Skip to main content
Connect Unleash to Oleria to gain continuous visibility into who can change your feature flags. Oleria reads identity, access, and audit data from the Unleash Admin API - users, groups, root and project roles, service accounts, and every API token - so you can see where access is over-provisioned, find unowned or long-lived tokens, and take action directly from Oleria. This integration works with Unleash Enterprise (hosted or self-hosted) and Unleash Open Source.

​
What Oleria discovers

  • Accounts - every user, with last login, root role, and how they sign in (password or SSO).
  • Non-human identities - every service account, service-account token, personal access token, backend/frontend/admin API token, signal-endpoint token, and add-on (integration such as a webhook, Slack, Teams, Datadog, or New Relic, which holds an outbound secret), each with its owner or creator, scope, and expiry. Oleria never reads the secrets themselves.
  • Groups - every group and its members.
  • Roles - the predefined root roles (Admin, Editor, Viewer) and project roles (Owner, Member, Reader), plus every custom root and project role with its permissions.
  • Resources - every project and environment, and which users, groups, roles, and API tokens can access each one.
  • Activity - the Unleash event log and login history (sign-ins, failed sign-ins, sign-outs), attributed to the user, service account, or admin token that performed them.

​
Prerequisites

  • An Unleash user or service account with the Admin root role, or an admin-type API token on Unleash Open Source. Without it, Unleash does not return users, groups, or tokens.
  • Your Unleash URL, including any instance path - for example https://us.app.getunleash.io/<instance> for hosted Unleash, or your self-hosted URL.
Self-hosted instances must be reachable from Oleria over HTTPS. Contact support@oleria.com to have your instance’s hostname allowed.

​
Authentication methods

Choose one method when you connect. All three use the same API token field. Oleria checks that the token matches the method you choose and that it holds the Admin root role before saving the connection.

​
Connect Unleash to Oleria

1

Create a token

Service account token (recommended): In Unleash, go to Admin settings -> Service accounts, select New service account, give it the Admin root role, then create a token for it.Personal access token: Sign in as a user with the Admin root role, open your profile, select Personal API tokens, and select New token.Admin API token: On Unleash Open Source, use an existing admin API token from Admin settings -> API access, or one configured on your instance.
2

Copy the token

Copy the token immediately - Unleash shows it only once. Choose the longest expiry your policy allows, and update the integration in Oleria before the token expires. If you lose it, create a new token and update the integration in Oleria.
3

Find Unleash in Oleria

Go to your Oleria workspace, select Integrations, select the Available tab, and search for Unleash.
4

Enter your Unleash URL

Select the Unleash card and enter your Unleash URL, including any instance path - for example https://us.app.getunleash.io/<instance>. The URL cannot be changed after the integration is created.
5

Choose the method and authenticate

Choose the Authentication method that matches your token, paste the token into API token, then select Authenticate. Oleria checks that the token is the kind you chose and holds the Admin root role before saving.

​
Verify the integration

Confirm the Unleash instance appears on the Connected tab of your Oleria Integrations page. After the first sync completes, review the discovered accounts, groups, roles, resources, and activity in your Oleria workspace.

​
Remediation actions

Oleria never deletes, disables, removes from a group, or changes the root role of the user, service account, or token the integration itself connects with.

​
Known limitations

  • Personal access tokens cannot be revoked by Oleria. Unleash lets only a token’s owner delete it; delete the owning user instead. Other users’ personal access tokens are discovered from the event log, so a token whose creation event was purged is not listed.
  • No MFA data. Unleash has no multi-factor authentication of its own; for SSO users any MFA is enforced by your identity provider.
  • Implicit default-project access that Editor and Viewer root roles get is not listed per user, because Unleash does not expose it.
  • Enterprise-only data. Groups, service accounts, custom roles, project role assignments, signal endpoints, and login history are Unleash Enterprise features; on Open Source, Oleria syncs users, root roles, projects, environments, API tokens, and the event log.

​
Contact us

For questions about this integration, contact us at support@oleria.com.