What Oleria discovers
Oleria reads one Railway workspace through the Railway public GraphQL API (https://backboard.railway.com/graphql/v2) on its regular sync schedule:
- Users - workspace members with their workspace role (Admin, Member or Deployer), and collaborators outside the workspace who were invited to a single project. For each member, Oleria shows whether two-factor authentication is on and which methods are set up (authenticator app, passkey), whether your workspace requires 2FA, and whether SAML SSO is configured or enforced. Railway has no last-login field, so a member’s last activity comes from their most recent audit-log event in the last 30 days.
- Roles - the three workspace roles and who holds each. Each role’s reach over every project is shown once, on the role.
- Groups - Railway access groups, their members, and the project role each group grants on its projects.
- Resources - projects and their environments, and who can reach each one: direct project members (with their Owner, Editor or Viewer role), access groups, collaborators outside the workspace, and everyone through workspace roles. Project Owners are shown as the project’s owners. Public projects show anonymous read access.
- Non-human identities - project tokens (scoped to one environment), Railway Authentication tokens (with their expiry and creator), the connecting user’s own account and workspace tokens (when you connect with an account token), SSH keys (the workspace’s, plus the connecting user’s own when you connect with an account token), and bucket access keys. Each is linked to the person it authenticates as or who created it, when Railway records one. Workspace tokens are shown with the workspace Admin role, workspace SSH keys with access to every project, and bucket keys with access to their environment.
- Secrets - sealed variables and variables whose names show they hold a secret (for example
DATABASE_URLorSTRIPE_SECRET_KEY), as credentials. Oleria reads variable names only and never requests or stores variable values. - Activity - the workspace audit log: member, role, access-group, SSO and 2FA changes, token and credential changes, project and environment changes, deployments, and shell, SSH and file access to running services.
Prerequisites
- A Railway workspace on the Pro plan or higher. Workspaces with other members, 2FA enforcement and 30-day audit logs need Pro. SSO, access groups, Environment RBAC and 18-month audit logs need a committed-spend plan.
- A Railway user with the Admin workspace role, to create the token below.
- Admin access on the Oleria platform to add a new integration.
Permissions
Railway tokens have no scopes: a token can do what its owner’s workspace role allows, and a workspace token acts with workspace Admin rights. Oleria uses one token for discovery and remediation actions.Choose a token
Project tokens are not supported. They reach a single environment and can’t read workspace members, roles or the audit log.
Create the token in Railway
1
Open the token page
Signed in as a workspace Admin, go to Account Settings > Tokens (
railway.com/account/tokens).2
Create the token
Enter a name (for example,
oleria). For a workspace token, select your workspace in the Workspace list. For an account token, select No workspace. Select Create and copy the token.3
Find the Workspace ID (account tokens only)
Go to Workspace Settings > General and copy the workspace ID.
Connect Railway to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the Railway tile.
2
Complete the connection form
When you edit the integration, leave the API token blank to keep the stored token. You can’t change the Workspace ID; to connect a different workspace, add a new integration.
3
Save the integration
Select Authenticate. Oleria checks that the token works, selects the workspace, and reads it before saving the connection.
Verify the integration
Confirm the new instance appears on the Connected tab of your Integrations page with a status of Healthy.Remediation actions
Every action needs a workspace token or an account token of a workspace Admin. Oleria never removes, demotes or revokes the access of the user whose token the connection uses, never removes or demotes the workspace’s only Admin, and never changes a project outside the connected workspace.
Known limitations
- Railway has no way to suspend a member, so every member shows as enabled. Railway accounts have no password, so the last password change is empty.
- Railway has no per-member last-login field. Last activity comes from the newest audit-log events of the last 30 days, which only Admins and workspace tokens can read. The audit log keeps 48 hours on Free and Hobby, 30 days on Pro and 18 months on Enterprise.
- When Railway’s audit log doesn’t identify who acted, the activity shows Unattributed Railway actor. Actions by Railway’s platform and support staff show Railway System and Railway Staff.
- Railway lists only the connecting user’s own account and workspace tokens. With a workspace token, no API tokens are listed.
- Oleria doesn’t revoke account or workspace tokens: Railway can’t tell which token the connection itself uses. Revoke them in Railway.
- Resetting a bucket’s S3 credentials replaces the secret access key; the Access Key ID stays the same, so the key keeps the same name in Oleria. Services that use the bucket keep the old secret until you redeploy them.
- Railway doesn’t record who created a project token or when any token was last used.
- Railway doesn’t show which environments are restricted through its API, so restricted environments appear like any other environment.