Skip to main content
Cloudsmith is a cloud-native package and artifact registry. Connect your Cloudsmith workspace to Oleria to see every person and machine that can read or publish packages, through which privilege, and what they did.

​
What Oleria discovers

Oleria reads your Cloudsmith workspace through the Cloudsmith REST API (https://api.cloudsmith.io/v1) on its regular sync schedule:
  • Users - workspace members with their workspace role (Owner, Manager, Member, Collaborator), email, active state, join date and last login. Two-factor status per user, and SSO status from the workspace’s SAML settings. Collaborators are marked as external users.
  • Groups - teams and their members, including service accounts, with each member’s team role (Manager or Member).
  • Roles - the four workspace roles and the two team roles, and who holds each.
  • Resources - repositories, with a link to each one, and every way a principal reaches them:
    • explicit Admin, Write or Read privileges for a user, a team or a service account
    • Owners, who always have full administrative access to every repository
    • the repository’s default privilege for Members and Managers
    • anonymous read access to public repositories
    • entitlement (download) tokens
  • Non-human identities - service accounts (with the person who created them, their role and their teams) and repository entitlement tokens (with their creator and active state).
  • Credentials - service account API keys, entitlement tokens, OpenID Connect (OIDC) provider trusts that let external CI tokens act as service accounts, and the connecting user’s own API key. Oleria never requests or stores key or token values.
  • Activity - the workspace audit log (on plans with audit log API access): logins, membership and role changes, team changes, service account and key events, entitlement token changes, SAML and two-factor policy changes, and repository events.

​
Prerequisites

  • A Cloudsmith workspace, and either an Owner account or permission to create a service account with the Manager role.
  • Admin access on the Oleria platform to add a new integration.
  • Activity from the audit log requires a Cloudsmith plan with audit log API access (Ultra or Enterprise). On other plans, Oleria syncs everything else and shows no activity. History depends on your plan’s audit log retention.

​
Choose an authentication method

Cloudsmith API keys carry no scopes: Oleria sees what the key’s owner can see. For complete coverage, use a service account with the Manager role that has Admin on every repository, or an Owner’s key. With less, Oleria still syncs what the identity can read and reports the rest as a coverage gap. Cloudsmith OIDC token exchange is designed for CI jobs that present a short-lived token from a trusted provider, so it can’t be used as a stored Oleria connection.

​
Create the credential in Cloudsmith

1

Create a service account

In Cloudsmith, go to Services on your workspace’s accounts page, and create a service account (for example, oleria) with the Manager role.
2

Grant repository access

In each repository’s settings, give the service account the Admin privilege. Oleria needs it to read the repository’s privileges and entitlement tokens, and to run repository and token actions.
3

Copy the API key

Copy the service account’s API key. Cloudsmith shows it only once, when you create the service account.
You also need your workspace slug: the short name in your Cloudsmith URLs, for example my-company in https://app.cloudsmith.com/my-company.

​
Connect Cloudsmith to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Cloudsmith tile.
2

Complete the connection form

3

Save the integration

Select Authenticate. Oleria checks that Cloudsmith authenticates the credential and that it can read the workspace and its members, then pins the connection to that workspace. When you edit the integration, leave API key or Password blank to keep the stored value.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Integrations page with a status of Healthy.

​
Remediation actions

Oleria never acts on the identity the connection uses: it won’t remove it from the workspace or a team, change its role, revoke its repository access, or rotate its key. It also never removes or demotes the last Owner of the workspace, and running Remove user from group never removes the last Manager of a team.

​
Known limitations

  • Cloudsmith has no API to suspend a member, so the leaver action removes the member.
  • Member email addresses are redacted for identities below Manager unless the workspace grants the “see unredacted emails” privilege; use a Manager or Owner identity.
  • Service accounts have no disabled state in Cloudsmith. Disable NHI covers entitlement tokens only.
  • Cloudsmith’s API doesn’t expose last password change, the workspace-wide two-factor enforcement setting, last-used times for service accounts and tokens, or other users’ personal API keys.
  • Cloudsmith’s audit log doesn’t record repository privilege changes.
  • Activity needs audit log API access, which Cloudsmith offers on Ultra and Enterprise plans. On other plans, Oleria shows no activity.

​
Contact us

For questions about this integration, contact us at support@oleria.com.