> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Veeva Vault

> Connect Veeva Vault to Oleria to bring users, groups, security profiles, license types, and API access tokens into your identity and access graph.

Connect Veeva Vault to Oleria to see who can sign in to each Vault and with what access: users, groups, security profiles, license types, and administrators. Oleria reads identity and access data from the Vault API using an API access token, so you can find dormant and over-privileged users and take action directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Vault:

* **Accounts** - every user of the Vault, with their name, email address, user name, status, created date, and last login. Users with an **External User** license are marked as external. Users with the **Vault Owner** or **System Admin** security profile, and **Domain Admins**, are marked as administrators.
* **Roles** - the user's security profile, license type, and Domain Admin status. Oleria also imports the catalog of application roles, without per-document assignments.
* **User groups** - system-provided, user-managed, and auto-managed groups with their members. Members that a group gains through a security profile are marked as implied members.
* **Non-human identities** - API access tokens, each linked to the user it authenticates as when Vault reports the token's owner, and Vault system users, which are marked as machine accounts.
* **Single sign-on** - whether each user signs in with single sign-on or a Vault password, based on the user's security policy.
* **Activity** - login, domain, system, and user-record audit events from the Vault audit trails.

Oleria refreshes this data on its [regular sync schedule](https://docs.oleria.com/integrations/overview.md#sync-model).

> [!NOTE]
>
> Oleria doesn't import documents, binders, or object records, or the sharing roles on them. This integration covers identity and access governance for people, groups, and tokens only.

## Prerequisites

* A Vault user with access to the Vault API and the **System Admin** or **Vault Owner** security profile, or a custom profile that can read users, groups, security policies, and audit trails. When you connect, Oleria rejects a token whose user can't read the Vault's users, groups, and security policies.
* Admin access to the Oleria workspace.
* Optional: access to the domain audit trail, if you want Oleria to import domain-level changes. If the token's user can't read it, Oleria skips that trail and still imports everything else.

> [!WARNING]
>
> Create a dedicated integration user with the System Admin or Vault Owner profile, and generate the token from that user. A token belongs to the user it was created for, so the connection stops working if that user is deactivated or loses its security profile.
>
> The integration user must be a Vault user, not a VeevaID user. Vault can't generate API access tokens for VeevaID users, and converting a user to VeevaID deletes that user's tokens.

## Create an API access token in Veeva Vault

**1. Sign in as the integration user**

Sign in to the Vault you want to connect as the integration user that will own the token.

**2. Open API access tokens**

Open your user profile, then find **API Access Tokens**.

**3. Generate the token**

Create a new token with a name such as `Oleria Integration`. Leave the expiration date empty only if your security profile allows non-expiring tokens. Each user can hold up to 25 active tokens.

**4. Copy the token**

Copy the token somewhere secure. It starts with `veeva-vault-`.

> [!WARNING]
>
> Vault shows the token only once. If you lose it, generate a new token and update the integration in Oleria.

> [!NOTE]
>
> An API access token works only for the Vault it was generated in. Generate a separate token in each Vault you want to connect. The exact location of these settings can change over time. If the steps above don't match what you see, refer to Veeva's Vault API documentation.

## Connect Veeva Vault to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations** -> select **Veeva Vault**.

**2. Complete the connection form**

Select **Continue** and provide the following:

| Field | Notes |
| :- | :- |
| Vault DNS | Required. The address of the Vault, for example `promomats-acme.veevavault.com`. Enter the host only, without `https://` or a path. |
| API Access Token | Required. Paste the token you generated in the previous section. |

**3. Confirm the connection**

Select **Authenticate** to validate the token. Oleria rejects tokens whose user can't read the Vault's users, groups, and security policies. Find the newly connected Vault on the **Connected** tab of your Oleria **Integrations** page.

> [!NOTE]
>
> Add one integration for each Vault. You can connect each Vault to Oleria once. To use a token from a different Vault, add a new integration.

## Verify the integration

Confirm the Vault appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts, roles, groups, and tokens in your Oleria workspace.

> [!NOTE]
>
> If you delete or replace the token in Vault, update it in Oleria by editing the integration and entering the new token. A deleted or expired token causes the sync to fail. You can't change the Vault DNS of an existing integration; add a new integration instead.

## Remediation actions

Oleria can take these actions in Veeva Vault. Each one runs with the permissions of the token's user. With a custom security profile, the actions also need edit permission on users (to disable and re-enable) and on groups (to change membership):

* **Disable a user** and **re-enable a user** in the connected Vault. Disabling keeps the user's security profile and license type, so re-enabling restores the same access. The user stays active in your other Vaults.
* **Add a user to a group** and **remove a user from a group**.

Keep these limits in mind:

* Oleria won't disable the user that owns the connection's token, because that would disconnect the integration.
* Vault manages the membership of auto-managed groups, so Oleria can't change it.
* If a user belongs to a group because their security profile is attached to the group, Oleria can't remove them from it, even if they were also added to the group directly. Change the user's security profile or the group's security profiles in Vault instead.

## Known limitations

* The Vault API doesn't expose MFA settings. Your identity provider enforces MFA for users who sign in with single sign-on.
* Oleria doesn't import password change dates.
* Last login reflects sign-ins to the Vault UI. Sign-ins through the API appear in activity, not in last login.
* Oleria imports the last 30 days of audit history when you connect, then keeps it current. Vault's audit query API reaches back only 30 days; older history is available from Vault as a full audit trail export, which Oleria doesn't import.
* Oleria can't tell when a custom security profile grants administrator permissions, so only the Vault Owner and System Admin profiles, and Domain Admins, are marked as administrators.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.