What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Twist workspace:- Workspace - the workspace itself, with its name, plan (Free or Unlimited), creator, and created date.
- Accounts - every person in the workspace, with their name, display name, email address, and workspace role. Admins and Members are shown as standard users, and Admins are marked as administrators. Each account’s license reflects the workspace’s plan. On the Unlimited plan, a Guest’s license is shown as unavailable, because whether Twist bills a Guest depends on the channels they’re in.
- Guests are shown as external users, because Twist designs the Guest role for people such as external contractors and clients.
- Removed users stay in Oleria and are shown as disabled, so you can see who left the workspace.
- Pending invitations - people who were invited but haven’t finished joining - are shown as active accounts.
- Roles - Twist’s three workspace roles, Admin, Member, and Guest, and the people who hold each one. Removed users hold no role.
- Groups - every group in the workspace and its members. Removed users aren’t shown as group members.
- Non-human identities (NHIs):
- Integration bot users - when an integration with a bot is installed, Twist adds a bot user to the workspace. Oleria shows each one as an application. Ada Bot, Twist’s built-in assistant, is shown as a system account.
- The connection’s own credential - with a personal token, the token is shown as a personal access token owned by the Twist user it belongs to. With OAuth, your Twist integration is shown as an application with its client secret and the scopes it was granted, acting for the user who approved it. Oleria never records the token or secret value itself.
Oleria doesn’t import channels, threads, conversations, or messages. This integration covers identity and access governance for workspace members, roles, groups, and NHIs only.
Prerequisites
- A Twist workspace on the Free or Unlimited plan.
- A Twist workspace Admin to connect it. Oleria reads and acts as this user, so its role decides what Oleria can see and do. A Member can connect for discovery and group actions, but removing, re-adding, or inviting people and changing their roles need an Admin. Oleria refuses a Guest’s credential, because a Guest sees only the members of the channels they’re in.
- Admin access on the Oleria platform to add a new integration.
Choose an authentication method
Both methods start with a general integration that you create in Twist.
Twist’s integration settings can change over time. If the steps below don’t match what you see, refer to Twist’s API documentation, in particular its OAuth 2 and testing sections.
Set up a personal token
1
Create a general integration
Sign in to Twist as a workspace Admin and create a general integration, for example named
Oleria.2
Copy the test token
Copy the test token from the OAuth section of your integration’s details page.
Set up OAuth
1
Create a general integration
Sign in to Twist as a workspace Admin and create a general integration, for example named
Oleria.2
Set the redirect URL
In the OAuth section of your integration’s details page, set the OAuth redirect URL to the following, replacing
<your-oleria-host> with the host of your Oleria workspace, as shown in your browser’s address bar:https://<your-oleria-host>/workspace/integrations/twist/connectA Twist integration has one redirect URL, so Oleria uses it both when you add the integration and when you edit or reconnect it. The Oleria connection form shows this URL when you choose OAuth 2.0.3
Copy the client credentials
From the same section, copy the integration’s client ID and client secret.
Write scopes, requested only when you select I authorize Oleria to perform write actions in Twist:
Connect Twist to Oleria
1
Open the integration
Sign in to your Oleria workspace, navigate to Integrations, and select Twist.
2
Complete the connection form
Fill in the connection form:
3
Authenticate
Select Authenticate. With OAuth 2.0, you’re redirected to Twist to approve access, then back to Oleria automatically. Oleria checks that the credential can read the workspace’s members before it saves the integration, and stores the workspace it connected to.
Verify the integration
Confirm the new instance appears on the Connected tab of your Oleria Integrations page. It’s named after your workspace ID, for example Twist (12345). After the first sync completes, review the discovered accounts, roles, groups, and NHIs in your Oleria workspace, and check that your Admins and Guests are marked correctly. To update the integration, for example after you rotate the token, edit it in Oleria:- To keep the stored token or client secret, leave that field empty.
- If you change the OAuth client ID, enter the new integration’s client secret too.
- If you switch the authentication method, enter the new method’s credential.
- The workspace can’t be changed. Oleria rejects a credential that resolves to a different workspace. To connect another workspace, add a new integration.
Remediation actions
Beyond discovery, Oleria can act on Twist access to remediate risk. Actions need I authorize Oleria to perform write actions in Twist to be selected. Before an action runs, Oleria checks that the connection’s user holds the workspace role the action needs and, with OAuth, that the write scopes were granted. It reports what’s missing.
The connection’s user needs this workspace role:
If the target is already in the requested state, the action succeeds without making a change, and there’s nothing to revert.
A few safeguards apply:
- Oleria never removes, re-adds, or changes the role of the Twist user the connection acts as, because that could break the connection.
- Oleria never removes, re-adds, or changes the role of a bot user. Bots belong to installed integrations, and these actions refuse them.
- Twist’s own limits still apply. For example, Twist refuses to remove or demote the workspace’s last Admin, and adding a person fails when the workspace has reached its maximum number of users or the pending invitation limit. Oleria reports Twist’s message.
Known limitations
- No activity data. Twist has no audit log, login history, or activity API, so Oleria shows no activity for Twist.
- No last activity, password change, or created dates. Twist doesn’t report when a person was last active, last changed their password, or joined. Oleria can’t flag dormant Twist accounts.
- No MFA or single sign-on data. Twist doesn’t report two-factor authentication, single sign-on, or sign-in methods for its users. Oleria shows them as unavailable rather than not required.
- Installed integrations are visible only through their bot users. Twist has no API that lists installed integrations or reports who installed them. Oleria shows the bot user each integration adds, with no installer or owner. Integrations without a bot user don’t appear. Oleria can’t disable or remove bots; uninstall the integration in Twist instead.
- Channels and messages aren’t collected. Oleria doesn’t read channels, threads, conversations, or messages, so access granted through channel membership isn’t shown, and channel memberships aren’t restored when you revert Disable user accounts.
- Pending invitation limit on new workspaces. A new Twist workspace allows at most three pending invitations until more people join. A removed user who never joined still counts. Until then, Twist can refuse Create user, Enable user accounts, and the revert of Disable user accounts for people who never joined. Oleria reports Twist’s message.
- One workspace per connection. Each integration reads one workspace, and the workspace can’t be changed when you edit the integration. To connect another workspace, add a new integration.