Skip to main content
Connect Ramp to Oleria to see who has access to your Ramp business, with which role, and what they do there. Oleria reads users, roles, departments, locations, and audit log events from the Ramp Developer API using an OAuth client credentials app, so you can review access to your corporate spend and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Ramp business:
  • Accounts - every user in the business, with their name, email address, role, status, department, employee ID, and manager. Users who are active, or who have accepted their invitation and are still onboarding, are enabled. Deactivated users, suspended users, invited users who haven’t accepted yet, and draft users who haven’t been invited are imported as disabled. Users with the Owner, Admin, or IT Admin role are marked as administrators. Guest users are marked as external users. If a user is scheduled to be deactivated, Oleria records the date.
  • Roles - Ramp’s built-in roles (Owner, Admin, IT Admin, Bookkeeper, Auditor, Employee, and Guest, plus the Owner, Admin, Bookkeeper, and Employee variants for unbundled plans) and any custom roles defined for the business. Every user holds exactly one built-in role.
  • Groups - each department and each location in Ramp is imported as a group, with the users who belong to it. A user belongs to at most one department and one location.
  • Activity - events from the Ramp audit log, such as sign-ins and sign-outs, users created, invited, deactivated, or reactivated, role changes, password and authenticator changes, and changes to single sign-on and login settings. Other audit events are imported with their original Ramp event name.
If your business requires single sign-on, Oleria marks single sign-on as required for every user. Oleria refreshes this data on its regular sync schedule.
Oleria doesn’t import cards, funds and spend limits, spend programs, transactions, bills, reimbursements, vendors, or accounting data. This integration covers identity and access governance for people, roles, and groups only.

​
Prerequisites

  • A Ramp user with the Admin role, to create a developer app. Ramp lets only admins manage developer apps.
  • Admin access to the Oleria workspace.

​
Create a developer app in Ramp

1

Create the app

Sign in to Ramp as an admin and go to Company -> Developer. Select Create New App, enter a name such as Oleria, and accept the terms.
2

Add the Client Credentials grant type

Under Grant types, select Add new grant type and choose Client Credentials.
3

Allow the scopes

Under Scopes, select Configure allowed scopes and allow:Allow all six unless you want a connection without activity or without remediation actions.
4

Copy the client credentials

Copy the app’s Client ID and Client Secret. Store the client secret securely.
Ramp’s sandbox and production environments are separate. To connect a sandbox business, create the developer app in the Ramp sandbox. The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Ramp’s own developer documentation.

​
Connect Ramp to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Ramp.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate to validate the credentials. Oleria checks that the app can get an access token with the required scopes, reads your Ramp business, and lists its users, departments, and locations. Find the newly connected business on the Connected tab of your Oleria Integrations page.
If Authenticate fails, check that the Environment matches where you created the app and that the app allows the Client Credentials grant type and the four required scopes.
You can connect each Ramp business to Oleria once. To connect a different business, add a new integration.

​
Verify the integration

Confirm the Ramp business appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, roles, groups, and activity in your Oleria workspace.
If you rotate the client secret or replace the developer app in Ramp, update the integration in Oleria with the new values. To keep the stored client secret when you edit other settings, leave that field empty. You can’t change the Environment of an existing integration or point it at a different Ramp business. To switch from sandbox to production, add a new integration.

​
Remediation actions

Oleria can take these actions in Ramp. Each one needs the users:write scope on the developer app:
  • Deactivate a user and reactivate a user. A deactivated user can’t sign in, and their cards are frozen. Their role, department, location, and history are kept, so they can be reactivated. Only deactivated users can be reactivated.
  • Change a user’s role. Because every Ramp user holds exactly one built-in role, assigning a role replaces the user’s current role. You can assign the Admin, IT Admin, Bookkeeper, Auditor, Employee, and Guest roles. Reverting the action restores the previous role.
  • Move a user to a department or location. Because a user belongs to at most one department and one location, adding a user to a department or location group moves them there. Reverting the action moves the user back. Changing a user’s location can also change the legal entity their spend belongs to.
If the developer app doesn’t allow users:write, the import still works, but the actions fail with a missing-permission error. Allow the scope on the app and try again. Keep these limits in mind:
  • Oleria won’t deactivate the business owner or change the owner’s role. Ramp doesn’t allow these changes through its API.
  • Custom roles, the Owner role, and the roles for unbundled plans can’t be assigned from Oleria, and users who hold one of the roles for unbundled plans can’t have their role changed from Oleria. Make these changes in Ramp.
  • Reverting a deactivation reactivates the user only if they were active before. If you deactivate a user who hadn’t finished joining Ramp (a draft user, a pending invitation, or a user still onboarding), reverting the action fails instead of making them an active user. Re-invite them in Ramp.
  • Users suspended by Ramp can’t be deactivated or reactivated from Oleria.
  • If a user had no department or location before they were moved, the move can’t be reverted from Oleria, because Ramp’s API can’t clear these fields. Reset it in Ramp.

​
Known limitations

  • Oleria doesn’t import MFA settings or authenticators for Ramp users. Changes to them appear as activity.
  • Ramp’s API doesn’t show which users hold a custom role. Custom roles are imported without members.
  • Oleria doesn’t import Ramp developer apps or the agents that act in Ramp. Agent actions appear as activity attributed to the user the agent acted for.
  • Ramp limits API requests. Oleria paces its requests to leave room for your other Ramp integrations.

​
Contact us

For questions about this integration, contact us at support@oleria.com.