PagerDuty

​

What Oleria discovers

• Accounts - every user in the account, along with their account-level role (owner, admin, user, limited user, observer, restricted access, read-only user, or read-only limited user).
• Teams - all teams and their membership, including the scoped role each member holds on that team (observer, responder, or manager).
• Account roles - the eight fixed account-level roles PagerDuty defines.
• Services and escalation policies - every service and escalation policy, including which teams are assigned to each.
• Audit activity - account-wide audit events such as user lifecycle changes and access configuration changes.

​

Prerequisites

• PagerDuty admin role, to create API keys or register OAuth apps
• API token or OAuth app credentials ready before connecting in Oleria (see the next section)

​

Connect PagerDuty to Oleria

• Option A: API token (Recommended)
• Option B: OAuth client credentials

A General Access API key is the simplest path. Best for organizations where a single long-lived key is acceptable and you want to get connected quickly.

1

Open API Access Keys in PagerDuty

Log in to PagerDuty as an admin, navigate to Integrations -> Developer Tools -> API Access Keys, and select Create New API Key.

2

Configure and copy the key

Enter a description (for example, Oleria connector). The key type is General Access REST API Keys. Within that type, a Read-only API Key checkbox limits the key to read-only access:

• Check “Read-only API Key” - for discovery only (accounts, teams, services, escalation policies, and audit logs)
• Leave unchecked - required if you want Oleria to perform governance actions such as deleting users, revoking sessions, adding or removing team members, or changing account roles

Select Create Key and copy the generated token. It is displayed only once.

Store the token securely. PagerDuty shows it only at creation time and cannot retrieve it later. If you lose it, you must create a new key and update the integration in Oleria.

3

Connect in Oleria

Go to your Oleria workspace, select Integrations -> select PagerDuty. Select Continue and fill in the connection form:

Field	Notes
Authentication method	Select Authenticate with API Token.
API Token	Required. Paste the API key created above.

Select Authenticate to validate and save the integration. Oleria checks the credentials against PagerDuty before saving.

Better for enterprise environments where token rotation matters or fine-grained per-app scoping is required. Oleria reads the token lifetime from PagerDuty’s token response and automatically renews it before it expires, so no manual rotation is needed after initial setup.

1

Register an OAuth app

Log in to PagerDuty as an admin, navigate to Integrations -> App Registration, and select + New App. Configure the app as follows:

• Set the authorization type to OAuth 2.0
• Select the Client Credentials grant (server-to-server, no user interaction required)
• Add scopes for the resources Oleria syncs. Grant read scopes for discovery; also grant write scopes if you want Oleria to perform governance actions.

Read scopes (required for discovery):

abilities.read
users.read
teams.read
services.read
escalation_policies.read
audit_records.read

Write scopes (required for governance actions):

users.write
teams.write

audit_records.read only has effect on Business or Enterprise plans. If you are on a Free or Team plan, or if this scope is not granted, Oleria syncs without audit activity and no error is shown.

2

Copy the client ID and client secret

After saving the app, copy the Client ID and Client Secret. Both values are shown only once.

Store the client secret securely. PagerDuty cannot retrieve it after you close the app registration page. If you lose it, you must regenerate the secret and update the integration in Oleria.

3

Connect in Oleria

Go to your Oleria workspace, select Integrations -> select PagerDuty. Select Continue and fill in the connection form:

Field	Notes
Authentication method	Select Authenticate with OAuth (Client Credentials).
Client ID	Required. The client ID from your registered OAuth app.
Client Secret	Required. The client secret from your registered OAuth app.

Select Authenticate to validate and save the integration. Oleria checks the credentials against PagerDuty before saving.

​

Verify the integration

​

Governance actions

​

Known limitations

• No disable or suspend state - PagerDuty has no concept of a disabled or suspended user. Deleting a user is the only deprovisioning path and is permanent.
• MFA and SSO enrollment - multi-factor authentication (MFA) and SSO enrollment status are not available via the PagerDuty API. Oleria reports these fields as unavailable, not as a false negative.
• Audit logs - audit activity requires a Business or Enterprise plan and credentials that include audit access (a non-read-only API key, or an OAuth app with audit_records.read). If either condition is not met, Oleria syncs without audit activity and no error is shown. If you are on a paid plan and see no audit activity, check that your credentials include audit access.

​

Contact us