> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Twist > Connect a Twist workspace to Oleria to discover members, guests, removed users, workspace roles, groups, and integration bot users, and take remediation actions directly from Oleria. Twist is a team messaging app from Doist, organized into workspaces. Connect a Twist workspace to Oleria to see who is in it, who is an Admin, which outside collaborators have Guest access, who was removed, and which integrations have added bot users to it. Oleria reads this data from the Twist API with a personal token or with OAuth, so you can review workspace access and act on it directly from Oleria. One Oleria integration covers one Twist workspace. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your Twist workspace: * **Workspace** - the workspace itself, with its name, plan (Free or Unlimited), creator, and created date. * **Accounts** - every person in the workspace, with their name, display name, email address, and workspace role. Admins and Members are shown as standard users, and Admins are marked as administrators. Each account's license reflects the workspace's plan. On the Unlimited plan, a Guest's license is shown as unavailable, because whether Twist bills a Guest depends on the channels they're in. * **Guests** are shown as external users, because Twist designs the Guest role for people such as external contractors and clients. * **Removed users** stay in Oleria and are shown as disabled, so you can see who left the workspace. * **Pending invitations** - people who were invited but haven't finished joining - are shown as active accounts. * **Roles** - Twist's three workspace roles, **Admin**, **Member**, and **Guest**, and the people who hold each one. Removed users hold no role. * **Groups** - every group in the workspace and its members. Removed users aren't shown as group members. * **Non-human identities (NHIs)**: * **Integration bot users** - when an integration with a bot is installed, Twist adds a bot user to the workspace. Oleria shows each one as an application. **Ada Bot**, Twist's built-in assistant, is shown as a system account. * **The connection's own credential** - with a personal token, the token is shown as a personal access token owned by the Twist user it belongs to. With OAuth, your Twist integration is shown as an application with its client secret and the scopes it was granted, acting for the user who approved it. Oleria never records the token or secret value itself. Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model). > [!NOTE] > > Oleria doesn't import channels, threads, conversations, or messages. This integration covers identity and access governance for workspace members, roles, groups, and NHIs only. ## Prerequisites * A Twist workspace on the **Free** or **Unlimited** plan. * A Twist workspace **Admin** to connect it. Oleria reads and acts as this user, so its role decides what Oleria can see and do. A Member can connect for discovery and group actions, but removing, re-adding, or inviting people and changing their roles need an Admin. Oleria refuses a Guest's credential, because a Guest sees only the members of the channels they're in. * Admin access on the Oleria platform to add a new integration. ## Choose an authentication method | Method | When to use it | | :- | :- | | **Personal token** (default) | The simplest setup: the test token of an integration you create in Twist. The token acts with the full access of the user who created the integration, and has no scopes you can narrow. | | **OAuth 2.0** | Use it for least-privilege access. You create an integration in Twist and approve it, and Oleria acts as the user who approves it, with only the scopes Oleria requests. A connection without write actions gets read scopes only. | Both methods start with a general integration that you create in Twist. > [!NOTE] > > Twist's integration settings can change over time. If the steps below don't match what you see, refer to Twist's [API documentation](https://developer.twist.com/v3/), in particular its [OAuth 2](https://developer.twist.com/v3/#oauth-2) and [testing](https://developer.twist.com/v3/#testing-purposes) sections. ## Set up a personal token **1. Create a general integration** Sign in to Twist as a workspace Admin and create a general integration, for example named `Oleria`. **2. Copy the test token** Copy the test token from the OAuth section of your integration's details page. > [!WARNING] > > Treat the token like a password. It acts with the full access of the user who created the integration. Store it securely and rotate it per your organization's security policy. ## Set up OAuth **1. Create a general integration** Sign in to Twist as a workspace Admin and create a general integration, for example named `Oleria`. **2. Set the redirect URL** In the OAuth section of your integration's details page, set the OAuth redirect URL to the following, replacing `` with the host of your Oleria workspace, as shown in your browser's address bar: `https:///workspace/integrations/twist/connect` A Twist integration has one redirect URL, so Oleria uses it both when you add the integration and when you edit or reconnect it. The Oleria connection form shows this URL when you choose **OAuth 2.0**. **3. Copy the client credentials** From the same section, copy the integration's client ID and client secret. When you authenticate, Twist asks the signed-in user to approve the scopes Oleria requests. Approve as a workspace Admin. Read scopes, always requested: | Scope | What Twist grants | Used for | | :- | :- | :- | | `user:read` | Access to the user's personal settings | Identifying the user the connection acts as, for the connection's own credential and the action safeguards. | | `workspaces:read` | Access to the teams the user is part of | The workspace, its members, and their roles. | | `groups:read` | Access to groups | Groups and group membership. If Twist refuses the groups read, Oleria syncs everything else without groups. | Write scopes, requested only when you select **I authorize Oleria to perform write actions in Twist**: | Scope | What Twist grants | Used for | | :- | :- | :- | | `workspaces:write` | Access to and updates of the teams the user is part of | **Disable user accounts**, **Enable user accounts**, **Create user**, **Add user to role**, and **Remove user from role**. | | `groups:write` | Access to and updates of groups | **Add user to group**, **Remove user from group**, **Create group**, and putting a user back in their groups when you revert **Disable user accounts**. | | `groups:remove` | Access to, updates of, and deletion of groups | **Create group**, whose revert deletes the group it created. | ## Connect Twist to Oleria **1. Open the integration** Sign in to your Oleria workspace, navigate to **Integrations**, and select **Twist**. **2. Complete the connection form** Fill in the connection form: | Field | Notes | | :- | :- | | Authentication method | **Personal token** (default) or **OAuth 2.0**. | | API token | **Personal token** only. The test token you copied. | | OAuth client ID | **OAuth 2.0** only. The client ID of your Twist integration. | | OAuth client secret | **OAuth 2.0** only. The client secret of the same integration. | | Workspace ID (optional) | The numeric ID of the Twist workspace to connect. Leave it blank to use the default workspace of the token's user. It can't be changed after you connect. | | Base URL (optional) | The Twist API host. Leave it as `https://api.twist.com`. Only `https` hosts on `twist.com`, without a port, path, or query, are accepted. | | I authorize Oleria to perform write actions in Twist | Select it only if you want Oleria to take [remediation actions](#remediation-actions). With **OAuth 2.0**, Oleria then also requests the write scopes. | **3. Authenticate** Select **Authenticate**. With **OAuth 2.0**, you're redirected to Twist to approve access, then back to Oleria automatically. Oleria checks that the credential can read the workspace's members before it saves the integration, and stores the workspace it connected to. If you enter a **Workspace ID** that the credential can't see, the error lists the workspaces the credential can see, with their IDs. ## Verify the integration Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page. It's named after your workspace ID, for example **Twist (12345)**. After the first sync completes, review the discovered accounts, roles, groups, and NHIs in your Oleria workspace, and check that your Admins and Guests are marked correctly. To update the integration, for example after you rotate the token, edit it in Oleria: * To keep the stored token or client secret, leave that field empty. * If you change the OAuth client ID, enter the new integration's client secret too. * If you switch the authentication method, enter the new method's credential. * The workspace can't be changed. Oleria rejects a credential that resolves to a different workspace. To connect another workspace, add a new integration. With **OAuth 2.0**, if you turn on write actions after connecting, edit the integration and select **Update**. Twist then asks you to approve the write scopes. ## Remediation actions Beyond discovery, Oleria can act on Twist access to remediate risk. Actions need **I authorize Oleria to perform write actions in Twist** to be selected. Before an action runs, Oleria checks that the connection's user holds the workspace role the action needs and, with OAuth, that the write scopes were granted. It reports what's missing. | Action | What it does | Revert | | :- | :- | :- | | Disable user accounts | Removes the person from the workspace. Twist has no suspend or deactivate state, so removal is how Oleria takes access away. Their threads, comments, and messages stay in Twist. | Supported - re-adds the person by email with the role they had, then adds them back to the groups they were in. Groups that no longer exist are skipped. If a group can't be restored, Oleria reports it; run the revert again or add the person to that group in Twist. Channel memberships aren't restored, so add the person back to their channels in Twist. If Twist gives the re-added person a new account, Oleria shows that account, pending until they accept the invitation, and the earlier account stays disabled. | | Enable user accounts | Re-adds a removed person by email, with the role they last held. On the Unlimited plan, this can take a billed seat, and Twist may send an invitation. If Twist gives the person a new account, Oleria shows that account, pending until they accept, and the earlier account stays disabled. | Supported - removes the person again. | | Create user | Invites a person by email as a **Member**. If a member with that email already exists, Oleria leaves it as is. If a removed user has that email, use **Enable user accounts** instead. On the Unlimited plan, the seat is billed. | Supported - removes the invited person. | | Add user to role | Sets the person's workspace role to **Admin**, **Member**, or **Guest**. A Twist user holds exactly one role, so this replaces the previous one. | Supported - restores the previous role, only if the person still holds the role the action set. Otherwise Oleria leaves it as is and reports that it changed. | | Remove user from role | Removes the **Admin** role, which makes the person a **Member**. Only the Admin role can be removed. To change a Member or Guest, use **Add user to role** with the role they should have. | Supported - makes the person an Admin again, only if they're still a Member. Otherwise Oleria leaves it as is and reports that it changed. | | Add user to group | Adds the person to a group. Removed users must be re-added to the workspace first. | Supported - removes them from the group. | | Remove user from group | Removes the person from a group. | Supported - adds them back to the group. | | Create group | Creates a group with the given name. If a group with exactly that name already exists, Oleria leaves it as is. | Supported - deletes the group, only while it has no members. If people were added to it since, Oleria leaves the group as is and reports that it changed. | The connection's user needs this workspace role: | Action | Required Twist role | | :- | :- | | Disable user accounts, Enable user accounts, Create user, Add user to role, Remove user from role | **Admin**. Reverting **Create user** removes a person, which only an Admin can do. | | Add user to group, Remove user from group, Create group | **Admin** or **Member** | If the target is already in the requested state, the action succeeds without making a change, and there's nothing to revert. A few safeguards apply: * Oleria never removes, re-adds, or changes the role of the Twist user the connection acts as, because that could break the connection. * Oleria never removes, re-adds, or changes the role of a bot user. Bots belong to installed integrations, and these actions refuse them. * Twist's own limits still apply. For example, Twist refuses to remove or demote the workspace's last Admin, and adding a person fails when the workspace has reached its maximum number of users or the [pending invitation limit](#known-limitations). Oleria reports Twist's message. ## Known limitations * **No activity data.** Twist has no audit log, login history, or activity API, so Oleria shows no activity for Twist. * **No last activity, password change, or created dates.** Twist doesn't report when a person was last active, last changed their password, or joined. Oleria can't flag dormant Twist accounts. * **No MFA or single sign-on data.** Twist doesn't report two-factor authentication, single sign-on, or sign-in methods for its users. Oleria shows them as unavailable rather than not required. * **Installed integrations are visible only through their bot users.** Twist has no API that lists installed integrations or reports who installed them. Oleria shows the bot user each integration adds, with no installer or owner. Integrations without a bot user don't appear. Oleria can't disable or remove bots; uninstall the integration in Twist instead. * **Channels and messages aren't collected.** Oleria doesn't read channels, threads, conversations, or messages, so access granted through channel membership isn't shown, and channel memberships aren't restored when you revert **Disable user accounts**. * **Pending invitation limit on new workspaces.** A new Twist workspace allows at most three pending invitations until more people join. A removed user who never joined still counts. Until then, Twist can refuse **Create user**, **Enable user accounts**, and the revert of **Disable user accounts** for people who never joined. Oleria reports Twist's message. * **One workspace per connection.** Each integration reads one workspace, and the workspace can't be changed when you edit the integration. To connect another workspace, add a new integration. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.