> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # LeanIX > Connect your SAP LeanIX workspace to Oleria to continuously discover users, API tokens, roles, and workspace activity, and take governance actions directly from Oleria. SAP LeanIX is an enterprise architecture management platform. Connect a LeanIX workspace to Oleria to bring its users, technical users (API tokens), roles, and sign-in and permission activity into your identity and access graph. This page provides step-by-step guidance for connecting LeanIX to Oleria. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your LeanIX workspace: * **Users** - every person with access to the workspace, including pending invitations, with their workspace role. Archived users and each user's last sign-in are included when LeanIX returns them. * **Technical users** - the machine identities behind LeanIX API tokens, with each token's description and expiry date. Oleria never reads the token value. * **Roles** - the three standard workspace roles (Admin, Member, and Viewer) and any custom roles your identity provider assigns, and which role each user holds. * **Activity** - workspace events such as sign-ins, failed sign-ins, permission and role changes, invitations, API token changes, and domain, SSO, and workspace setting changes. Oleria uses this data for dormant account detection, API token hygiene, and access reviews, refreshed on Oleria's [regular sync schedule](/integrations/overview.md#sync-model). > [!NOTE] > > LeanIX has no user group object, so Oleria doesn't discover groups. Oleria doesn't sync Fact Sheets or other workspace content - only the identities and access around them. ## Prerequisites * A LeanIX administrator who can create a technical user. A technical user isn't tied to a person, so the integration keeps working when someone leaves your organization. * Your LeanIX subdomain - the part of your workspace URL before `.leanix.net` (for example, `eu`). * Admin access on the Oleria platform to add a new integration. > [!NOTE] > > The exact location of these settings can change over time. If the steps below don't match what you see, refer to the SAP LeanIX documentation on technical users. ## Create a technical user in LeanIX **1. Open Technical Users** In LeanIX, open the user profile menu, select **Administration**, and then go to **Technical Users**. **2. Create the technical user** Select **New Technical User** and fill in the details: | Field | Value | | :- | :- | | Username | A name that identifies the integration, for example `oleria`. | | Description | Optional. For example, `Oleria governance integration`. | | Permission Role | **Admin**. Oleria needs the Admin permission role to read the workspace's users and to run remediation actions. | | Expiry Date | The date the API token stops working. Set it according to your token rotation policy. | Select **Save**. **3. Copy the API token** LeanIX displays the API token for the new technical user once. > [!WARNING] > > LeanIX shows the API token only once. Copy and store it securely before you close the dialog - you can't retrieve it again. If you lose it, replace the token on the technical user and update the integration in Oleria. **4. Copy the Workspace ID (recommended)** In the administration area, open **API Tokens** and copy the **WorkspaceId** value. If you leave it empty, Oleria tries to find the workspace from the API token and your technical users, and asks for the ID if it can't. ## Connect LeanIX to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations**, then select the **LeanIX** tile. **2. Complete the connection form** Fill in the connection form: | Field | Notes | | :- | :- | | Subdomain | Required. The part of your workspace URL before `.leanix.net`, for example `eu`. A pasted workspace URL is also accepted. | | API token | Required. The API token of the technical user you created. | | Workspace ID | Recommended. The workspace UUID from the API Tokens page. If you leave it empty, Oleria tries to find it from the API token and the workspace's technical users. | **3. Authenticate** Select **Authenticate** to validate the credentials and save the integration. Oleria checks that the technical user can read the workspace's users before saving. ## Verify the integration Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. Oleria syncs users, roles, API tokens, and activity from LeanIX on its [regular sync schedule](/integrations/overview.md#sync-model) once the initial sync completes. > [!NOTE] > > Each connection covers one LeanIX workspace. To connect more workspaces, create a technical user in each and add a separate integration for each. > [!NOTE] > > If you replace the API token on the technical user, LeanIX disables the previous token immediately. Update the API token in Oleria by editing the integration. An update must use a token from the same workspace. ## Remediation actions The technical user's Admin permission role is what authorizes these actions, so no extra setting is needed in Oleria: | Action | What it does | Revert | | :- | :- | :- | | Disable a user | Archives the user's workspace permission, or withdraws a pending invitation or access request. LeanIX keeps archived users for 90 days and then deletes them. | Reactivates the user, only if Oleria archived them. A withdrawn invitation can't be restored - invite the user again in LeanIX. | | Enable a user | Reactivates an archived user. | Archives the user again, only if Oleria reactivated them | | Assign a role | Sets the user's workspace role to Admin, Member, or Viewer. | Restores the previous role, only while the user still holds the assigned one | | Remove a role | Steps the user down one level: Admin to Member, or Member to Viewer. | Restores the removed role, only while the user still holds the lower one | | Disable an API token user | Archives the technical user's workspace permission. Oleria doesn't delete the technical user or its token. | Reactivates the technical user, only if Oleria archived it | Oleria never changes the technical user whose token the integration itself uses. If Oleria can't tell which technical user its API token belongs to, it refuses actions on every technical user with the Admin permission role that it can't tell apart from its own, so it can't lock itself out. Change those users in LeanIX directly. Oleria also doesn't change roles when your workspace takes roles from your identity provider, because the provider overwrites them at the next sign-in. Viewer is LeanIX's base role, so it can't be removed - archive the user instead. Enabling a user doesn't accept a pending invitation on the invitee's behalf, and it can't reactivate a user archived at the account level (for example by your identity provider) - do that in LeanIX or your identity provider. ## Known limitations * **No groups.** LeanIX has no user group object, so Oleria doesn't discover groups or group membership. * **No Fact Sheets or other content.** Oleria discovers who has access to the workspace, not the architecture content inside it. * **MFA and SSO status is mostly unavailable.** LeanIX doesn't expose how users authenticate, so Oleria shows MFA as unavailable. SSO shows as configured only for users your identity provider provisions through SCIM. * **Account-level administrators and SAP support users without a workspace permission aren't discovered.** LeanIX doesn't list them through the workspace API. * **Token expiry needs the technical user listing.** If the technical user can't read it, users still sync, without each token's expiry date. * **Activity needs permission to read workspace events.** If LeanIX denies it, Oleria skips activity with a warning, and users and roles still sync. * **Oleria can't create LeanIX users.** Invite new users in LeanIX. * **This integration hasn't been verified against a live LeanIX workspace yet.** Before you rely on a remediation action, try it on a test user in a test workspace and confirm the result in LeanIX, especially that disabling an API token user stops its token from authenticating. * **Changes in LeanIX appear after the next sync.** ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.