> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pylon

> Connect Pylon to Oleria to bring users, teams, roles, and audit activity from your customer support platform into your identity and access graph.

Connect Pylon to Oleria to see who has access to your Pylon workspace: its users, their roles, and teams. Oleria reads identity and access data from the Pylon API using an admin API token, so you can see where access is over-provisioned and take action directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Pylon workspace:

* **Accounts** - every user in the workspace, with their name and email address. Deactivated users appear as disabled accounts.
* **Roles** - the roles defined in your Pylon workspace.
* **User groups** - every Pylon team and its members.
* **Role assignments** - which accounts hold which roles.
* **Activity** - events from the Pylon audit log. Oleria records each event under Pylon's own action name and attributes it to the Pylon workspace, not to a specific user, team, or role.

<Note>
  Oleria doesn't read Pylon customer accounts, contacts, or issues. It only reads the people who work in your Pylon workspace.
</Note>

## Prerequisites

* A Pylon account with the Admin role. Only Pylon admins can create API tokens.
* To know whether your Pylon organization is hosted in the US or EU region.
* Admin access to the Oleria workspace

<Note>
  Pylon API tokens don't support scopes, so the token you create has full admin access to your Pylon organization, including customer data. Oleria uses it only to read workspace users, roles, teams, and audit logs, and to change team membership when you run a remediation action.
</Note>

## Create an API token in Pylon

<Steps>
  <Step title="Open API tokens">
    Sign in to Pylon as an admin, then go to **Settings** -> **API tokens**.
  </Step>

  <Step title="Create a token">
    Create a new token and give it a name, for example `Oleria Integration`.

    <Note>
      Pylon shows actions taken with a token under the token's name. A descriptive name makes Oleria's actions easy to find in the Pylon audit log.
    </Note>
  </Step>

  <Step title="Copy the token">
    Copy the token somewhere secure.

    <Warning>
      If you lose the token, create a new one and update the integration in Oleria.
    </Warning>
  </Step>
</Steps>

## Connect Pylon to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Pylon**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field | Notes |
    | :- | :- |
    | API Token | Required. Paste the token you created in the previous section. |
    | Region | Required. Select **US** or **EU**, matching where your Pylon organization is hosted. The default is **US**. |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate** to validate the token. Oleria checks that the token and region can reach your Pylon organization, and rejects the connection if they can't. Find the newly connected Pylon workspace on the **Connected** tab of your Oleria **Integrations** page.
  </Step>
</Steps>

## Verify the integration

Confirm the Pylon workspace appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, you can review the discovered accounts, roles, and user groups in your Oleria workspace.

<Note>
  If you revoke or replace the token in Pylon, update it in Oleria by editing the integration. A revoked token causes the sync to fail.
</Note>

## Remediation actions

Oleria can add a user to a Pylon team or remove a user from one. These actions are available on every Pylon connection: Pylon API tokens have no scopes, so there's no separate write permission to grant.

| Action | Reversible? |
| :- | :- |
| Add to team | Yes - reversed by removing the user from the team. If the user was already a member, there's nothing to reverse. |
| Remove from team | Yes - reversed by adding the user back. If the user wasn't a member, there's nothing to reverse. |

<Note>
  Pylon replaces a team's whole member list on each update, so Oleria reads the current members and then writes the updated list. A change made to the same team in Pylon at that moment can be overwritten.
</Note>

## Known limitations

* **Team membership is the only remediation.** Pylon's API has no field to deactivate a user, and its role update replaces all of a user's roles, so Oleria doesn't deactivate users or change roles. Manage those in Pylon.
* **MFA and SSO status are unavailable.** Pylon doesn't expose MFA or SSO policy through its API, so these fields report as unavailable.
* **API tokens aren't discovered.** Pylon has no API to list tokens, so they don't appear as accounts in Oleria. Actions taken with a token appear in the audit log under the token's name.
* **API access is inferred from the Admin role.** Only Pylon admins can create API tokens, so Oleria marks users with the Admin role as having API access.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.