> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # PandaDoc > Connect PandaDoc to Oleria to bring organization users, workspaces, per-workspace roles, webhook subscriptions, and administrative API activity into your identity and access graph. Connect PandaDoc to Oleria to see who has access to your PandaDoc organization: its users, the workspaces they belong to, and the role they hold in each workspace. Oleria connects at the organization level with an API key (recommended) or an OAuth 2.0 app, so you can see where access is over-provisioned and take action directly from Oleria. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your PandaDoc organization: * **Accounts** - every user in your PandaDoc organization, with their name, email address, and license type (Full, eSign, Read-only, Creator, or Guest). Guest users are marked as external users. The account owner is marked as an administrator, and so is anyone who is an **Admin** of at least one workspace. * **Workspaces** - every workspace in the organization appears as a group, with its members. A workspace's owner is shown as the owner of the group. * **Roles** - each user's role in each workspace: **Admin**, **Manager**, **Member**, **Collaborator**, or a custom role. The **Admin** role is marked as privileged. * **Non-human identities** - webhook subscriptions, each with its signing key as a credential and the endpoint it sends events to. Oleria never reads the signing key itself. * **Activity** - administrative changes made through the PandaDoc API, such as adding or removing workspace members, changing a member's role, creating API keys, and creating, changing, or deleting webhook subscriptions. See [Known limitations](#known-limitations). Oleria refreshes users, workspaces, and roles on its [regular sync schedule](/integrations/overview.md#sync-model). > [!NOTE] > > Oleria doesn't import documents, templates, contacts, or their content. This integration covers identity and access governance for users, workspaces, and roles only. ## Prerequisites * A PandaDoc organization with API access. Production API keys and OAuth apps require the **Enterprise** plan with API access activated by PandaDoc. On the **Business** plan, you can connect with a sandbox API key after you turn on API access, but PandaDoc limits sandbox keys to 10 requests a minute per endpoint, so syncs of large organizations take longer. * A PandaDoc **Organization Admin** to create the API key or approve the OAuth app. Oleria acts with this person's access. * Admin access to the Oleria workspace. > [!WARNING] > > PandaDoc has no service accounts. Both connection methods act as one person's PandaDoc account: the owner of the API key, or the user who approves the OAuth request. If that person is removed from the workspace or loses Organization Admin access, the connection stops working until you reconnect with another Organization Admin's credential. ## Set up access in PandaDoc **1. Turn on API access** Sign in to PandaDoc as the account owner or an Admin. Go to **Settings** -> **API and Integrations** -> **API** and turn on API access. **2. Create the credential** In the PandaDoc **Developer Dashboard**, signed in as an Organization Admin, create one of the following: * **API key** (recommended) - generate an API key and copy it. * **OAuth app** - create an application and register both of these redirect URLs, replacing `` with the Oleria URL you sign in to: * `https:///workspace/integrations/pandadoc/connect` * `https:///workspace/integrations/edit` Copy the app's client ID and client secret. > [!NOTE] > > The exact location of these settings can change over time. If the steps above don't match what you see, refer to PandaDoc's own documentation. ## Connect PandaDoc to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **PandaDoc**. **2. Complete the connection form** Select **Continue** and provide the following: | Field | Notes | | :- | :- | | Authentication method | Required. **API key** (recommended) or **OAuth 2.0**. | | Region | Required. Where your PandaDoc account is hosted: **US** (`app.pandadoc.com`) or **EU** (`app.pandadoc.eu`). | | API key | Required for **API key**. The API key you generated. | | Client ID | Required for **OAuth 2.0**. The client ID of the OAuth app you created. | | Client secret | Required for **OAuth 2.0**. The client secret of the same app. | | I authorize Oleria to perform write actions in PandaDoc | Optional. Select this only if Oleria should run [remediation actions](#remediation-actions). With OAuth, Oleria then requests the `write` scope in addition to `read`. | **3. Confirm the connection** Select **Authenticate**. With OAuth, approve the request in PandaDoc while signed in as an Organization Admin. Oleria checks that the credential can read your organization's user list, which only an Organization Admin can do, before it saves anything. Find the newly connected organization on the **Connected** tab of your Oleria **Integrations** page. ## Verify the integration Confirm the PandaDoc organization appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, check that users, workspaces, and roles appear in your Oleria workspace, and that workspace Admins are marked as administrators. > [!NOTE] > > When you edit the integration, leave **API key** or **Client secret** blank to keep the stored value. Editing an OAuth connection sends you through PandaDoc's approval again, which is why the OAuth app needs the `/workspace/integrations/edit` redirect URL. ## Remediation actions Oleria can take these actions in PandaDoc when you select **I authorize Oleria to perform write actions in PandaDoc**. Every action needs the credential of an Organization Admin. With OAuth, the app must also have been granted the `write` scope. | Action | What it does | Revert | | :- | :- | :- | | Add user to group | Adds the user to a workspace with the **Member** role, without PandaDoc notification emails. | Supported - removes the membership the action created. | | Remove user from group | Removes the user from a workspace. | Supported - adds the user back with their previous role. | | Add user to role | Changes the user's role in a workspace. Promoting a user with a Guest license can upgrade the license and use a paid seat. | Supported - restores the previous role. | | Disable user accounts | Removes the user from every workspace. This is the only offboarding step PandaDoc's API offers. The user stays in your PandaDoc organization and may keep their license, so remove them or reassign their seat in PandaDoc to finish offboarding. After the next sync, the user has no workspace access in Oleria. If PandaDoc fails partway, the user stays removed from the workspaces already processed and the action can't be reverted. Add them back in PandaDoc. | Supported - adds the user back to each workspace with their previous role. | | Disable NHI accounts | Turns off a webhook subscription. | Supported - turns it back on. | | Create user | Creates an organization user with a **Full** license and the **Member** role in the workspaces you choose, or in the workspace of the integration's credential if you don't choose any. A Full license uses a paid seat, and PandaDoc charges for a new seat when none is spare. PandaDoc requires the email domain to match your organization's domain. If a user with that email address already exists, nothing changes. | Supported - removes the user from every workspace. PandaDoc's API can't delete users, so the user and their seat stay in your organization until you delete them in PandaDoc. | | Create group | Creates a workspace, and PandaDoc adds the integration's credential owner to it as an **Admin**. More than one workspace needs the **Enterprise** plan, or the workspaces add-on on the **Business** plan. | Supported - deactivates the workspace, which removes its members and makes it unavailable. Skipped if another user joined the workspace after the action. | Keep these limits in mind when you use these actions: * Oleria reads the user, workspace, or webhook subscription before it changes anything. If it's already in the requested state, Oleria makes no change. * Oleria won't remove or change the role of the user whose credential the integration uses, because that would disconnect the integration. It also won't remove or change the role of the account owner. * Oleria won't remove or demote the last **Admin** of a workspace. Removing a user from all workspaces is refused before any change if it would leave a workspace without an Admin. * If PandaDoc applies a change but its response is lost, Oleria reads the user again and reports what actually happened, so the change can still be reverted. * Reverting an action undoes only the change that action made. Reverting a removal restores the user's previous role in each workspace. * Oleria can't disable API keys or OAuth apps, because PandaDoc's API can't list them. ## Known limitations * **Both connection methods are tied to one person.** See [Prerequisites](#prerequisites). * **API keys and OAuth apps aren't discovered.** PandaDoc's API can only create these, not list them, so they don't appear as non-human identities. Webhook subscriptions are the only non-human identities Oleria discovers. * **Only the account owner is identified as an Organization Admin.** PandaDoc's API doesn't say which other users are Organization Admins. * **Activity covers administrative API changes only.** Oleria imports write calls to administrative endpoints from PandaDoc's API request log, not changes made in the PandaDoc web app, and not the document audit trail. PandaDoc keeps a separate API log for each workspace, and Oleria reads the log of the workspace the credential belongs to. For an API key, that's the workspace where the key was generated. Oleria imports at most the last 90 days of earlier activity, the default lookback of PandaDoc's API log. Changes Oleria makes through remediation actions appear as activity by the person whose credential the integration uses. * **No MFA, single sign-on, or last-login data.** PandaDoc's API doesn't report these, so Oleria can't flag dormant accounts from account data. * **Custom roles appear by name only.** PandaDoc's API doesn't expose what a custom role permits. * **Removed memberships aren't shown.** Oleria imports active workspace memberships only. * **Documents and templates aren't inventoried.** Oleria doesn't import documents, templates, or the access to them. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.