Skip to main content
Connect Highspot to Oleria to see who has access to your Highspot domain: its users, its groups, and who belongs to each group. Oleria reads identity and access data through a Highspot API key and secret that act as the Highspot user who generated them, so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Highspot domain:
  • Accounts - every verified and unverified user, with their name and email address. An unverified user was invited but hasn’t signed in yet. Suspended users are shown as disabled, and suspended and unverified users are shown with an inactive license. When Highspot reports a user’s account type, Oleria shows it as the Employee or Partner account role and marks partners as external users. Users with single sign-on details in Highspot are marked as having single sign-on configured.
  • User groups - every group the connection’s Highspot user can list, plus private groups that users belong to, and each group’s direct members.
  • Activity - events from Highspot’s audit log. Single sign-on sign-ins appear as successful or failed sign-ins. Oleria keeps every other audit event too, under its Highspot event name.
Oleria refreshes users and groups on its regular sync schedule. Activity syncs separately and trails real time by about an hour, so recent activity appears in Oleria later than users and groups.
Oleria doesn’t import spots, items, pitches, or other Highspot content. This integration covers identity and access governance for users and groups only.

​
Prerequisites

  • A Highspot user for Oleria to connect as. Oleria acts with this user’s Highspot permissions:
    • To sync, the user must be able to list users and groups.
    • To run remediation actions, the user must be able to edit users and manage group members.
  • Access to that user’s Settings > Developer > Basics page in Highspot, to generate an API key and secret.
  • Admin access to the Oleria workspace.
Generate the API key and secret as a dedicated Highspot admin user instead of a named person’s account. The credential acts as the user who generated it. If that user is suspended, leaves the company, or loses its permissions, syncs and actions can stop working. You also can’t move the integration to a different Highspot user later. See Verify the integration.

​
Generate an API key in Highspot

1

Sign in as the dedicated user

Sign in to Highspot as the user Oleria will connect as.
2

Generate the API key and secret

Go to Settings > Developer > Basics and generate an API key and secret.
3

Copy the credentials and API URL

Copy the API key, the API secret, and the API URL shown on the same page, for example https://api.highspot.com/v1.0 or https://api-<instance>.highspot.com/v1.0. You need all three to connect Highspot to Oleria.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Highspot’s own documentation.

​
Connect Highspot to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Highspot.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria reads the Highspot user the credentials belong to, and checks that this user can list users and groups, before it saves anything. Find the newly connected domain on the Connected tab of your Oleria Integrations page.
Authenticate checks that the user can list users and groups. It doesn’t check whether the user can read audit events, edit users, or manage group members. Confirm the data after the first sync, as described in Verify the integration.

​
Verify the integration

Confirm the Highspot domain appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, check that users and groups appear in your Oleria workspace. If Collect activity is on, allow about an hour, plus one sync, for audit-log activity to appear.
When you edit the integration, you can change the API URL, API key, API secret, and Collect activity. Leave API secret blank to keep the stored secret. The new credentials must belong to the same Highspot user the integration is connected as. Oleria refuses credentials of a different user. To connect as a different Highspot user, add a new integration.

​
Remediation actions

Oleria can take these actions in Highspot. Each one runs with the Highspot permissions of the user the credentials belong to:
  • Deactivate a user and reactivate a user. In Highspot, these suspend and unsuspend the user. The connection’s user needs permission to edit users.
  • Add a user to a group and remove a user from a group. These actions change direct group membership, one user at a time. The connection’s user needs permission to manage the group’s members.
Before it offers an action, Oleria checks that the credentials still work and that the connection’s user can list users or groups. Highspot doesn’t report whether a user can make changes, so Oleria can’t check this in advance. If the connection’s user lacks the permission, the action fails when it runs and Highspot makes no change. Keep these limits in mind when you use these actions:
  • Oleria reads the user or group before it changes anything. If the user is already in the requested state, Oleria makes no change.
  • After a change, Oleria reads the user or group again to confirm it. If Highspot accepted the change but the user or group still shows its old state, Oleria sets it back and reports the action as failed.
  • If Highspot accepted the change but Oleria can’t read the user or group to confirm it, the action succeeds with a note to verify the change in Highspot. Oleria doesn’t undo the change, so a suspension isn’t reversed because a confirming read failed.
  • If Highspot returns an error but the user or group still ends up in the requested state, the action succeeds but is marked unconfirmed, and Oleria won’t revert it automatically.
  • Removing a user from a group removes only that member. If other members leave the group while the action runs, Oleria lists them in the action’s result and doesn’t add them back. Only if every other member disappears at once, and there were at least two, does Oleria treat this as caused by the change, add them back, and report the action as failed.
  • Reverting an action undoes only the change that action made. If the user or group is already back in its original state, the revert makes no change. Highspot doesn’t report when a user or group last changed, so Oleria can’t tell whether someone changed it and then changed it back in between.
  • Oleria won’t deactivate the connection’s own Highspot user, or remove it from a group, because that would disconnect the integration. Highspot also refuses to suspend some protected service accounts.
  • Oleria can’t delete users or change administrative roles or group permissions.

​
Known limitations

  • Activity sync fails on any audit-log error. Highspot doesn’t document how its audit-log API responds when a domain or user can’t read audit events, so Oleria never treats a failed read as “no events.” If the activity sync keeps failing, ask Highspot to confirm that your domain has access to the audit-event API and that the connection’s user can read audit events. If your Highspot plan doesn’t include audit events, turn off Collect activity on the integration. Oleria then skips activity and keeps syncing users and groups. While activity fails, users and groups keep syncing, and Oleria retries the same time window on each sync, so no events are skipped. If it still fails, contact support@oleria.com.
  • Very large bursts of activity. Highspot’s audit-log API returns at most 500 events per page and pages by timestamp only. If more than 500 events share one timestamp, the activity sync fails rather than skip events, and the error asks you to raise it with Highspot support.
  • No administrator standing or roles. Highspot’s API doesn’t let Oleria read administrative groups or group permissions. Oleria doesn’t import roles, and doesn’t mark any Highspot user as an administrator.
  • No last-login, creation date, or MFA data on accounts. Highspot’s API doesn’t report when a user last signed in, when the user was created, or multi-factor authentication settings. Sign-ins appear as activity.
  • Account type only when Highspot reports it. If Highspot doesn’t return a user’s account type, the user has no Employee or Partner account role in Oleria.
  • Private groups need a member and read access. Oleria discovers a private group only when a user belongs to it and the connection’s user can read it. Private groups it can’t read, and memberships in them, aren’t shown.
  • No non-human identities or AI agents. Highspot’s API doesn’t list API keys, integrations, or AI agents, and doesn’t mark service accounts. Oleria doesn’t discover non-human identities or AI agents, and shows every Highspot user as a human account.
  • Highspot API addresses only. Oleria connects only to api.highspot.com and api-<instance>.highspot.com.
  • Content isn’t inventoried. Oleria doesn’t import spots, items, pitches, or the access to them.

​
Contact us

For questions about this integration, contact us at support@oleria.com.