Skip to main content
Connect PandaDoc to Oleria to see who has access to your PandaDoc organization: its users, the workspaces they belong to, and the role they hold in each workspace. Oleria connects at the organization level with an API key (recommended) or an OAuth 2.0 app, so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your PandaDoc organization:
  • Accounts - every user in your PandaDoc organization, with their name, email address, and license type (Full, eSign, Read-only, Creator, or Guest). Guest users are marked as external users. The account owner is marked as an administrator, and so is anyone who is an Admin of at least one workspace.
  • Workspaces - every workspace in the organization appears as a group, with its members. A workspace’s owner is shown as the owner of the group.
  • Roles - each user’s role in each workspace: Admin, Manager, Member, Collaborator, or a custom role. The Admin role is marked as privileged.
  • Non-human identities - webhook subscriptions, each with its signing key as a credential and the endpoint it sends events to. Oleria never reads the signing key itself.
  • Activity - administrative changes made through the PandaDoc API, such as adding or removing workspace members, changing a member’s role, creating API keys, and creating, changing, or deleting webhook subscriptions. See Known limitations.
Oleria refreshes users, workspaces, and roles on its regular sync schedule.
Oleria doesn’t import documents, templates, contacts, or their content. This integration covers identity and access governance for users, workspaces, and roles only.

​
Prerequisites

  • A PandaDoc organization with API access. Production API keys and OAuth apps require the Enterprise plan with API access activated by PandaDoc. On the Business plan, you can connect with a sandbox API key after you turn on API access, but PandaDoc limits sandbox keys to 10 requests a minute per endpoint, so syncs of large organizations take longer.
  • A PandaDoc Organization Admin to create the API key or approve the OAuth app. Oleria acts with this person’s access.
  • Admin access to the Oleria workspace.
PandaDoc has no service accounts. Both connection methods act as one person’s PandaDoc account: the owner of the API key, or the user who approves the OAuth request. If that person is removed from the workspace or loses Organization Admin access, the connection stops working until you reconnect with another Organization Admin’s credential.

​
Set up access in PandaDoc

1

Turn on API access

Sign in to PandaDoc as the account owner or an Admin. Go to Settings -> API and Integrations -> API and turn on API access.
2

Create the credential

In the PandaDoc Developer Dashboard, signed in as an Organization Admin, create one of the following:
  • API key (recommended) - generate an API key and copy it.
  • OAuth app - create an application and register both of these redirect URLs, replacing <your-oleria-host> with the Oleria URL you sign in to:
    • https://<your-oleria-host>/workspace/integrations/pandadoc/connect
    • https://<your-oleria-host>/workspace/integrations/edit
    Copy the app’s client ID and client secret.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to PandaDoc’s own documentation.

​
Connect PandaDoc to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select PandaDoc.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. With OAuth, approve the request in PandaDoc while signed in as an Organization Admin. Oleria checks that the credential can read your organization’s user list, which only an Organization Admin can do, before it saves anything. Find the newly connected organization on the Connected tab of your Oleria Integrations page.

​
Verify the integration

Confirm the PandaDoc organization appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, check that users, workspaces, and roles appear in your Oleria workspace, and that workspace Admins are marked as administrators.
When you edit the integration, leave API key or Client secret blank to keep the stored value. Editing an OAuth connection sends you through PandaDoc’s approval again, which is why the OAuth app needs the /workspace/integrations/edit redirect URL.

​
Remediation actions

Oleria can take these actions in PandaDoc when you select I authorize Oleria to perform write actions in PandaDoc. Every action needs the credential of an Organization Admin. With OAuth, the app must also have been granted the write scope. Keep these limits in mind when you use these actions:
  • Oleria reads the user, workspace, or webhook subscription before it changes anything. If it’s already in the requested state, Oleria makes no change.
  • Oleria won’t remove or change the role of the user whose credential the integration uses, because that would disconnect the integration. It also won’t remove or change the role of the account owner.
  • Oleria won’t remove or demote the last Admin of a workspace. Removing a user from all workspaces is refused before any change if it would leave a workspace without an Admin.
  • If PandaDoc applies a change but its response is lost, Oleria reads the user again and reports what actually happened, so the change can still be reverted.
  • Reverting an action undoes only the change that action made. Reverting a removal restores the user’s previous role in each workspace.
  • Oleria can’t disable API keys or OAuth apps, because PandaDoc’s API can’t list them.

​
Known limitations

  • Both connection methods are tied to one person. See Prerequisites.
  • API keys and OAuth apps aren’t discovered. PandaDoc’s API can only create these, not list them, so they don’t appear as non-human identities. Webhook subscriptions are the only non-human identities Oleria discovers.
  • Only the account owner is identified as an Organization Admin. PandaDoc’s API doesn’t say which other users are Organization Admins.
  • Activity covers administrative API changes only. Oleria imports write calls to administrative endpoints from PandaDoc’s API request log, not changes made in the PandaDoc web app, and not the document audit trail. PandaDoc keeps a separate API log for each workspace, and Oleria reads the log of the workspace the credential belongs to. For an API key, that’s the workspace where the key was generated. Oleria imports at most the last 90 days of earlier activity, the default lookback of PandaDoc’s API log. Changes Oleria makes through remediation actions appear as activity by the person whose credential the integration uses.
  • No MFA, single sign-on, or last-login data. PandaDoc’s API doesn’t report these, so Oleria can’t flag dormant accounts from account data.
  • Custom roles appear by name only. PandaDoc’s API doesn’t expose what a custom role permits.
  • Removed memberships aren’t shown. Oleria imports active workspace memberships only.
  • Documents and templates aren’t inventoried. Oleria doesn’t import documents, templates, or the access to them.

​
Contact us

For questions about this integration, contact us at support@oleria.com.