> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vanta

Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we integrate your Vanta organization into the Oleria platform, giving you visibility into every Vanta login and its group memberships, plus the ability to run offboarding and group-membership actions from Oleria. This document provides step-by-step guidance for integrating Vanta with your Oleria workspace.

## Prerequisites

* A **Vanta organization** with a user who can create applications in **Settings** -> **Developer Console** (Admin role recommended).
* Optional: the **Vanta Person ID** of whoever Oleria should record as the offboarding acknowledger, if you plan to run the **Offboard Person** action.

<Note>Oleria requests an OAuth scope per connection, not per application - you don't grant any scope inside Vanta itself. You choose **Read-only** or **Read-write** later, in Oleria's connection form.</Note>

## What Oleria discovers

| Area         | Detail                                                                                                                                                                                          |
| :----------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Users**    | Vanta dashboard logins, enriched with linked personnel records where available.                                                                                                                 |
| **Groups**   | Vanta groups and their membership. Vanta groups don't nest.                                                                                                                                     |
| **Activity** | Vanta's own internal audit trail - administrative actions, sign-ins, and role, policy, vendor, and control changes performed inside Vanta. Not activity within a downstream monitored resource. |

<Note>Vanta's REST API doesn't expose role or permission-profile assignments, so Oleria can't inventory who holds which Vanta role. See [Notes and limitations](#notes-and-limitations) below.</Note>

## Set up the integration

Vanta authentication uses OAuth 2.0 client credentials. You register an application in Vanta's Developer Console and provide the credentials to Oleria.

<Steps>
  <Step title="Create an OAuth application">
    1. Log in to Vanta and go to **Settings** -> **Developer Console**.

    2. Select **Create**.

    3. For **Application type**, select **Manage Vanta**. Vanta's other application types - **Build Integrations** (Private or Public) and **Auditor** - are for different use cases and don't apply to this integration.

    4. Enter an application name (for example, `Oleria`) and a description, then save.
  </Step>

  <Step title="Copy your credentials">
    1. Copy the **Client ID** - Vanta generates this automatically when you create the application.

    2. Select **Generate client secret** and copy the **Client Secret** immediately - Vanta shows it only once.

    <Warning>If you lose the client secret, generate a new one in Vanta and update the credential in Oleria. Vanta doesn't let you retrieve a previously generated secret.</Warning>
  </Step>

  <Step title="Find the offboarding acknowledger Person ID (optional)">
    Only required if you plan to use the **Offboard Person** action from Oleria.

    1. In Vanta, go to **Personnel** -> **People**.

    2. Select the person Oleria should record as the acknowledger on offboarding tasks.

    3. Copy their Person ID from the browser URL.
  </Step>
</Steps>

## Connect Vanta to Oleria

<Steps>
  <Step title="Open the integration">
    Log in to your Oleria workspace and navigate to **Integrations** -> **Vanta** -> **Connect**.
  </Step>

  <Step title="Complete the connection form">
    Provide the following and select **Authenticate**:

    | Field                                  | Notes                                                                                                                                                                  |
    | :------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | **Client ID**                          | Required. From the application you created in Step 1. Also identifies your Vanta organization to Oleria and can't be changed later.                                    |
    | **Client Secret**                      | Required. From the application you created in Step 1.                                                                                                                  |
    | **Scope**                              | Required. **Read-only** covers user, group, and activity sync. Choose **Read-write** only if you also want to run offboarding or group-membership actions from Oleria. |
    | **Vanta Region**                       | Required. **Commercial** for most organizations, or **Vanta Gov (FedRAMP)** if your organization uses Vanta's FedRAMP environment.                                     |
    | **Offboarding Acknowledger Person ID** | Optional. The Vanta Person ID from Step 3. Required only if you plan to run the **Offboard Person** action.                                                            |
  </Step>

  <Step title="Complete the connection">
    Oleria validates the connection, discovers your Vanta users, groups, and activity, and begins the first sync.
  </Step>
</Steps>

## Verify the integration

Confirm Vanta appears in your Oleria workspace's connected integrations. After the first sync completes, you can review the discovered users, groups, and activity in your Oleria workspace.

## Remediation actions

Remediation actions require the **Read-write** scope selected during setup - a read-only connection can't run these.

| Action                       | Notes                                                                                                                                                                                                                                                |
| :--------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Offboard Person**          | Marks the person as offboarded in Vanta and records the configured acknowledger. Vanta requires the person to already be marked an ex-employee, with all monitored accounts deactivated and offboarding tasks complete, before this action succeeds. |
| **Add Person to Group**      | Adds the person to the selected Vanta group.                                                                                                                                                                                                         |
| **Remove Person from Group** | Removes the person from the selected Vanta group.                                                                                                                                                                                                    |

<Warning>Offboard Person can't be undone. Vanta has no operation to re-onboard or reactivate an offboarded person.</Warning>

## Notes and limitations

* **Roles and permissions:** Vanta's public API doesn't expose your organization's role assignments (Admin, Member, Auditor, or custom roles). Oleria can't inventory who holds which Vanta role, and account records never show a real role value.
* **Non-human accounts:** system, API, SCIM, and AI-agent principals in Vanta aren't modeled as accounts. They're visible only as the actor on activity events.
* **Resources:** Vanta has no independent, ACL-governed resource surface of its own. This integration inventories accounts, groups, and activity only, not resource-level access.
* **Activity retention:** Vanta's event log covers events from October 28, 2022 onward and is retained for at least one year.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).