What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from the Expensify workspaces your account administers:- Accounts - every member of those workspaces, identified by the email address or phone number they sign in with. A person who belongs to several workspaces appears once. Oleria also imports each member’s approver (the person their reports are submitted to) and, when every workspace agrees on it, their employee ID.
- Roles - each workspace’s three roles: Workspace Admin, Auditor, and Employee. A member holds one role per workspace.
- Groups - each company workspace is imported as a group, with the members who belong to it.
Oleria doesn’t import reports, expenses, Expensify Cards, categories, tags, or accounting connections. Expensify’s API doesn’t provide an audit log, login history, or two-factor authentication status, so this integration has no activity data. Personal workspaces and workspaces your account doesn’t administer aren’t imported.
Prerequisites
- An Expensify login that is a Workspace Admin on every company workspace you want Oleria to govern. We recommend a dedicated login used only for this integration.
- Admin access to the Oleria workspace.
Create Integration Server credentials in Expensify
1
Sign in as the integration login
Sign in to Expensify with the login that is a Workspace Admin on every company workspace Oleria should govern.
2
Generate the credentials
Go to expensify.com/tools/integrations (Settings -> Integrations -> Integration Server credentials) and generate new credentials.
3
Copy the credentials
Copy the Partner User ID and the Partner User Secret and store them securely. Expensify shows the secret only once.
Connect Expensify to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select Expensify.
2
Complete the connection form
Select Continue and provide the following:
3
Confirm the connection
Select Authenticate to validate the credentials. Oleria checks that Expensify accepts them, that the login administers at least one company workspace, and that it can read the workspace members. Find the newly connected integration on the Connected tab of your Oleria Integrations page.
Verify the integration
Confirm Expensify appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, roles, and groups in your Oleria workspace.If you generate new credentials in Expensify, update the integration in Oleria with both new values. The new credentials must come from a login that administers at least one of the workspaces this integration already covers. To connect a different Expensify company, add a new integration. To keep the stored secret when you edit the integration, leave the field empty, unless you also change the Partner User ID.
Remediation actions
Oleria can take these actions in Expensify on the workspaces your integration login administers:- Change a member’s workspace role to Workspace Admin, Auditor, or Employee. Reverting the action restores the previous role.
- Remove a member’s role to make them an Employee on that workspace. Reverting the action restores the previous role.
- Add a user to a workspace as an Employee. Reverting the action removes them again.
- Remove a user from a workspace. Reverting the action adds them back with their previous role, approver, employee ID, custom fields, and approval limit, without sending them an invitation email. If someone already added them back, Oleria leaves that membership as it is.
- Remove a user from all administered workspaces. In Oleria this action is labeled Disable account, for example in lifecycle workflows. For Expensify it removes the user from every workspace your integration login administers. Reverting the action adds them back to each of those workspaces.
- Oleria won’t remove or demote a workspace owner, and won’t remove a member who approves other members’ reports. Change the approval workflow in Expensify first.
- Oleria won’t remove a login that is a Workspace Admin on every workspace your integration login administers, because it may be the integration login itself and removing it would disconnect the integration.
- Oleria won’t change a member whose current role it can’t restore, such as a custom or card admin role.
- If someone changes the member in Expensify while Oleria is making a change, or after it, Oleria refuses to apply or revert the change rather than overwrite theirs.
- Expensify limits how many requests an integration can make per minute, so actions on many users take several seconds each.
Known limitations
- Oleria doesn’t import Domain Admins, domain groups, Copilots, or SAML settings. Expensify’s API doesn’t provide them.
- Expensify’s API doesn’t provide an audit log or login history, so there’s no activity or dormant-account detection for Expensify.
- Oleria doesn’t import two-factor authentication or single sign-on status.
- Members of workspaces your integration login doesn’t administer aren’t visible to Oleria.
- If Expensify returns an error, or no members, for any workspace your integration login administers, the sync fails rather than removing that workspace’s members from Oleria. The sync error names the workspace. Check it in Expensify, or remove the integration login’s admin role from it, and the next sync recovers.