Skip to main content
Connect Pylon to Oleria to see who has access to your Pylon workspace: its users, their roles, and teams. Oleria reads identity and access data from the Pylon API using an admin API token, so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Pylon workspace:
  • Accounts - every user in the workspace, with their name and email address. Deactivated users appear as disabled accounts.
  • Roles - the roles defined in your Pylon workspace.
  • User groups - every Pylon team and its members.
  • Role assignments - which accounts hold which roles.
  • Activity - events from the Pylon audit log. Oleria records each event under Pylon’s own action name and attributes it to the Pylon workspace, not to a specific user, team, or role.
Oleria doesn’t read Pylon customer accounts, contacts, or issues. It only reads the people who work in your Pylon workspace.

​
Prerequisites

  • A Pylon account with the Admin role. Only Pylon admins can create API tokens.
  • To know whether your Pylon organization is hosted in the US or EU region.
  • Admin access to the Oleria workspace
Pylon API tokens don’t support scopes, so the token you create has full admin access to your Pylon organization, including customer data. Oleria uses it only to read workspace users, roles, teams, and audit logs, and to change team membership when you run a remediation action.

​
Create an API token in Pylon

1

Open API tokens

Sign in to Pylon as an admin, then go to Settings -> API tokens.
2

Create a token

Create a new token and give it a name, for example Oleria Integration.
Pylon shows actions taken with a token under the token’s name. A descriptive name makes Oleria’s actions easy to find in the Pylon audit log.
3

Copy the token

Copy the token somewhere secure.
If you lose the token, create a new one and update the integration in Oleria.

​
Connect Pylon to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Pylon.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate to validate the token. Oleria checks that the token and region can reach your Pylon organization, and rejects the connection if they can’t. Find the newly connected Pylon workspace on the Connected tab of your Oleria Integrations page.

​
Verify the integration

Confirm the Pylon workspace appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered accounts, roles, and user groups in your Oleria workspace.
If you revoke or replace the token in Pylon, update it in Oleria by editing the integration. A revoked token causes the sync to fail.

​
Remediation actions

Oleria can add a user to a Pylon team or remove a user from one. These actions are available on every Pylon connection: Pylon API tokens have no scopes, so there’s no separate write permission to grant.
Pylon replaces a team’s whole member list on each update, so Oleria reads the current members and then writes the updated list. A change made to the same team in Pylon at that moment can be overwritten.

​
Known limitations

  • Team membership is the only remediation. Pylon’s API has no field to deactivate a user, and its role update replaces all of a user’s roles, so Oleria doesn’t deactivate users or change roles. Manage those in Pylon.
  • MFA and SSO status are unavailable. Pylon doesn’t expose MFA or SSO policy through its API, so these fields report as unavailable.
  • API tokens aren’t discovered. Pylon has no API to list tokens, so they don’t appear as accounts in Oleria. Actions taken with a token appear in the audit log under the token’s name.
  • API access is inferred from the Admin role. Only Pylon admins can create API tokens, so Oleria marks users with the Admin role as having API access.

​
Contact us

For questions about this integration, contact us at support@oleria.com.