Skip to main content
SAP LeanIX is an enterprise architecture management platform. Connect a LeanIX workspace to Oleria to bring its users, technical users (API tokens), roles, and sign-in and permission activity into your identity and access graph. This page provides step-by-step guidance for connecting LeanIX to Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your LeanIX workspace:
  • Users - every person with access to the workspace, including pending invitations, with their workspace role. Archived users and each user’s last sign-in are included when LeanIX returns them.
  • Technical users - the machine identities behind LeanIX API tokens, with each token’s description and expiry date. Oleria never reads the token value.
  • Roles - the three standard workspace roles (Admin, Member, and Viewer) and any custom roles your identity provider assigns, and which role each user holds.
  • Activity - workspace events such as sign-ins, failed sign-ins, permission and role changes, invitations, API token changes, and domain, SSO, and workspace setting changes.
Oleria uses this data for dormant account detection, API token hygiene, and access reviews, refreshed on Oleria’s regular sync schedule.
LeanIX has no user group object, so Oleria doesn’t discover groups. Oleria doesn’t sync Fact Sheets or other workspace content - only the identities and access around them.

​
Prerequisites

  • A LeanIX administrator who can create a technical user. A technical user isn’t tied to a person, so the integration keeps working when someone leaves your organization.
  • Your LeanIX subdomain - the part of your workspace URL before .leanix.net (for example, eu).
  • Admin access on the Oleria platform to add a new integration.
The exact location of these settings can change over time. If the steps below don’t match what you see, refer to the SAP LeanIX documentation on technical users.

​
Create a technical user in LeanIX

1

Open Technical Users

In LeanIX, open the user profile menu, select Administration, and then go to Technical Users.
2

Create the technical user

Select New Technical User and fill in the details:Select Save.
3

Copy the API token

LeanIX displays the API token for the new technical user once.
LeanIX shows the API token only once. Copy and store it securely before you close the dialog - you can’t retrieve it again. If you lose it, replace the token on the technical user and update the integration in Oleria.
4

Copy the Workspace ID (recommended)

In the administration area, open API Tokens and copy the WorkspaceId value. If you leave it empty, Oleria tries to find the workspace from the API token and your technical users, and asks for the ID if it can’t.

​
Connect LeanIX to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the LeanIX tile.
2

Complete the connection form

Fill in the connection form:
3

Authenticate

Select Authenticate to validate the credentials and save the integration. Oleria checks that the technical user can read the workspace’s users before saving.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs users, roles, API tokens, and activity from LeanIX on its regular sync schedule once the initial sync completes.
Each connection covers one LeanIX workspace. To connect more workspaces, create a technical user in each and add a separate integration for each.
If you replace the API token on the technical user, LeanIX disables the previous token immediately. Update the API token in Oleria by editing the integration. An update must use a token from the same workspace.

​
Remediation actions

The technical user’s Admin permission role is what authorizes these actions, so no extra setting is needed in Oleria: Oleria never changes the technical user whose token the integration itself uses. If Oleria can’t tell which technical user its API token belongs to, it refuses actions on every technical user with the Admin permission role that it can’t tell apart from its own, so it can’t lock itself out. Change those users in LeanIX directly. Oleria also doesn’t change roles when your workspace takes roles from your identity provider, because the provider overwrites them at the next sign-in. Viewer is LeanIX’s base role, so it can’t be removed - archive the user instead. Enabling a user doesn’t accept a pending invitation on the invitee’s behalf, and it can’t reactivate a user archived at the account level (for example by your identity provider) - do that in LeanIX or your identity provider.

​
Known limitations

  • No groups. LeanIX has no user group object, so Oleria doesn’t discover groups or group membership.
  • No Fact Sheets or other content. Oleria discovers who has access to the workspace, not the architecture content inside it.
  • MFA and SSO status is mostly unavailable. LeanIX doesn’t expose how users authenticate, so Oleria shows MFA as unavailable. SSO shows as configured only for users your identity provider provisions through SCIM.
  • Account-level administrators and SAP support users without a workspace permission aren’t discovered. LeanIX doesn’t list them through the workspace API.
  • Token expiry needs the technical user listing. If the technical user can’t read it, users still sync, without each token’s expiry date.
  • Activity needs permission to read workspace events. If LeanIX denies it, Oleria skips activity with a warning, and users and roles still sync.
  • Oleria can’t create LeanIX users. Invite new users in LeanIX.
  • This integration hasn’t been verified against a live LeanIX workspace yet. Before you rely on a remediation action, try it on a test user in a test workspace and confirm the result in LeanIX, especially that disabling an API token user stops its token from authenticating.
  • Changes in LeanIX appear after the next sync.

​
Contact us

For questions about this integration, contact us at support@oleria.com.