Skip to main content
Connect Vercel to Oleria to see who belongs to your Vercel team, which role each member holds, and which access tokens and installed integrations can reach your team. Vercel is a frontend cloud platform. Oleria reads one Vercel team at a time with an access token, so you can review access to Vercel and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Vercel team:
  • Accounts - every member of the team, with their name, email address, username, the date the account was created, and how they sign in. Oleria shows the Git logins linked to the account (GitHub, GitLab, or Bitbucket) as sign-in methods, and shows single sign-on when the member signed in through your team’s SAML identity provider. Oleria shows single sign-on as Required when the team enforces SAML, Configured for a member who joined through your identity provider, and Not configured otherwise. A person who asked to join the team but hasn’t been accepted yet appears as a disabled account. Oleria shows each member’s multi-factor authentication as Required when the member has MFA turned on in Vercel and Not required when they don’t. Vercel doesn’t report a member’s last activity or password change (Vercel has no password login), so Oleria leaves those empty.
  • Roles - the Vercel team roles. Oleria shows the role identifiers that Vercel’s API returns: OWNER, MEMBER, DEVELOPER, SECURITY, BILLING, VIEWER (the Viewer role), VIEWER_FOR_PLUS (the Enterprise Viewer role), and CONTRIBUTOR. Every member holds exactly one role. Oleria lists all of them, including roles nobody holds yet, so you can assign any of them.
  • Groups - the team’s access groups, with their members and the team roles and permission groups they carry. Access groups are available on the Vercel Enterprise plan, and Oleria reads them with an Owner’s token (see Prerequisites).
  • Non-human identities and credentials:
    • Access tokens that belong to the account Oleria connects with. Oleria shows each token’s name, creation and expiry dates, last activity, and whether it’s limited to specific teams, and links it to the account that owns it. Tokens limited to other teams aren’t shown, because they can’t reach this team. Oleria skips the short-lived sign-in sessions Vercel also lists, which are the person signing in rather than a token someone created.
    • Installed integrations - every integration installed on the team, with the scopes you granted it, its status, and the member who installed it.
    Oleria never reads or shows a token value.
  • Activity - events from your team’s activity trail, such as sign-ins, members added, removed, or given a new role, access groups changed, access tokens created or deleted, integrations installed or removed, SAML and MFA policy changes, and reads and changes of environment variables. Each event keeps its Vercel event type, who did it, the member it concerns where Vercel names one, and whether an access token was used. Oleria imports up to 90 days of history.
Oleria refreshes this data on its regular sync schedule.
Oleria doesn’t import projects, deployments, domains, or environment variables, so it doesn’t populate Access Inventory or resource-level Access Graph data for Vercel. This integration covers identity and access governance for members, roles, groups, credentials, and activity.

​
Prerequisites

  • A Vercel team. Members, roles, access tokens, and activity sync from any plan, including a free Hobby team. Inviting people needs a paid plan (Vercel refuses invitations on a Hobby team), and access groups need Enterprise.
  • A Vercel account that is an Owner of the team, to create the access token from. Oleria uses the token with that account’s permissions: reading access groups and team activity, and every remediation action except deleting an access token or uninstalling an integration, need the Owner role. Reading members and roles needs any team role except Contributor. See Required permissions for each action.
  • The Vercel Enterprise plan and an Owner’s token, if you want Oleria to import access groups. Vercel offers access groups on Enterprise only, to Owners. On another plan, or when the token’s account isn’t an Owner, Oleria skips access groups, logs it, and still syncs everything else. Vercel’s Audit Log feature (export and log drains) is also an Enterprise feature; if Vercel denies the team activity request for your plan or role, Oleria skips activity and still syncs everything else.
  • Admin access to the Oleria workspace.
A Vercel access token has no scopes of its own. It can do everything the account that created it can do on the teams the token covers, and Oleria uses the same token for remediation actions. Store the token as an administrative credential. Create it from a dedicated service account that is an Owner of the team, so the connection doesn’t break when an employee leaves. Don’t use Oleria to remove that account from the team or to delete the token Oleria connects with.

​
Create an access token in Vercel

1

Open your account tokens

Sign in to Vercel as an Owner of the team, open your account menu, select Account Settings, and go to Tokens.
2

Create the token

Enter a name such as oleria, choose the team under Scope, and choose an expiration date. Select Create Token.
3

Copy the token

Copy the token and store it securely until you’ve connected Oleria. Vercel shows it only once. When the token expires, Vercel rejects it, so update the integration with a new token before then.
4

Find your team ID or slug

Open your team’s Settings > General. Team ID shows the ID, which starts with team_. The slug is the part of your team’s address after vercel.com/.

​
Connect Vercel to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Vercel.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria checks that Vercel accepts the token, that the team exists, and that the token’s account is a member of it.
If Authenticate fails, Oleria shows the reason. The most common causes:
  • Vercel rejects the token (401). Check that it’s a valid access token that hasn’t expired.
  • Vercel can’t find the team or doesn’t allow access to it. Check the team ID or slug, make sure the token’s account belongs to the team, and make sure the token isn’t limited to a different team.
  • The account has only asked to join the team. Ask a team Owner to accept the request.
You can connect each Vercel team to Oleria once. To connect a different team, add a new integration.

​
Existing SCIM connections

If you connected Vercel to Oleria earlier with a SCIM base URL and token, that connection used a SCIM token, which can’t read the Vercel API. After this update, its syncs fail with a message asking you to reconnect with an access token and the team ID or slug. Edit the existing integration rather than deleting it and adding a new one:
  1. Create an access token and find your team ID or slug.
  2. In Oleria, edit the Vercel integration. Paste the token into Access token and enter the team ID or slug. The team field is empty and editable for a connection made with SCIM.
  3. Select Update. Oleria checks the token and the team as it does for a new connection, and the next sync uses the new token.
Oleria no longer uses the SCIM token. Don’t revoke it if your identity provider uses it for directory sync to Vercel, because that stops your identity provider’s sync.

​
Verify the integration

Confirm the Vercel team appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, roles, groups, credentials, and activity in your Oleria workspace.
If you rotate the token or it expires, update the integration in Oleria with the new token. To keep the stored token when you edit the integration, leave the Access token field empty. The team is locked after you connect, because it identifies the connection.

​
Required permissions

The account that created the token determines what Oleria can read and do. Vercel access tokens have no scopes, so the permissions below are team roles as Vercel’s access roles page names them. Vercel doesn’t attach a role to every endpoint Oleria uses, so some rows are inferred.
Vercel answers a missing permission, a plan limit, and a team the token can’t see with the same error (HTTP 403). Because of that, a missing permission doesn’t change a row on the Capabilities tab to Needs permission: if Oleria can’t read members or roles, it keeps the last saved capability until the read works again. Access groups are the exception: Vercel reports the token’s own team role, so on an Enterprise team whose token account isn’t an Owner, the groups row shows Needs permission.

​
Remediation actions

Oleria can take these actions in Vercel. Each one uses the integration’s access token, and Oleria first checks that the token’s account has the role the action needs. Oleria reads the current state first, so an action on something already in the target state succeeds without changing anything, and reverting such an action changes nothing either.
  • Remove a user from the team. The person loses access to every project in the team. This also dismisses a pending request to join. Reverting the action invites the person back by email with the role they had. They must accept the invitation, and project roles they had aren’t restored. Oleria refuses to remove the account that the integration connects with, and the last Owner of the team.
  • Invite a user to the team (and enable a user, which re-invites a removed member). Oleria invites the person by email with the least-privileged read-only role your plan offers: Enterprise Viewer on Enterprise, Viewer on Pro. Assign a higher role after they join. Oleria refuses an invitation that also asks for group memberships or a password: the person can join an access group only after they accept, and Vercel has no password sign-in. If the person is already a member or already invited, nothing changes. Reverting withdraws the invitation, or removes the person if they’ve already joined.
  • Add a user to an access group and remove a user from an access group (Enterprise plan). Oleria changes the group’s members and checks afterwards that the change took effect. Oleria refuses groups that your directory sync manages: change the directory group instead. Reverting puts the membership back, only if the action changed it.
  • Create an access group (Enterprise plan). Oleria creates a group with the name you give it, unless a group with that name exists. If Vercel’s answer is lost, Oleria looks the group up by name, so a group the action created is still reverted. Reverting deletes the group, and only a group that the action created.
  • Assign a team role. A Vercel member holds exactly one team role, so assigning a role replaces the one the member had. Oleria never lowers a member’s role this way: it refuses a role that gives less access than the member’s current one. Oleria refuses to change the role of the account that the integration connects with. Reverting restores the role the member had, as long as the member still holds the role the action set.
  • Disable a non-human identity. Oleria deletes an access token of the account it connects with, or uninstalls an installed integration, which also removes the integration’s webhooks, log drains, and project environment variables. Neither can be reverted. Oleria refuses to delete the token that the integration itself uses. If the token or integration is already gone, the action fails with “NHI not found” instead of succeeding, because a missing item looks the same as a wrong ID.
Oleria can’t remove a person from a role (a member always holds one), revoke a person’s sessions, or delete a Vercel account. Vercel’s API doesn’t offer those actions for a team.

​
Known limitations

  • Only one account’s access tokens. Vercel lists only the access tokens of the account the token belongs to. Oleria can’t list other members’ tokens or a team’s tokens. Vercel’s token list has no way to request a next page, so if Vercel ever splits an account’s tokens across pages, Oleria shows the first page and logs that the rest weren’t read.
  • Access tokens need account-level reads. Oleria lists access tokens through Vercel’s account endpoints. If Vercel refuses them for a token limited to the team, Oleria imports no access tokens, logs it, and syncs everything else. Member, role, and access group actions still work, because Oleria identifies the connection’s own account from the team.
  • Some profile details aren’t available. Vercel doesn’t report a member’s last activity or password change, so Oleria leaves those empty. Vercel returns a member’s extra permission groups only for access groups, not for individual members.
  • Access groups need the Enterprise plan and the Owner role. On another plan, or when the token’s account isn’t an Owner, Oleria skips access groups, logs it, and the rest of the sync completes. If the account loses the Owner role later, Oleria stops showing the team’s access groups until you restore the role or update the token. On an Enterprise team where the token’s account is an Owner, a refused access group request fails the groups part of the sync instead, because nothing explains it. Access groups assign project roles. Oleria doesn’t import projects, so it shows an access group’s members and roles, not the projects it covers.
  • Invitations need a paid Vercel plan. On a free Hobby team Vercel answers an invitation with an error (“Team members are not permitted on the Hobby Plan”), Oleria reports the action as failed, and nothing is sent.
  • Pending invitations aren’t accounts. Vercel returns people you’ve invited but who haven’t accepted. Oleria doesn’t import them until they join.
  • Activity depends on your plan and role. Vercel’s Audit Log feature is available on Enterprise, and team activity needs the Owner role. If Vercel denies the request, Oleria skips activity and the rest of the sync still completes. Oleria imports up to 90 days of history. Events carry the member they concern only for member and access group changes.
  • Some credential details aren’t available. Oleria shows the last time Vercel reports an access token as active, but Vercel doesn’t return who created an installed integration other than the installing member, and it never returns a token value or whether an integration’s token is still accepted elsewhere.
  • One team per connection. Oleria connects to one Vercel team at a time. Connect each team separately.
  • Invited people get a default role. Oleria invites with the least-privileged read-only role for your plan. Change the role from Oleria after they join.
  • Rate limits. Vercel limits requests per endpoint and answers with HTTP 429 when it throttles requests. Oleria retries and paces its requests, so very large teams can take longer to sync.

​
Contact us

For questions about this integration, contact us at support@oleria.com.