> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Sanity > Connect your Sanity organization to Oleria to continuously discover users, pending invitations, robot API tokens, organization and project roles, and Activity Log events across your Sanity projects. Connect Sanity to Oleria to gain continuous visibility into who has access to your Sanity projects and what they can do. Oleria reads users, invitations, roles, and robot API tokens from the Sanity API with a robot token, and maps every person and non-human identity in one place, so you can find over-privileged access and act on it directly from Oleria. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your Sanity organization: * **Users** - every member of your organization and of the projects Oleria syncs, with their name, email, and login provider. Users who sign in through a SAML provider are shown as using SSO. MFA status isn't available, because Sanity has no MFA setting. * **Pending invitations** - organization and project invitations that haven't been accepted yet. * **Robot API tokens** - each project's robot tokens as non-human identities, with their label, roles, creation date, and expiry date. Oleria never reads a token's value. * **Roles** - organization and project roles, and which users and robot tokens hold each. * **Activity** - events from the Sanity Activity Log. The Activity Log keeps 90 days of events on the Growth plan and 365 days on the Enterprise plan. The Free plan has no Activity Log. Oleria doesn't collect groups, because Sanity has none, and doesn't read datasets or documents. Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model). ## Prerequisites * A Sanity user who can create API tokens on every project you want to sync. * Your Sanity organization ID. * Admin access on the Oleria platform to add a new integration. > [!NOTE] > > A project robot token works on one project only, and each Oleria integration takes one token. To sync several projects, connect one Oleria integration per project, each with its own token and the **Project IDs** field set to that project. Sanity also has no OAuth connection for this kind of access, so Oleria connects with a robot token only. ### Permissions Oleria needs Sync needs the **Developer** role, plus **Access Manager** for the Activity Log. Developer is the robot role that can read the project's API tokens, and it also covers reading members and roles. Sanity's Activity Log API needs an Access Manager robot token: | Permission | Used for | | :- | :- | | `sanity.project.members.read` | Users and pending invitations | | `sanity.project.roles.read` | Roles and who holds them | | `sanity.project.tokens.read` | Robot API tokens | | Access Manager role | Activity Log events | Remediation actions need these permissions as well: | Permission | Role that grants it | Needed for | | :- | :- | :- | | `sanity.project.members.update` | Access Manager | Changing a user's project roles | | `sanity.project.members.delete` | Access Manager | Removing a user from a project, deleting a user | | `sanity.project.members.invite` | Developer | Creating a user (invitation), revoking a pending invitation | | `sanity.project.tokens.delete` | Developer | Deleting a robot token | Add **Access Manager** to collect Activity Log events and to let Oleria change roles, remove users or delete users. > [!NOTE] > > The exact location of these settings can change over time. If the steps below don't match what you see, refer to Sanity's documentation on [API tokens](https://www.sanity.io/docs/content-lake/http-auth). ## Connect Sanity to Oleria **1. Open the project's API tokens** Sign in to [sanity.io/manage](https://www.sanity.io/manage) and select the project you want to sync. Select **API**, then **Tokens**, and select **Add API token**. ![Sanity Manage, project API Tokens page with the Add API token button](https://mintcdn.com/oleria/0aTLOo2TRYO5DG08/images/integrations/sanity/step-1-api-tokens.png?fit=max\&auto=format\&n=0aTLOo2TRYO5DG08\&q=85\&s=dfec207a366902459d7040134fb1e98e) **2. Create the robot token** In the **Add API token** dialog, name the token, for example `oleria`, and set an expiration if your policy needs one. Under **Permissions**, select **Developer**. To collect Activity Log events and use the remediation actions that change roles or remove users, open **Other roles** and select **Access Manager** too. Select **Add token**. ![Sanity Add API token dialog with the Developer role selected and Access Manager selected under Other roles](https://mintcdn.com/oleria/0aTLOo2TRYO5DG08/images/integrations/sanity/step-2-add-api-token.png?fit=max\&auto=format\&n=0aTLOo2TRYO5DG08\&q=85\&s=8d8ac88419b699f57e98d5e9cae7f466) **3. Copy the token** Select the copy icon next to the new token. Sanity shows the token only once, so copy it before you leave the page. ![Sanity Tokens page showing the new token with its value hidden and the copy button](https://mintcdn.com/oleria/0aTLOo2TRYO5DG08/images/integrations/sanity/step-3-token-created.png?fit=max\&auto=format\&n=0aTLOo2TRYO5DG08\&q=85\&s=172dc4be999885cf16b9535a5ddb52dd) > [!WARNING] > > Treat the token like a password. Anyone who has it can act on the project with the roles you selected. Developer also grants read and write access to every dataset in the project. Oleria doesn't use it, but anyone holding the token can. To sync another project, repeat these steps on that project and connect it as a separate Oleria integration. **4. Find your organization ID** In [sanity.io/manage](https://www.sanity.io/manage), select your organization. The organization ID is the part of the address after `organizations/`, as in `https://www.sanity.io/organizations//...`. **5. Find Sanity in Oleria** Go to your Oleria workspace, select **Integrations**, select the **Available** tab, and search for **Sanity**. **6. Connect in Oleria** Select the **Sanity** card and fill in the form: | Field | Description | | :- | :- | | Robot token | Required. Paste the token you copied. | | Organization ID | Required. The organization ID from the previous step. It can't be changed after the integration is connected. | | Project IDs | Optional. The project ID of this token's project. Leave it empty to sync every project the token can see. | Select **Authenticate**. ## Verify the integration Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered users, invitations, robot tokens, roles, and activity in your Oleria workspace. ## Remediation actions Beyond discovery, Oleria can act on Sanity access to remediate risk. | Action | Permission | Reversible? | | :- | :- | :- | | Change a user's project roles | Access Manager | Yes - reversed by restoring the user's previous roles, unless the change removed the user's last role on the project (see next row). | | Remove a user from a project | Access Manager | No - happens when you remove a user's last role on a project. To give the user access again, send them a new invitation. | | Delete a robot token | Developer | No - a deleted token can't be restored. Apps that use it stop working until you create a new token. | | Revoke a pending invitation | Developer | Yes - reversed by sending the invitation again. | | Create a user | Developer | Yes - reversed by revoking the invitation. Oleria invites the user to a project with the chosen role (Viewer by default). | | Delete a user | Access Manager | No - removes the user from every project Oleria syncs. The user stays a member of the organization, because a robot token can't remove organization members, and Oleria refuses users who hold an organization role above Member. For a pending user, Oleria revokes the invitation instead, which needs only Developer and is reversed by sending the invitation again. | ## Known limitations * **Organization-level roles and robot tokens can't be listed with a robot token.** Oleria infers organization roles from the users' memberships, and discovers an organization-managed robot token only when it has access to a synced project. Organization invitations are discovered. * **Robot token last-used time isn't available.** The Sanity API doesn't return when a token was last used. * **SAML and SSO configuration can't be read.** Oleria shows which users sign in through a SAML provider, but the Sanity API doesn't expose the SSO settings. * **Activity needs a paid plan and Access Manager.** The Free plan has no Activity Log, and on Growth or Enterprise the token needs the Access Manager role. * **Datasets and documents aren't imported.** Oleria reads who can access each project, not the content in it. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.