> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Coupa

Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we integrate your Coupa instance into the Oleria platform. Follow these steps to connect Coupa to your Oleria workspace using OAuth 2.0.

## Prerequisites

* Coupa administrator account with permission to manage OAuth2/OpenID Connect clients
* A Coupa instance URL (for example, `https://<instance>.coupahost.com` for customer tenants, or `https://<instance>.coupacloud.com` for partner/demo tenants)
* Admin access to the Oleria workspace

<Note>
  Standard integrations are configured with read-only permissions. Use a service account (and not an employee account) to create the OAuth2/OpenID Connect client, so the integration keeps working if the employee leaves or changes roles.
</Note>

## Create an OAuth2/OpenID Connect client in Coupa

<Steps>
  <Step title="Open OAuth2/OpenID Connect Clients">
    Log in to Coupa as an administrator, then select **Setup** -> **Integrations** -> **OAuth2/OpenID Connect Clients**.

    <Note>
      Menu names can vary slightly by Coupa release. If you don't see this option, ask your Coupa administrator or Coupa Support to enable it for your instance.
    </Note>
  </Step>

  <Step title="Create a new client">
    Select **Create** and name the client something recognizable, for example `Oleria Integration`.
  </Step>

  <Step title="Set the grant type">
    Set **Grant Type** to **Client Credentials**. This lets Oleria authenticate directly with Coupa without a user login step.
  </Step>

  <Step title="Grant read scopes">
    Grant the client read access to the following three scopes:

    | Coupa object / scope                                       | Purpose                                                                                                                                                     |
    | :--------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | Users (`core.user.read`)                                   | Identify accounts and their status. Also the source of role data - each user record carries a `roles[]` array, so no separate scope is needed to map roles. |
    | User Groups (`core.user_group.read`)                       | Map groups tied to access                                                                                                                                   |
    | User Group Memberships (`core.user_group_membership.read`) | Map which users belong to which groups                                                                                                                      |

    <Note>
      These three scopes are fixed defaults for the Oleria connector and do not depend on which Coupa modules you have licensed. Coupa does not expose a separate scope for roles.
    </Note>
  </Step>

  <Step title="Save the client credentials">
    Save the client. Coupa displays a **Client ID** and **Client Secret** - copy both now, since Coupa shows the secret only once.

    <Note>
      If you lose the client secret, create a new OAuth2/OpenID Connect client and update the credentials in Oleria.
    </Note>
  </Step>
</Steps>

## Connect Coupa to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Coupa**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field         | Notes                                                                                                                                                                          |
    | :------------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | Instance URL  | Your full Coupa instance URL, including the domain. Customer tenants use `https://<instance>.coupahost.com`; partner and demo tenants use `https://<instance>.coupacloud.com`. |
    | Client ID     | Copied from the OAuth2/OpenID Connect client you created in Coupa                                                                                                              |
    | Client Secret | Copied from the OAuth2/OpenID Connect client you created in Coupa                                                                                                              |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate** to validate the credentials. Find the newly connected Coupa instance in your Oleria workspace connected integrations.
  </Step>
</Steps>

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).