. | | **User API key** | Acts as the user who created it, with that user's role. Create it as an **Owner** or **Admin** if you want Oleria to take remediation actions. | **1. Create the key** **Service API key:** In Checkly, open [Settings -> API keys](https://app.checklyhq.com/settings/account/api-keys) and create a service API key. Choose the **Admin** role to allow remediation actions. **User API key:** Sign in to Checkly as an **Owner** or **Admin**, open your [user API keys](https://app.checklyhq.com/settings/user/api-keys), and create a key. **2. Copy the key** Copy the key when Checkly shows it. > [!WARNING] > > Treat the key like a password. Anyone who has it can act in Checkly with the permissions of its role. Store it securely and rotate it per your organization's security policy. **3. Find your account ID** Open [Settings -> Account -> General](https://app.checklyhq.com/settings/account/general) and copy the account ID. It's a UUID, such as `00000000-0000-0000-0000-000000000000`. > [!NOTE] > > The exact location of these settings can change over time. If the steps above don't match what you see, refer to Checkly's own documentation on API keys. ## Connect Checkly to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **Checkly**. **2. Complete the connection form** Provide the following: | Field | Notes | | :- | :- | | API key | Required. The service API key or user API key you created. | | Checkly Account ID | Required. The ID of your Checkly account, from **Settings** -> **Account** -> **General**. | | Checkly API base URL (optional) | Leave empty to use `https://api.checklyhq.com`. Only `https` addresses on `checklyhq.com` or one of its subdomains are accepted, without a port or path. | **3. Authenticate** Select **Authenticate**. Oleria checks that the key reads the Checkly account with the ID you entered and can list its members before it saves the integration. It doesn't check private locations here: if the key can't read them, the sync stops with an error. If **Authenticate** fails, check the following: * Checkly rejected the API key: check the key, and that it belongs to the account ID you entered. * Checkly denied access: the key's role needs `account:read` and `members:read` on the account. * The account wasn't found: check the account ID. ## Verify the integration Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. It's named after your Checkly account ID, for example **Checkly (00000000-0000-0000-0000-000000000000)**. After the first sync completes, you can review the discovered accounts, roles, and non-human identities in your Oleria workspace. > [!NOTE] > > To rotate the key, edit the integration and enter the new one. If you change **Checkly API base URL**, enter the API key again. You can't change the **Checkly Account ID** of an existing integration, and a new key must belong to the same account. To connect a different Checkly account, add a new integration. ## Remediation actions Beyond discovery, Oleria can act on Checkly access to remediate risk. Remediation needs the user API key of an **Owner** or **Admin**, or a service API key with the **Admin** role. Checkly has no way to report a key's permissions in advance. Before an action runs, Oleria checks that the key reads the account, that the target isn't the **Owner** or a pending invitation, and, for a role change, that they're a current member. If the key's role is missing a permission, Oleria reports Checkly's permission error. | Action | What it does | Revert | | :- | :- | :- | | Delete user | Removes the member from the Checkly account. Checkly can't deactivate a member, so removal is the only way to take access away. The person's Checkly user isn't deleted. | No - Checkly's API can't invite members. To restore access, invite the user again with their previous role in Checkly under **Account settings** -> **Members**. | | Add user to role | Sets the member's role to **Admin**, **Read & Write**, **Read & Run**, or **Read Only**. A Checkly member holds one role, so this replaces the previous one. | Yes - restores the previous built-in role while the member still holds the role Oleria set. If the previous role was a custom role, restore it in Checkly under **Account settings** -> **Members**. | A few safeguards apply: * Oleria won't remove the account **Owner** or change their role. Transfer ownership in Checkly first. * Oleria can't act on pending invitations, because Checkly's API can't revoke or change them. Remove an invitation in Checkly under **Account settings** -> **Members**. * The **Owner** role and custom roles can't be assigned through Checkly's API. Assign custom roles in Checkly under **Account settings** -> **Members**. * Checkly only lets you remove or change the role of members with less access than the key's role (for a user API key, the role of the user who created it). Otherwise Checkly refuses, and Oleria reports the error. * Re-running an action changes nothing, and there's nothing to revert: removing someone who's already been removed succeeds without changes, and setting the role a member already holds keeps that role. If someone changed the member's role in Checkly since the action ran, the revert leaves it as is. * Checkly plan limits still apply. For example, on the Hobby plan Checkly doesn't allow role changes without an upgrade to the Team plan. Oleria reports Checkly's message. * A removed member who signs in through SSO may be able to join again through just-in-time provisioning. Remove their access in your identity provider too. ## Known limitations * **No activity.** Checkly has no API for its audit log or activity log. The Activity Log is available only in the Checkly app, so Oleria doesn't import activity. * **No groups.** Checkly has no user groups or teams. Access comes only from each member's role. * **User and service API keys aren't inventoried.** Checkly's API can't list them, so Oleria doesn't show them as non-human identities. * **No last login or password change.** Checkly's API doesn't report when a member last signed in or last changed their password, so dormant accounts can't be detected from Checkly data. * **No owner for non-human identities.** Checkly's API doesn't name who created or owns a private location or its agent keys. * **Private-location agent keys aren't inventoried.** Checkly's API doesn't list a private location's agent API keys, so Oleria doesn't show them and can't disable private locations or their keys. * **Sign-in settings are per member.** Checkly's API reports whether each member has turned on authenticator-app MFA (TOTP) and whether they signed in through SSO, but not whether your account enforces SSO or MFA, or whether a member signs in with a password or a Google or GitHub account. Members who sign in through SSO without TOTP show their MFA status as unavailable, because your identity provider decides whether they use MFA. A member with neither TOTP nor SSO shows MFA as not required and their sign-in method as unavailable. * **Custom role details are limited.** Custom roles appear only when a member or invitation holds them, and Checkly's API doesn't show the permissions they grant. Holders of a custom role aren't marked as administrators. * **API key only.** Checkly doesn't offer OAuth to third-party applications, so Oleria connects with an API key. * **SAML SSO is Enterprise-only.** In Checkly, SAML single sign-on is available only on Enterprise plans and is set up by Checkly support. On other plans, no member shows SSO. * **One account per integration.** Add one integration for each Checkly account. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.