> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Imperva

> Connect your Imperva Cloud Security Console account to Oleria to discover users, roles, API keys, websites, and audit activity, and take governance actions directly from Oleria.

Imperva Cloud Security Console (Cloud Application Security, formerly Incapsula) protects websites and applications with a cloud WAF, DDoS protection, and CDN. Connect an Imperva account to Oleria to bring its console users, roles, API keys, websites, and audit trail into your identity and access graph. This page provides step-by-step guidance for connecting Imperva to Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Imperva account:

* **Users** - every console user of the account and its sub-accounts, with name, email, creation date, and last sign-in. Oleria also shows each user's MFA, SSO, sign-in methods, and last password change when the account's audit trail from the last 90 days records them.
* **Roles** - the built-in Administrator and Reader roles and your custom roles, which users hold them, and in which account or sub-account each role is assigned.
* **Resources** - your Imperva account, its sub-accounts, and its websites, with the access each role grants to them.
* **API keys** - every user's API keys (API ID and key) as non-human identities, with each key's owner, status, expiry date, and last use. Oleria also discovers AI Application Security API keys. Oleria never reads key values.
* **Credentials** - API keys, TLS certificates with their expiry dates, and the secrets stored for SIEM log connections (S3, SFTP, and Splunk), for credential hygiene and expiry tracking.
* **Activity** - the Imperva audit trail, including sign-ins, failed sign-ins, SSO and two-factor authentication events, password changes, user and role changes, and API key changes.

Oleria uses this data for access reviews, dormant account and API key detection, and credential expiry tracking, refreshed on Oleria's [regular sync schedule](/integrations/overview.md#sync-model).

> [!NOTE]
>
> Imperva has no user groups, so Oleria doesn't discover groups. A role in Imperva grants access only in the account or sub-account where it's assigned, so Oleria shows a role assigned in a sub-account with the sub-account's name, for example `Reader (EU Apps)`.

## Prerequisites

* An Imperva user who can manage users and API keys, such as an account admin, to create the integration user and its API key.
* A parent-account API key. A key that belongs to a sub-account user only sees that sub-account and can't read roles.
* Admin access on the Oleria platform to add a new integration.
* If your account or the integration user restricts access by IP address, add Oleria's IP addresses to the allowed list. Imperva applies the restriction to API calls too. Contact [support@oleria.com](mailto:support@oleria.com) for the current list.

> [!NOTE]
>
> The exact location of these settings can change over time. If the steps below don't match what you see, refer to the Imperva documentation on account users, roles, and API keys.

## Create a role for the integration

An Imperva API key has exactly the permissions of the user it belongs to, so create a dedicated user with a role that grants what Oleria needs.

**1. Open Roles**

In the Imperva Cloud Security Console, select **Account** > **Account Management** in the top menu bar, then select **User Management** > **Roles** in the sidebar.

**2. Create the role**

Select **New Role**, name it (for example, `Oleria integration`), and select these permissions:

| Permission | Why Oleria needs it |
| :- | :- |
| **Manage users** | Required. Reads the account's users and their roles. Also needed to create and delete users, assign and remove roles, and disable API keys. |
| **View user roles** | Recommended. Reads roles, their permissions, and who holds them. Without it, roles appear without their permissions and the **Capabilities** tab can't list the permissions the user holds. Also needed to assign and remove roles and to remove a user from a sub-account. |
| **Manage API keys** | Required. Reads every user's API keys, together with **Manage users**. Without it, Imperva shows the integration user only its own keys. Oleria checks for it when you connect, if the user can read roles. Also needed to disable API keys. |
| **Manage account sub-accounts** | Reads sub-accounts and their users, roles, websites, and API keys. If your account has sub-accounts, also needed to remove a user from a sub-account and to change roles or disable API keys in a sub-account. Enterprise plan accounts only. |
| **View audit trail** | Reads activity, and the MFA, SSO, and password evidence Oleria derives from it. |
| **View SSL Certificates** | Reads TLS certificates and their expiry dates. |

Imperva has no view-only permission for users, so the integration user can always change users, even if you only want discovery. Every permission above is also used for discovery. If you leave out any permission other than **Manage users**, Oleria discovers less, as the table describes. The built-in **Administrator** role includes every permission.

## Create the integration user and API key

**1. Add the user**

In **User Management** > **Users**, add a user for the integration, for example `oleria@yourcompany.com`, and assign it the role you created in the parent account. If you use sub-accounts, the **Manage account sub-accounts** permission gives the user access to all of them.

**2. Create the API key**

On the **Account Users** page, find the integration user, select the ellipsis in the **Actions** column, and select **Edit**. Open the **API keys** tab and select **Add API key**. Give the key a name, such as `Oleria`, and choose an expiration that matches your rotation policy.

**3. Copy the API ID and API key**

Imperva shows the API ID and API key in a popup.

> [!WARNING]
>
> Imperva shows the API key only once. Copy the API ID and API key before you close the popup - you can't retrieve the key again. If you lose it, regenerate the key and update the integration in Oleria.

## Connect Imperva to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations**, then select the **Imperva** tile.

**2. Complete the connection form**

Fill in the connection form:

| Field | Notes |
| :- | :- |
| API ID | Required. The numeric API ID shown with the key. |
| API key | Required. The API key you copied. |

**3. Authenticate**

Select **Authenticate** to validate the credentials and save the integration. Oleria checks that the key's user can read the account's users and API keys before saving. Imperva's API is global, so you don't need to choose a region.

## Verify the integration

Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. Oleria syncs users, roles, websites, API keys, and activity from Imperva on its [regular sync schedule](/integrations/overview.md#sync-model) once the initial sync completes. The integration's **Capabilities** tab lists the permissions the key's user holds, when the user has **View user roles**, and flags any that are missing.

> [!NOTE]
>
> Each connection covers one Imperva account and its sub-accounts. If you regenerate the API key, update it in Oleria by editing the integration. An update must use a key from the same Imperva account.

## Remediation actions

The permissions of the integration user's role authorize these actions:

| Action | What it does | Revert |
| :- | :- | :- |
| Create a user | Creates the user in the Imperva account with the roles you choose. Imperva emails the user a link to verify their address and set a password. If the user already exists and already holds those roles, nothing changes. If they exist without some of the roles, the action fails; use **Assign a role** instead. Needs a parent-account API key. | Deletes the user, only if Oleria created them |
| Assign a role | Adds the role to the user in the account or sub-account where the role is scoped. In a sub-account, the user must already be a member. A user can hold up to 10 roles per account. | Removes that role only |
| Remove a role | Removes the role from the user in that account or sub-account. | Adds the role back. Fails if the user has since been removed from that sub-account. |
| Delete a user | Deletes the user from the account and all its sub-accounts. Imperva also deletes the user's API keys. Needs a parent-account API key. | Not available. Invite the user again in Imperva. |
| Remove access to a sub-account | Removes the user from a sub-account, along with every role they hold there. | Adds the user back with the roles and allowed IP addresses they had |
| Disable an API key | Disables the API key so it stops authenticating. The key isn't deleted. | Re-enables the key, only if Oleria disabled it |

Oleria never assigns or removes roles for, deletes, or removes sub-account access for the user whose API key the integration uses or the Imperva account admin, and it never disables the API key the integration uses. It can disable other API keys, including the account admin's. Imperva can't lock or disable users through its API, so Oleria offers deleting a user instead of disabling them - lock users in the Imperva console if you need a reversible block. Access to the parent account and to websites comes from roles, so remove the role to revoke it. A role with **Manage account sub-accounts** in the parent account gives access to every sub-account, so Oleria doesn't remove a user from a sub-account while they hold one - remove the parent-account role instead. Oleria can disable account API keys, but not AI Application Security API keys, which Imperva can only delete.

## Known limitations

* **No groups.** Imperva has no user group object, so Oleria doesn't discover groups or group membership.
* **User status isn't available.** Imperva's API doesn't report whether a user is locked, pending activation, or has an expired password, so Oleria shows every user as enabled.
* **MFA, SSO, and password change dates come from the audit trail.** Imperva's API doesn't expose them directly. Oleria reads the last 90 days of the audit trail, so a user who hasn't signed in or changed their password in that time shows these as unavailable. This needs the **View audit trail** permission.
* **API-only users appear as regular users.** Imperva's API doesn't say which users are API-only.
* **API key creation dates and creators aren't available.** Imperva doesn't record them in its API. Each key's owner is the user it belongs to.
* **SIEM log connection secrets show as inactive.** Imperva doesn't report a status for them.
* **Reseller managed accounts aren't discovered.** A reseller connection covers the reseller's own account only.
* **Accounts, sub-accounts, and websites are the only resources.** Oleria doesn't discover DNS zones, API Security APIs, or DDoS-protected networks, which have no per-user access.
* **This integration hasn't been verified against a live Imperva account yet.** Before you rely on a remediation action, try it on a test user and confirm the result in Imperva.
* **Changes in Imperva appear after the next sync.**

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.