ConfigCat

ConfigCat is a feature flag service. Connect ConfigCat to Oleria to see every member of your ConfigCat organization and every pending invitation, the organization roles and product permission groups that decide who can change which feature flags in which environment, and the SDK keys and Proxy profiles that can read your flag configuration. Oleria connects with a ConfigCat Public API credential. Oleria reads access to the organization, its products, and each product’s configs and environments. It doesn’t list individual feature flags. Access to them appears through the permission groups and environments that grant it.

​

What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your ConfigCat organization:

• Accounts - every organization member, with their organization role, administrator status, and whether they turned on two-factor authentication. Pending invitations appear as disabled accounts, with the product and permission group they would grant, when they were sent, and when they expire. The organization’s creator shows when they created the organization, from the audit log.
• Non-human identities - SDK keys, one for each config and environment, plus the secondary key while a key rotation is in progress. Each SDK key is paired with a credential that shows it’s active and limited to downloading that config’s JSON for that environment. Oleria never stores SDK key values. Each primary SDK key shows when it was issued and is linked as owned by the member who created its config or environment, from the audit log. An SDK key’s last activity is when an application last connected with it. Proxy profiles also appear, with when the profile was last used and the configs and environments of the SDK keys selected for the profile. Each Proxy profile shows when it was created and is linked as owned by the member who created it, from the audit log. Each Proxy profile is paired with a credential for its secret. ConfigCat never returns the secret value, so the credential shows only that it exists.
• Roles - the organization roles Organization Admin and Billing Manager, an Organization Member role for members who hold neither, and every product’s permission groups, with the members who hold each. ConfigCat has no Organization Member role, so Oleria marks it as modeled. Permission groups are marked as custom, because you can rename, edit, and delete every one of them in ConfigCat.
• Resources - the organization, its products, and each product’s configs and environments, with each one’s creation date from the audit log, and who can reach each one:
  • Members of a permission group get the group’s product permissions, such as managing team members or creating and deleting configs, and full or read-only access to feature flag values in each environment the group allows.
  • Organization Admins are shown as owners of the organization and every product.
  • Billing Managers get billing and subscription access to the organization, and no product access.
  • SDK keys and Proxy profiles can download the config JSON of their config and environment.
• Activity - events from the organization audit log across every product, such as changes to products, configs, environments, feature flags, segments, permission groups, members and invitations, SDK keys, Public API credentials, SAML and provisioning settings, Proxy profiles, and change requests. Each event reads as a sentence, such as “Ann Admin created a new config Main Config”, is linked to the member who made it, and links to the product or config it affected, or to the organization. When an application connects with an SDK key, the event is linked to that SDK key. Oleria never copies SDK key values from the audit log.

Oleria refreshes this data on its regular sync schedule.

​

Prerequisites

• A ConfigCat user with the Organization Admin role. Use a dedicated user if you can. Oleria never changes the access of the user the connection authenticates as.
• Admin access to the Oleria workspace.

Each Oleria integration covers one ConfigCat organization. If you have several organizations, add one integration for each.

​

Required permissions

ConfigCat has no API scopes. A Public API credential acts with the permissions of the user who created it. Oleria checks the role when you connect and doesn’t save a credential whose user isn’t an Organization Admin, because ConfigCat then returns only part of the member list.

​

Create a Public API credential in ConfigCat

​

Connect ConfigCat to Oleria

​

Verify the integration

Confirm ConfigCat appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered members, roles, products, SDK keys, and Proxy profiles in your Oleria workspace. The integration’s Capabilities tab shows Read users and Read roles with the Organization Admin permission and checks it against your credential. Read groups shows as not supported, because ConfigCat has no user groups.

​

Remediation actions

Beyond discovery, Oleria can act on ConfigCat access to remediate risk. Every action needs the Organization Admin role on the credential’s user. Oleria checks the role before an action runs and reports it if it’s missing. If the account is already in the requested state, the action changes nothing and there’s nothing to reverse. Oleria doesn’t reverse an action if someone changed the member’s permission group in that product since, so it doesn’t overwrite the newer change. Organization Member can’t be added or removed as a role. To remove a member from the organization, use Disable account. Oleria won’t act on the user the connection authenticates as.

​

Known limitations

• No user groups. ConfigCat’s Public Management API has no user groups. Groups that your identity provider syncs to ConfigCat aren’t collected.
• No single sign-on status. The API doesn’t expose your sign-in methods, SAML configuration, or two-factor enforcement settings, so single sign-on shows as unavailable. Two-factor authentication shows whether each member turned it on, without the factor type.
• Dates come from the audit log. ConfigCat doesn’t expose when a member last signed in, when they joined, or when they last changed their password. Oleria takes each member’s last activity from their audit log events, and the audit log records changes, not sign-ins. Join dates are available only for the organization’s creator, and only within your plan’s audit log retention. Creation dates of resources, SDK keys, and Proxy profiles also come from the audit log, so objects created before that retention show none.
• Activity depends on your plan. Oleria reads the audit log as far back as your ConfigCat plan keeps it: 7, 35, or 750 days, depending on the plan. If your plan doesn’t include audit log access, Oleria syncs everything else without activity. Events by former members keep their email but aren’t linked to an account.
• SDK keys and Proxy profiles can’t be disabled. The API has no way to disable, revoke, or rotate an SDK key. A Proxy profile can only be deleted or have its secret regenerated, and neither can be undone. Oleria doesn’t offer Disable NHI for ConfigCat. Rotate or delete them in ConfigCat.
• Some credentials aren’t listed. The API doesn’t list Public API credentials, so Oleria doesn’t inventory them. Their creation and removal appear as activity. Webhook signing keys aren’t collected either.
• SDK key and Proxy profile owners come from the audit log. ConfigCat doesn’t record who created them, so Oleria reads it from the creation events. Objects created before your plan’s audit log retention, or by a former member, show no owner. A secondary SDK key shows no creation date.
• Feature flags aren’t listed individually. Access to flags appears at the config and environment level.
• Large organizations take longer to sync. ConfigCat returns SDK keys one config and environment at a time, within its rate limit.
• On-Premise links. For ConfigCat On-Premise, Oleria doesn’t link resources to the ConfigCat dashboard, because the dashboard address isn’t known.
• One organization per integration. Add one integration for each ConfigCat organization.

​

Contact us

For questions about this integration, contact us at support@oleria.com.