> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ConfigCat

> Connect your ConfigCat organization to Oleria to continuously discover who can change your feature flags: members, pending invitations, organization roles, product permission groups, SDK keys, Proxy profiles, and audit log activity.

ConfigCat is a feature flag service. Connect ConfigCat to Oleria to see every member of your ConfigCat organization and every pending invitation, the organization roles and product permission groups that decide who can change which feature flags in which environment, and the SDK keys and Proxy profiles that can read your flag configuration. Oleria connects with a ConfigCat Public API credential.

Oleria reads access to the organization, its products, and each product's configs and environments. It doesn't list individual feature flags. Access to them appears through the permission groups and environments that grant it.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your ConfigCat organization:

* **Accounts** - every organization member, with their organization role, administrator status, and whether they turned on two-factor authentication. Pending invitations appear as disabled accounts, with the product and permission group they would grant, when they were sent, and when they expire. The organization's creator shows when they created the organization, from the audit log.
* **Non-human identities** - SDK keys, one for each config and environment, plus the secondary key while a key rotation is in progress. Each SDK key is paired with a credential that shows it's active and limited to downloading that config's JSON for that environment. Oleria never stores SDK key values. Each primary SDK key shows when it was issued and is linked as owned by the member who created its config or environment, from the audit log. An SDK key's last activity is when an application last connected with it. Proxy profiles also appear, with when the profile was last used and the configs and environments of the SDK keys selected for the profile. Each Proxy profile shows when it was created and is linked as owned by the member who created it, from the audit log. Each Proxy profile is paired with a credential for its secret. ConfigCat never returns the secret value, so the credential shows only that it exists.
* **Roles** - the organization roles **Organization Admin** and **Billing Manager**, an **Organization Member** role for members who hold neither, and every product's permission groups, with the members who hold each. ConfigCat has no **Organization Member** role, so Oleria marks it as modeled. Permission groups are marked as custom, because you can rename, edit, and delete every one of them in ConfigCat.
* **Resources** - the organization, its products, and each product's configs and environments, with each one's creation date from the audit log, and who can reach each one:
  * Members of a permission group get the group's product permissions, such as managing team members or creating and deleting configs, and full or read-only access to feature flag values in each environment the group allows.
  * Organization Admins are shown as owners of the organization and every product.
  * Billing Managers get billing and subscription access to the organization, and no product access.
  * SDK keys and Proxy profiles can download the config JSON of their config and environment.
* **Activity** - events from the organization audit log across every product, such as changes to products, configs, environments, feature flags, segments, permission groups, members and invitations, SDK keys, Public API credentials, SAML and provisioning settings, Proxy profiles, and change requests. Each event reads as a sentence, such as "Ann Admin created a new config Main Config", is linked to the member who made it, and links to the product or config it affected, or to the organization. When an application connects with an SDK key, the event is linked to that SDK key. Oleria never copies SDK key values from the audit log.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model).

## Prerequisites

* A ConfigCat user with the **Organization Admin** role. Use a dedicated user if you can. Oleria never changes the access of the user the connection authenticates as.
* Admin access to the Oleria workspace.

Each Oleria integration covers one ConfigCat organization. If you have several organizations, add one integration for each.

## Required permissions

ConfigCat has no API scopes. A Public API credential acts with the permissions of the user who created it.

| Capability | ConfigCat permission |
| :- | :- |
| Read users | `Organization Admin` |
| Read roles | `Organization Admin` |
| All [remediation actions](#remediation-actions) | `Organization Admin` |

Oleria checks the role when you connect and doesn't save a credential whose user isn't an Organization Admin, because ConfigCat then returns only part of the member list.

## Create a Public API credential in ConfigCat

**1. Sign in as an Organization Admin**

Sign in to the ConfigCat dashboard as the user the connection will use.

**2. Create the credential**

Go to **My account** -> **Public API credentials** and create a credential. Copy its **Basic auth user name** and **Basic auth password**.

**3. Copy your organization ID (only if needed)**

You need the organization ID only if the user belongs to more than one ConfigCat organization. Open your organization's page in the ConfigCat dashboard and copy the ID from the address, the part after `/organization/`.

## Connect ConfigCat to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations**, then select the **ConfigCat** tile.

**2. Complete the connection form**

| Field | Notes |
| :- | :- |
| Basic auth user name | Required. The user name of the Public API credential. |
| Basic auth password | Required. The password of the same credential. When you edit the integration, the field is labeled **Basic auth password (optional)**: leave it blank to keep the stored password. Enter it again if you change the user name or the API base URL. |
| API base URL (optional) | Only for ConfigCat On-Premise. Leave it blank to use `https://api.configcat.com`. For ConfigCat On-Premise, enter your Management API address. It must be an `https` address without a path, query, or credentials. |
| Organization ID (optional) | Only if the credential's user belongs to several organizations. Leave it blank if the user belongs to one organization. You can't change it after you connect. |

**3. Authenticate**

Select **Authenticate**. Oleria checks the credential, finds the organization, and confirms that the user is an Organization Admin before it saves the integration. If the user belongs to several organizations and you left **Organization ID** blank, Oleria asks you to enter it.

> [!NOTE]
>
> To connect ConfigCat On-Premise, first contact Oleria support to allow your Management API host. The host must be reachable over HTTPS. Oleria rejects private and loopback addresses.

## Verify the integration

Confirm ConfigCat appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered members, roles, products, SDK keys, and Proxy profiles in your Oleria workspace.

The integration's **Capabilities** tab shows **Read users** and **Read roles** with the `Organization Admin` permission and checks it against your credential. **Read groups** shows as not supported, because ConfigCat has no user groups.

> [!NOTE]
>
> If you replace the Public API credential in ConfigCat, update it in Oleria by editing the integration.

## Remediation actions

Beyond discovery, Oleria can act on ConfigCat access to remediate risk. Every action needs the `Organization Admin` role on the credential's user. Oleria checks the role before an action runs and reports it if it's missing.

| Action | What it does | Revert |
| :- | :- | :- |
| Create user | Invites the email into the product permission groups you choose, one per product. At least one permission group is required. ConfigCat takes only the email; the invitee sets their name when they sign up. If the email is already a member, or already invited to that product, nothing changes. If an invitation fails, Oleria revokes the ones it already sent. | Yes - revokes the invitations it sent that are still pending. If the user already accepted one, the revert reports a failure; remove the user with **Disable account** instead. |
| Add user to role | Adds a member to a product permission group, or grants the **Organization Admin** or **Billing Manager** role. A member holds one permission group per product, so the new group replaces the one they held in that product. Granting **Organization Admin** removes the member from their product permission groups, because the role covers every product. | Yes - restores the previous permission group, or removes the member from the product if they had none. For an organization role, removes the role, and after **Organization Admin** adds the member back to the permission groups they held. |
| Remove user from role | Removes a member from a product permission group, which removes them from that product, or removes the **Organization Admin** or **Billing Manager** role. | Yes - adds the permission group or role back. Restoring **Organization Admin** is refused if the member has joined a product permission group since, because the role would remove them from it. |
| Revoke access | Removes a member from a product. Only product access can be revoked. If the member is an **Organization Admin**, Oleria refuses without changing anything, because the role covers every product; remove the role instead. | Yes - adds the member back to the permission group they held. |
| Disable account | ConfigCat has no disabled state for members, so Oleria removes the member from the organization. Oleria first records the member's email and product permission groups. For a pending invitation, Oleria revokes the invitation. | Partly - invites the member's email again into each recorded permission group. The member has to accept the invitation. The **Organization Admin** and **Billing Manager** roles aren't restored, so grant them again in ConfigCat. A member who held no permission group isn't invited again. A revoked invitation is sent again to the same product and permission group. |

If the account is already in the requested state, the action changes nothing and there's nothing to reverse. Oleria doesn't reverse an action if someone changed the member's permission group in that product since, so it doesn't overwrite the newer change.

**Organization Member** can't be added or removed as a role. To remove a member from the organization, use **Disable account**. Oleria won't act on the user the connection authenticates as.

## Known limitations

* **No user groups.** ConfigCat's Public Management API has no user groups. Groups that your identity provider syncs to ConfigCat aren't collected.
* **No single sign-on status.** The API doesn't expose your sign-in methods, SAML configuration, or two-factor enforcement settings, so single sign-on shows as unavailable. Two-factor authentication shows whether each member turned it on, without the factor type.
* **Dates come from the audit log.** ConfigCat doesn't expose when a member last signed in, when they joined, or when they last changed their password. Oleria takes each member's last activity from their audit log events, and the audit log records changes, not sign-ins. Join dates are available only for the organization's creator, and only within your plan's audit log retention. Creation dates of resources, SDK keys, and Proxy profiles also come from the audit log, so objects created before that retention show none.
* **Activity depends on your plan.** Oleria reads the audit log as far back as your ConfigCat plan keeps it: 7, 35, or 750 days, depending on the plan. If your plan doesn't include audit log access, Oleria syncs everything else without activity. Events by former members keep their email but aren't linked to an account.
* **SDK keys and Proxy profiles can't be disabled.** The API has no way to disable, revoke, or rotate an SDK key. A Proxy profile can only be deleted or have its secret regenerated, and neither can be undone. Oleria doesn't offer **Disable NHI** for ConfigCat. Rotate or delete them in ConfigCat.
* **Some credentials aren't listed.** The API doesn't list Public API credentials, so Oleria doesn't inventory them. Their creation and removal appear as activity. Webhook signing keys aren't collected either.
* **SDK key and Proxy profile owners come from the audit log.** ConfigCat doesn't record who created them, so Oleria reads it from the creation events. Objects created before your plan's audit log retention, or by a former member, show no owner. A secondary SDK key shows no creation date.
* **Feature flags aren't listed individually.** Access to flags appears at the config and environment level.
* **Large organizations take longer to sync.** ConfigCat returns SDK keys one config and environment at a time, within its rate limit.
* **On-Premise links.** For ConfigCat On-Premise, Oleria doesn't link resources to the ConfigCat dashboard, because the dashboard address isn't known.
* **One organization per integration.** Add one integration for each ConfigCat organization.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.