> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Zip
> Connect Zip to Oleria to bring users, permission groups, approval roles, departments, subsidiaries, and audit activity from your procurement platform into your identity and access graph.
Connect Zip to Oleria to see who has access to your Zip procurement platform, with which permission groups and approval roles, and what they do there. Oleria reads users, permission groups, approval roles, departments, subsidiaries, and audit trail events from the Zip API using an API key, so you can review access to your purchasing and approval workflows and take action directly from Oleria.
## What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Zip organization:
* **Accounts** - every user in the organization, with their name, email address, permission groups, status, department, subsidiary, employee number, and manager. Active users are enabled. Deactivated users are imported as disabled. Users in a permission group named **Admin** or **Administrator** are marked as administrators. If single sign-on is enforced for a user, Oleria marks it as required.
* **Roles** - each Zip **permission group** (the collections of feature permissions that control what users can do in Zip) and each **hierarchical approval role** (which determines who approves requests based on reporting chain and amount). A user can hold several of each.
* **Groups** - each department and each subsidiary in Zip is imported as a group, with the users who belong to it. A user belongs to at most one department and one subsidiary.
* **Activity** - events from the Zip audit trail, with the user who acted and their IP address. Events are imported with their original Zip event type. Audit trail access requires a Zip Premier subscription.
Oleria refreshes this data on its [regular sync schedule](/integrations/overview#sync-model).
Oleria doesn't import purchase requests, approvals, vendors, purchase orders, invoices, agreements, or budgets. This integration covers identity and access governance for people, permission groups, approval roles, and groups only.
## Prerequisites
* A Zip administrator, or a Zip user with the **Manage company API keys** permission, to create the API key.
* A Zip Premier subscription to import activity and to use the [remediation actions](#remediation-actions) that change users' permission groups, approval roles, departments, or subsidiaries.
* Admin access to the Oleria workspace.
## Create an API key in Zip
Sign in to Zip, select the gear icon at the top of the page, and select **Company settings**. In the **Setup** section of the menu, select **API**.
Select **Create API key** and choose the type of key:
* A **Standard key** reads and writes all Zip API endpoints. It's the simplest choice.
* A **Restricted key** only reaches the record types you choose. Give it **Read only** access to users, user groups, roles, departments, and subsidiaries, plus audit logs if you want activity. To use the remediation actions, give it **Read and write** access to users.
Enter a name such as `Oleria`, optionally set an expiration date, and select **Create**.
Copy the API key and store it securely. Zip shows the full key only once.
If the key has an expiration date, the integration stops working when it expires. Create a new key before then and update the integration in Oleria.
The exact location of these settings can change over time. If the steps above don't match what you see, refer to Zip's own API documentation, which you can open from the question mark menu in Zip.
## Connect Zip to Oleria
Go to your Oleria workspace, select **Integrations** -> select **Zip**.
Select **Continue** and provide the following:
| Field | Notes |
| :- | :- |
| Zip URL | Required. The address you use to sign in to Zip, for example `https://acme.ziphq.com`. You can also enter just `acme`. |
| API Key | Required. The API key you created. |
Select **Authenticate** to validate the key. Oleria checks that it can read users, permission groups, approval roles, departments, and subsidiaries. Find the newly connected organization on the **Connected** tab of your Oleria **Integrations** page.
If **Authenticate** fails, check that the key is complete and hasn't expired, and that a restricted key has read access to all five record types.
You can connect each Zip organization to Oleria once. Oleria uses the Zip URL you enter to name the integration, so enter the URL of the organization the API key belongs to.
## Verify the integration
Confirm the Zip organization appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts, roles, groups, and activity in your Oleria workspace.
If you replace or rotate the API key in Zip, update the integration in Oleria with the new key. The new key must belong to the same Zip organization. To keep the stored key when you edit the integration, leave the field empty. You can't change the **Zip URL** of an existing integration. To connect a different Zip organization, add a new integration.
## Remediation actions
Oleria can take these actions in Zip. Each one needs an API key with read and write access to users:
* **Deactivate a user**. The user can no longer sign in to Zip. Zip's API has no way to reactivate a user, so this action can't be reverted from Oleria. Reactivate the user in Zip if needed.
* **Add a user to, or remove a user from, a permission group or approval role**. Zip replaces a user's whole list of permission groups or approval roles on every change, so Oleria reads the user's current assignments first and keeps every other assignment unchanged. Reverting the action undoes the change. This action requires Zip Premier.
* **Move a user to a department or subsidiary**. Because a user belongs to at most one department and one subsidiary, adding a user to one moves them there. Reverting the action moves the user back. This action requires Zip Premier.
Keep these limits in mind:
* Oleria won't remove a user's last permission group. Assign another permission group first. Reverting an action that gave a user their only permission group returns them to having none.
* If someone changes the same user's permission groups or approval roles in Zip while Oleria is updating them, and that change removes an assignment Oleria kept, the action fails instead of reporting success. Check the user in Zip and run it again.
* If a user had no department or subsidiary before they were moved, the move can't be reverted from Oleria, because Zip's API can't clear these fields. Reset it in Zip.
* If someone changes the user's department or subsidiary in Zip after Oleria moved them, Oleria won't revert the move, so it doesn't overwrite that later change.
* If the API key or your plan doesn't allow changing users, the import still works but these actions fail with a missing-permission error.
## Known limitations
* Oleria doesn't import MFA settings for Zip users.
* Zip doesn't publish its list of audit event types, so activity is imported with Zip's own event names rather than mapped to Oleria activity types.
* Activity is only available with Zip Premier. Without it, Oleria imports accounts, roles, and groups but no activity.
* Oleria doesn't import Zip API keys or webhooks. API calls made with a key appear as activity with the key's name.
## Contact us
For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.