> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Metabase > Connect Metabase to Oleria to discover users, groups, API keys, and activity, and to manage users, group membership, and API keys from Oleria. Connect Metabase to Oleria to see who can sign in to your Metabase instance, which permission groups they belong to, who administers it, and which API keys can act on it. Metabase is a business intelligence platform. Oleria reads one Metabase instance at a time with an API key, so you can review access to Metabase and take action directly from Oleria. Both self-hosted Metabase and Metabase Cloud work. Oleria reads who has access to the instance itself. It doesn't import collections, dashboards, questions, or databases, and it doesn't read the data and collection permissions that you set for each group. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your Metabase instance: * **Accounts** - every user, including deactivated users (shown as disabled), with their name, email address, the date they joined, their last sign-in, and whether they are an administrator. Oleria also shows how each user signs in: with a password, or through the single sign-on provider that created the account (Google, LDAP, SAML, JWT, or OpenID Connect). Two-factor authentication and single sign-on show the instance's own settings: Oleria shows single sign-on as required when you turn off password sign-in, and, if your plan includes two-factor authentication (a paid Metabase feature), two-factor authentication as required when your instance enforces it. * **Groups** - every permission group, including the built-in **Administrators** and **All Users** groups, and each user's group memberships. If your plan includes group managers (Metabase Pro and Enterprise), Oleria also shows which users are **group managers** of a group. * **Non-human identities and credentials** - every API key. Metabase creates an API-only user for each key, and Oleria shows that user as a non-human identity with the key as its credential. Oleria shows the key's name, its creation date, the group it belongs to, and whether it has full administrator authority or is limited to its group. Oleria never reads or stores a key's secret. * **Activity** - if your plan includes **Usage analytics** (Metabase Pro and Enterprise), events from its activity log, such as users invited, joining, updated, deactivated, or reactivated, password resets, two-factor authentication changes, and group membership changes. Each event shows who did it, including events done with an API key, and the user, group, or API key it concerned. Events that Metabase records for itself, or for a user or key that no longer exists, are shown without that account. Metabase keeps usage analytics for 720 days by default. Without Usage analytics, Oleria imports no activity and the rest of the sync still completes (see [Known limitations](#known-limitations)). Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model). > [!NOTE] > > Metabase has no roles. Access comes from group membership, and an administrator is a member of the **Administrators** group, so Oleria shows administrators through that group and each account's administrator flag. ## Prerequisites * A Metabase instance on version 0.47 or later, the first version with API keys. Use a current release for the best results. * A Metabase **administrator** account to create the API key. * A Metabase instance that Oleria can reach over **HTTPS** at a public address. Self-hosted instances that are only reachable on a private network or VPN, or whose address resolves to a private IP, can't be connected. Metabase Cloud instances (`https://.metabaseapp.com`) work as they are. * If a firewall, reverse proxy, or web application firewall in front of a self-hosted instance only allows known IP addresses, allow Oleria's IP addresses. To get them, contact [support@oleria.com](mailto:support@oleria.com). * Admin access to the Oleria workspace. > [!WARNING] > > Metabase has no read-only API scope. A key acts with the permissions of the one group you put it in, and the lists of users, groups, group memberships, and API keys that Oleria reads are available only to administrators. The key must therefore belong to the **Administrators** group, and Oleria uses the same key for [remediation actions](#remediation-actions). Store the key as an administrative credential. Create it for this purpose, name it clearly (for example `Oleria`), and don't delete it in Metabase while the integration is connected. ## Create an API key in Metabase **1. Open the API keys settings** Sign in to Metabase as an administrator. Select the grid icon in the upper right and select **Admin**. Go to **Settings** > **Authentication**, scroll to **API Keys**, and select **Manage**. **2. Create the key** Select **Create API Key**. Enter a name, for example `Oleria`, and select the **Administrators** group. Metabase doesn't allow two keys with the same name. **3. Copy the key** Select **Create**, then copy the key. It starts with `mb_`. Metabase shows the key only once, so store it securely until you have connected Oleria. If you lose it, create a new key and [update the integration](#verify-the-integration). ### Permissions Oleria needs | What | Permission | | :- | :- | | Read users, groups, memberships, and API keys | The key is in the **Administrators** group. | | Create, deactivate, or reactivate a user; create a group; add or remove a user from a group; delete an API key | The key is in the **Administrators** group. | Oleria checks this when you connect: it refuses a key that isn't in the Administrators group and tells you why. The **Capabilities** tab of the integration shows the same requirement for each read and action. ## Connect Metabase to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **Metabase**. **2. Complete the connection form** Select **Continue** and provide the following: | Field | Notes | | :- | :- | | Metabase URL | Required. The address of your instance, for example `https://metabase.example.com` or `https://your-team.metabaseapp.com`. It must use `https`. If your instance runs under a sub-path, include it. You can't change the URL after you connect; to connect a different instance, add a new integration. | | API key | Required. The key you created in Metabase. When you edit an existing integration, leave it blank to keep the current key. | **3. Authenticate** Select **Authenticate**. Oleria checks that the key is accepted and belongs to an administrator, then saves the integration. Each Oleria integration covers one Metabase instance. If you have several instances, add one integration for each. ## Verify the integration Confirm the Metabase instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered users, groups, and API keys in your Oleria workspace. > [!NOTE] > > If you rotate the API key in Metabase, edit the integration in Oleria and enter the new key. If someone deletes the key in Metabase, the integration stops syncing until you enter a new one. ## Remediation actions If remediation is enabled for your Metabase integration, Oleria can take these actions in Metabase: | Action | What it does | Reversible | | :- | :- | :- | | Create a user | Creates a user with the name and email address you give, in the **All Users** group and any groups you choose. The user is created deactivated unless you ask for them to be active. If email is set up in Metabase and you don't give a password, Metabase emails the user an invitation to set one, including a user created deactivated; give a password to create the user without an email. Reverting deactivates the user, because Metabase can't delete a user. | Yes | | Disable a user | Deactivates the user. The user keeps their record and content but can no longer sign in. | Yes | | Enable a user | Reactivates a deactivated user. | Yes | | Create a group | Creates a permission group. If a group with that name exists, nothing changes. Reverting deletes the group only while it has no members, active or deactivated, and no API keys. | Yes | | Add a user to a group | Adds the user to a permission group. | Yes | | Remove a user from a group | Removes the user from a permission group. If the user was a group manager (Metabase Pro and Enterprise), a revert restores that role. | Yes | | Disable a non-human identity | Deletes the API key. The key stops working at once. If the key is already gone, nothing changes. | No | Oleria never changes the API key that the integration connects with or the user that key acts as (if it can't tell which key that is, it deletes no key), and Metabase doesn't let you add users to or remove them from the built-in **All Users** group, because every user belongs to it. An action that finds the user or group already in the target state does nothing. Deleting an API key can't be undone: Metabase shows a key's secret only when you create it, so create a new key if you need one again. ## Known limitations * **Activity needs Usage analytics.** Metabase's audit log is part of **Usage analytics**, which is available only on the Pro and Enterprise plans. On the open-source edition and on plans without it, Oleria imports no activity. Usage analytics has no sign-in event, so Oleria shows each user's last sign-in on the account instead, which supports dormant account detection. * **Group permissions aren't imported.** Oleria shows who is an administrator and which groups each user is in, but not the data and collection permissions each group holds. A user's access to specific databases, collections, or dashboards doesn't appear in Oleria. * **Limited sign-in details.** Metabase doesn't report when a user last changed their password, whether an individual user has enrolled in two-factor authentication, or when an API key was last used, so Oleria doesn't show them. Two-factor authentication is a paid Metabase feature, so an instance without it shows two-factor authentication as not required. * **API keys have no owner.** Metabase doesn't record who owns an API key, so Oleria shows no owner for it. * **Group managers need a paid plan.** Group managers are a Metabase Pro and Enterprise feature. On other plans, Oleria shows memberships without a manager role. ## Existing SCIM connections Earlier versions of this integration connected through Metabase's SCIM provisioning with a SCIM base URL and token. This integration replaces it and connects with an API key instead. A connection that you created with a SCIM token doesn't carry over: add the integration again with a Metabase URL and an API key, then remove the old connection. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.