> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Unleash > Connect your Unleash instance to Oleria to continuously discover who has access to your feature-flag projects and environments, including every service account and API token. Connect Unleash to Oleria to gain continuous visibility into who can change your feature flags. Oleria reads identity, access, and audit data from the Unleash Admin API - users, groups, root and project roles, service accounts, and every API token - so you can see where access is over-provisioned, find unowned or long-lived tokens, and take action directly from Oleria. This integration works with Unleash Enterprise (hosted or self-hosted) and Unleash Open Source. ## What Oleria discovers * **Accounts** - every user, with last login, root role, and how they sign in (password or SSO). * **Non-human identities** - every service account, service-account token, personal access token, backend/frontend/admin API token, signal-endpoint token, and add-on (integration such as a webhook, Slack, Teams, Datadog, or New Relic, which holds an outbound secret), each with its owner or creator, scope, and expiry. Oleria never reads the secrets themselves. * **Groups** - every group and its members. * **Roles** - the predefined root roles (Admin, Editor, Viewer) and project roles (Owner, Member, Reader), plus every custom root and project role with its permissions. * **Resources** - every project and environment, and which users, groups, roles, and API tokens can access each one. * **Activity** - the Unleash event log and login history (sign-ins, failed sign-ins, sign-outs), attributed to the user, service account, or admin token that performed them. ## Prerequisites * An Unleash user or service account with the **Admin** root role, or an admin-type API token on Unleash Open Source. Without it, Unleash does not return users, groups, or tokens. * Your Unleash URL, including any instance path - for example `https://us.app.getunleash.io/` for hosted Unleash, or your self-hosted URL. Self-hosted instances must be reachable from Oleria over HTTPS. Contact [support@oleria.com](mailto:support@oleria.com) to have your instance's hostname allowed. ## Authentication methods Choose one method when you connect. All three use the same **API token** field. | Method | When to use it | | :- | :- | | **Service account token** (recommended) | Unleash Enterprise. The token belongs to a service account, so the integration keeps working when people leave. | | **Personal access token** | Unleash Enterprise, when you cannot use a service account. The token carries its user's permissions and stops working if that user is removed. | | **Admin API token** (legacy / Open Source) | Unleash Open Source, which has no service accounts. Use an existing admin API token; Unleash 8.x and later cannot create new ones. | Oleria checks that the token matches the method you choose and that it holds the Admin root role before saving the connection. ## Connect Unleash to Oleria **Service account token (recommended):** In Unleash, go to **Admin settings** -> **Service accounts**, select **New service account**, give it the **Admin** root role, then create a token for it. **Personal access token:** Sign in as a user with the Admin root role, open your profile, select **Personal API tokens**, and select **New token**. **Admin API token:** On Unleash Open Source, use an existing admin API token from **Admin settings** -> **API access**, or one configured on your instance. Copy the token immediately - Unleash shows it only once. Choose the longest expiry your policy allows, and update the integration in Oleria before the token expires. If you lose it, create a new token and update the integration in Oleria. Go to your Oleria workspace, select **Integrations**, select the **Available** tab, and search for **Unleash**. Select the Unleash card and enter your **Unleash URL**, including any instance path - for example `https://us.app.getunleash.io/`. The URL cannot be changed after the integration is created. Choose the **Authentication method** that matches your token, paste the token into **API token**, then select **Authenticate**. Oleria checks that the token is the kind you chose and holds the Admin root role before saving. ## Verify the integration Confirm the Unleash instance appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, review the discovered accounts, groups, roles, resources, and activity in your Oleria workspace. ## Remediation actions | Action | Reversible? | | :- | :- | | Create user | Yes - reversed by deleting the user Oleria created. New users get the Viewer root role and no invitation email. A request that includes groups is refused; add the user to groups with Add user to group after it's created. The user has no password: they sign in through SSO, or an Unleash admin sends them a password reset link. | | Delete user | No - Unleash has no restore. Service accounts are refused: use Disable non-human identity to revoke all of a service account's tokens, and delete the service account in Unleash to remove its roles. | | Create group | Yes - reversed by deleting the group Oleria created. | | Add user to group / remove user from group | Yes. | | Add user to role / remove user from role | Yes. Root roles: removing a role moves the user to Viewer, because every Unleash user must hold one root role. Project roles are added or removed per project, and only a role held directly is removed: a project role that comes through a group stays, so remove the user from the group. Removing Admin is refused while a group also grants Admin, and Oleria names that group. Viewer can't be removed; assign another root role instead. Reversing undoes only Oleria's change: project roles granted since are kept, and a root role changed since is left in place and the reversal reports a conflict. | | Revoke project access | Yes - reversed by adding back the project roles Oleria removed. Project roles granted after the revoke are kept. If the user or service account also reaches the project through a group, or holds the Admin root role directly or through a group, Oleria changes nothing and names that source so you can change it there. | | Disable non-human identity | Tokens: no - revokes an API token, service-account token, or signal-endpoint token; disabling a service account revokes all of its tokens. Add-ons: yes - the add-on is switched off (its secret is kept) and reversed by switching it back on. Unleash applies the change within about a minute. | Oleria never deletes, disables, removes from a group, or changes the root role of the user, service account, or token the integration itself connects with. ## Known limitations * **Personal access tokens cannot be revoked by Oleria.** Unleash lets only a token's owner delete it; delete the owning user instead. Other users' personal access tokens are discovered from the event log, so a token whose creation event was purged is not listed. * **No MFA data.** Unleash has no multi-factor authentication of its own; for SSO users any MFA is enforced by your identity provider. * **Implicit default-project access** that Editor and Viewer root roles get is not listed per user, because Unleash does not expose it. * **Enterprise-only data.** Groups, service accounts, custom roles, project role assignments, signal endpoints, and login history are Unleash Enterprise features; on Open Source, Oleria syncs users, root roles, projects, environments, API tokens, and the event log. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.