What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Zip organization:- Accounts - every user in the organization, with their name, email address, permission groups, status, department, subsidiary, employee number, and manager. Active users are enabled. Deactivated users are imported as disabled. Users in a permission group named Admin or Administrator are marked as administrators. If single sign-on is enforced for a user, Oleria marks it as required.
- Roles - each Zip permission group (the collections of feature permissions that control what users can do in Zip) and each hierarchical approval role (which determines who approves requests based on reporting chain and amount). A user can hold several of each.
- Groups - each department and each subsidiary in Zip is imported as a group, with the users who belong to it. A user belongs to at most one department and one subsidiary.
- Activity - events from the Zip audit trail, with the user who acted and their IP address. Events are imported with their original Zip event type. Audit trail access requires a Zip Premier subscription.
Oleria doesn’t import purchase requests, approvals, vendors, purchase orders, invoices, agreements, or budgets. This integration covers identity and access governance for people, permission groups, approval roles, and groups only.
Prerequisites
- A Zip administrator, or a Zip user with the Manage company API keys permission, to create the API key.
- A Zip Premier subscription to import activity and to use the remediation actions that change users’ permission groups, approval roles, departments, or subsidiaries.
- Admin access to the Oleria workspace.
Create an API key in Zip
1
Open the API settings
Sign in to Zip, select the gear icon at the top of the page, and select Company settings. In the Setup section of the menu, select API.
2
Create the key
Select Create API key and choose the type of key:
- A Standard key reads and writes all Zip API endpoints. It’s the simplest choice.
- A Restricted key only reaches the record types you choose. Give it Read only access to users, user groups, roles, departments, and subsidiaries, plus audit logs if you want activity. To use the remediation actions, give it Read and write access to users.
Oleria, optionally set an expiration date, and select Create.3
Copy the key
Copy the API key and store it securely. Zip shows the full key only once.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Zip’s own API documentation, which you can open from the question mark menu in Zip.
Connect Zip to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select Zip.
2
Complete the connection form
Select Continue and provide the following:
3
Confirm the connection
Select Authenticate to validate the key. Oleria checks that it can read users, permission groups, approval roles, departments, and subsidiaries. Find the newly connected organization on the Connected tab of your Oleria Integrations page.
You can connect each Zip organization to Oleria once. Oleria uses the Zip URL you enter to name the integration, so enter the URL of the organization the API key belongs to.
Verify the integration
Confirm the Zip organization appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, roles, groups, and activity in your Oleria workspace.If you replace or rotate the API key in Zip, update the integration in Oleria with the new key. The new key must belong to the same Zip organization. To keep the stored key when you edit the integration, leave the field empty. You can’t change the Zip URL of an existing integration. To connect a different Zip organization, add a new integration.
Remediation actions
Oleria can take these actions in Zip. Each one needs an API key with read and write access to users:- Deactivate a user. The user can no longer sign in to Zip. Zip’s API has no way to reactivate a user, so this action can’t be reverted from Oleria. Reactivate the user in Zip if needed.
- Add a user to, or remove a user from, a permission group or approval role. Zip replaces a user’s whole list of permission groups or approval roles on every change, so Oleria reads the user’s current assignments first and keeps every other assignment unchanged. Reverting the action undoes the change. This action requires Zip Premier.
- Move a user to a department or subsidiary. Because a user belongs to at most one department and one subsidiary, adding a user to one moves them there. Reverting the action moves the user back. This action requires Zip Premier.
- Oleria won’t remove a user’s last permission group. Assign another permission group first. Reverting an action that gave a user their only permission group returns them to having none.
- If someone changes the same user’s permission groups or approval roles in Zip while Oleria is updating them, and that change removes an assignment Oleria kept, the action fails instead of reporting success. Check the user in Zip and run it again.
- If a user had no department or subsidiary before they were moved, the move can’t be reverted from Oleria, because Zip’s API can’t clear these fields. Reset it in Zip.
- If someone changes the user’s department or subsidiary in Zip after Oleria moved them, Oleria won’t revert the move, so it doesn’t overwrite that later change.
- If the API key or your plan doesn’t allow changing users, the import still works but these actions fail with a missing-permission error.
Known limitations
- Oleria doesn’t import MFA settings for Zip users.
- Zip doesn’t publish its list of audit event types, so activity is imported with Zip’s own event names rather than mapped to Oleria activity types.
- Activity is only available with Zip Premier. Without it, Oleria imports accounts, roles, and groups but no activity.
- Oleria doesn’t import Zip API keys or webhooks. API calls made with a key appear as activity with the key’s name.