> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # ERPNext > Connect ERPNext to Oleria to continuously discover users, roles, role profiles, user groups, DocType permissions, shared documents, API keys, OAuth clients and grants, and sign-in, change, and export activity. ERPNext is an open-source ERP built on the Frappe Framework. Connect ERPNext to Oleria to see every user and how they sign in, the roles and role profiles that grant access to each DocType, the documents shared with individual users, and the API keys and OAuth clients that can act on your site. Oleria connects with an ERPNext API key and secret. This integration works with ERPNext on Frappe Cloud and with self-hosted ERPNext, Frappe version 15 or later. It also works with other Frappe Framework apps, such as Frappe HR. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your ERPNext site: * **Accounts** - every user, with their name, username, email address, whether they're enabled, when they were created, their last sign-in and last activity, and their last password change. System users are standard accounts, website (portal) users are shown as external users, and the **Guest** user represents anonymous visitors. **Administrator** and holders of the **System Manager** role are marked as administrators. Each account shows its sign-in methods (password, the single sign-on providers the user has signed in with, and the two-factor method), whether two-factor authentication is required for it, and, when ERPNext's Employee records are readable, the user's department, designation, company, and manager. * **Non-human identities** - every user API key, OAuth client registered on your site, OAuth client secret, OAuth grant (the tokens an OAuth client holds for one user), and social login client secret, each with a credential. API keys and OAuth grants link to the user they act as, with that user's full access, and OAuth grants show their scopes and expiry. Oleria never reads API secrets, client secrets, or token values. * **Groups** - user groups and their members, and role profiles, which appear as groups whose members are the users holding the profile and which hold the profile's roles. * **Roles** - every role and who holds it, including the roles ERPNext assigns automatically: **All** and **Guest** for every user, **Desk User** for system users, and every role for **Administrator**. * **Resources** - modules and DocTypes, with the permissions each role grants on each DocType (read, write, create, delete, submit, cancel, amend, report, export, import, share, print, email, and select, per permission level), and documents shared with a user or with everyone. * **Activity** - sign-ins, sign-outs, failed sign-ins, and impersonations; changes to users, roles, role profiles, user groups, permissions, shares, user permissions, OAuth clients, social login keys, LDAP settings, and system settings; deletions of these records; and data exports, prints, and report downloads. Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model). > [!NOTE] > > Oleria doesn't import business records such as invoices or orders, except documents that are shared with a user or with everyone. ## Prerequisites * ERPNext (or another Frappe Framework site) version 15 or later, on Frappe Cloud or self-hosted. * A dedicated ERPNext system user with the **System Manager** role. The API key acts as this user and stops working if the user is disabled. * Admin access to the Oleria workspace. > [!NOTE] > > A self-hosted site must be reachable from Oleria over HTTPS at a public address. Before you connect, contact [support@oleria.com](mailto:support@oleria.com) to have your site's address allowlisted. Sites on `frappe.cloud` don't need this. Each Oleria integration covers one ERPNext site. If you have several sites, add one integration for each. ## Required permissions ERPNext API keys have no scopes. A key acts with its user's roles, and ERPNext lets only the **System Manager** role read users, roles, permissions, and logs. | Role | What it allows | | :- | :- | | **System Manager** | All discovery: users, roles, role profiles, user groups, permissions, shares, API keys, OAuth clients and tokens, settings, and activity logs. All [remediation actions](#remediation-actions). | | Read access to **Employee** (optional) | Department, designation, company, and manager on each account. Without it, these fields stay empty. The **HR User** role includes it. | | **Share** on DocTypes (optional) | Removing document shares. ERPNext only lets a user who can share a DocType remove or restore its shares, and **System Manager** doesn't include this. Give the user a role with **Read** and **Share** on each DocType whose shares Oleria should remove. | When you select **Authenticate**, Oleria refuses a key whose user doesn't hold **System Manager**. ## Create an API key **1. Create the integration user** In ERPNext, go to the **User** list and add a user for Oleria, for example `oleria@example.com`. Give it the **System Manager** role. **2. Generate keys** Open the user, go to **Settings** -> **API Access**, and select **Generate Keys**. **3. Copy the key and secret** Copy the **API Key** and the **API Secret**. ERPNext shows the secret only once. ## Connect ERPNext to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations**, then select the **ERPNext** tile. **2. Complete the connection form** | Field | Notes | | :- | :- | | ERPNext URL | The HTTPS address of your site, such as `https://example.frappe.cloud` or your own domain. Any path is ignored. You can't change it after the integration is created. | | API key | The API key you copied. | | API secret | The API secret you copied. | **3. Authenticate** Select **Authenticate**. Oleria checks that ERPNext accepts the key and that its user holds **System Manager**, then saves the integration. ## Verify the integration Confirm ERPNext appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, you can review the discovered accounts, roles, groups, DocTypes, and API keys in your Oleria workspace. > [!NOTE] > > If you generate new keys for the integration user in ERPNext, the old secret stops working. Update it in Oleria by editing the integration. Editing the integration always asks for the API secret, so enter the current one if you don't replace it. ## Remediation actions Beyond discovery, Oleria can act on ERPNext access to remediate risk. Every action needs the **System Manager** role. The share actions also need **Share** on the document's DocType (see [Required permissions](#required-permissions)). Oleria checks both before an action runs. | Action | What it does | Reversible? | | :- | :- | :- | | Disable user / Enable user | Disables or enables the user. If the user is already in that state, nothing changes. | Yes - restores the previous state. | | Add user to group / Remove user from group | Adds or removes the user in a user group. Role profiles are refused: change the user's role profile in ERPNext instead. | Yes - applies the opposite change. | | Add user to role / Remove user from role | Grants or removes a role. The automatic roles (**All**, **Guest**, **Desk User**, **Administrator**) are refused, and so is granting a disabled role. | Yes - applies the opposite change. | | Create user | Creates a disabled user (enabled only if the request activates it) without sending a welcome email, and adds it to the requested user groups. Oleria uses the password in the request, or generates one, and never shows or stores it; the user can set their own with **Forgot password**. If the user already exists, nothing changes. | Yes - deletes the user it created. | | Delete user | Deletes the user. ERPNext refuses a user that other records link to; delete or reassign those first. | No - a deleted user can't be restored. | | Create group | Creates a user group. If it exists, nothing changes. ERPNext version 16 requires every user group to have a member, so there the action fails with a message: create the group in ERPNext instead. | Yes - deletes the group while it has no members. | | Revoke permission to resource | Removes a document share with the user. Access that comes from roles on the DocType isn't a share; remove the role instead. | Yes - shares the document again with the same rights. | | Revoke anonymous access to resource | Removes a document's share with everyone. | Yes - shares it again. | | Revoke access to externally shared asset / Remove access to external accounts | Removes a document's shares with website (external) users, or with one of them. | Yes - shares it again. | | Disable NHI | For an API key, clears the key so it stops working. For an OAuth grant, deletes the OAuth client's tokens for that user. OAuth clients and client secrets aren't supported: ERPNext can only delete an OAuth client, and a social login secret can only be removed by turning off that sign-in for every user. | API key: yes - restores the same key. OAuth grant: no - the user must authorize the client again. | Oleria never disables or deletes the user the connection authenticates as, never removes that user from a group or role, and never clears that user's API key. It never changes the **Administrator** or **Guest** users. ## Known limitations * **Two-factor enrollment isn't available.** ERPNext doesn't expose whether a user has set up two-factor authentication. Oleria shows whether two-factor is required for each user, from your two-factor settings and the roles that require it. ERPNext asks a user to set it up at their next sign-in. * **Administrator and Guest aren't shown.** ERPNext hides its built-in **Administrator** and **Guest** users from every user except Administrator, so Oleria's dedicated user can't read them. * **API key use isn't logged.** ERPNext records no creation time or last use for API keys, and requests made with an API key don't appear in the activity log. Sign-in records don't say whether the user signed in with a password or single sign-on. * **Restrictions aren't shown as access.** User permissions and module profiles only narrow what a user can see, so Oleria doesn't show them as grants. Changes to user permissions appear in activity. * **OAuth scopes don't limit access.** ERPNext doesn't restrict what an OAuth token can read or change by its scopes, so Oleria shows each OAuth grant with the full access of its user. The scopes are listed for reference. * **OAuth grant expiry.** An OAuth grant shows as expired once its latest access token expires, even though the client may be able to refresh it. * **Activity retention.** ERPNext keeps sign-in records for 90 days by default (**Log Settings**), so the first sync can't import older sign-ins. * **Sessions can't be ended directly.** ERPNext offers no API to sign another user out, so there's no **Revoke user sessions** action. Disabling a user ends their sessions. * **Some credentials aren't collected.** Oleria doesn't inventory connected apps, webhook secrets, email account passwords, or the LDAP bind password. * **Custom roles.** ERPNext marks a role as custom only when its **Is Custom** option is set, so roles you created without it show as standard roles. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.