> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Airtable

> Connect your Airtable Enterprise account to Oleria to continuously discover and map who has access to your workspaces, bases, and enterprise groups.

Connect your Airtable Enterprise account to Oleria to gain continuous visibility into who has access across your workspaces and bases, and to review activity across your Airtable enterprise. Oleria reads identity, access, and audit data from the Airtable Enterprise Admin API, so you can see every account, group, role, and access change in one place. This page provides step-by-step guidance for connecting Airtable to Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Airtable enterprise:

* **Accounts** - enterprise users and service accounts, including admin status, license type, and activity status.
* **Groups** - enterprise user groups and their membership.
* **Roles and permission levels** - the five Airtable permission levels (read, comment, edit, create, owner), modeled as roles, with effective access resolved across direct, group, and workspace-inherited collaboration.
* **Resources** - workspaces and bases, and the collaborators and groups with access to each.
* **Audit activity** - enterprise-wide audit log events such as user creation, permission changes, and login activity, covering a 180-day retention window.

<Note>
  Oleria does not currently discover access granted via Airtable share links (public or
  link-based sharing of a base or view), and does not inventory Airtable personal access
  tokens or OAuth integrations as non-human identities - Airtable's enterprise API exposes
  no endpoint to enumerate them. Airtable service accounts are discovered and appear as
  accounts. Activity performed by PATs or OAuth integrations still appears in audit events.
  If your enterprise relies on share links or on PAT-based automation, that access will not
  appear in Oleria's inventory.
</Note>

## Prerequisites

* Airtable Enterprise Scale plan - the Enterprise Admin and Audit Log API is not available on other plans
* Enterprise admin access in Airtable
* Your Airtable Enterprise Account ID, found in the Airtable admin panel

## Choose an authentication method

Oleria supports two ways to connect to Airtable. Choose the one that fits your organization:

| Method                          | How it works                                                                                                                                                                                                                                               | Best for                                                                                                                                                                                                       |
| :------------------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **OAuth (recommended)**         | You sign in to Airtable and approve access directly in Oleria's connection flow. No token to create, copy, or rotate - Oleria refreshes access automatically. Requests the same scopes as a fully-privileged Personal Access Token, including remediation. | Most organizations. Faster setup, and access can be revoked from Airtable at any time without editing the Oleria integration.                                                                                  |
| **Personal Access Token (PAT)** | An enterprise admin creates a token in Airtable and pastes it into Oleria, choosing exactly which scopes to grant.                                                                                                                                         | Organizations that want a narrowly-scoped, read-only credential. OAuth always requests write access as part of a fixed scope set - a PAT lets you omit it deliberately if you never intend to use remediation. |

<Note>
  Both authentication methods can perform discovery and remediation - OAuth requests the full scope set automatically, including `enterprise.user:write`. This scope is optional: if it isn't granted (denied during the OAuth consent screen, or omitted when creating a Personal Access Token), the connection still works normally for discovery - only remediation actions are unavailable, and only surface as a permission error if one is attempted. On Airtable's OAuth consent screen, every requested scope appears as an individually deselectable checkbox, but `enterprise.user:write` is the only one safe to deselect - denying any of the other requested scopes will cause the connection to be rejected.
</Note>

If you're using OAuth, skip ahead to [Connect Airtable to Oleria](#connect-airtable-to-oleria) - no token needs to be created in Airtable first.

## Create a Personal Access Token in Airtable

Only needed if you're connecting with a Personal Access Token rather than OAuth.

<Steps>
  <Step title="Open personal access tokens in Airtable">
    Sign in to [airtable.com](https://airtable.com) and go to **Builder Hub** -> **Personal access tokens**.
  </Step>

  <Step title="Create a token with the required scopes">
    Create a new token and give it a recognizable name such as `Oleria connector`. Grant the following scopes:

    | Capability           | Scope                       | Used for                                                                                                      |
    | :------------------- | :-------------------------- | :------------------------------------------------------------------------------------------------------------ |
    | Enterprise account   | `enterprise.account:read`   | Discovery                                                                                                     |
    | Users                | `enterprise.user:read`      | Discovery                                                                                                     |
    | Groups               | `enterprise.groups:read`    | Discovery                                                                                                     |
    | Audit log            | `enterprise.auditLogs:read` | Discovery (audit activity)                                                                                    |
    | Workspaces and bases | `workspacesAndBases:read`   | Discovery (resources)                                                                                         |
    | Base schemas         | `schema.bases:read`         | Discovery (base collaborators - without this scope, base access is not discovered even though workspaces are) |
    | User management      | `enterprise.user:write`     | Remediation (remove user from enterprise, grant or revoke admin)                                              |

    <Note>
      The `enterprise.user:write` scope is only required if you want Oleria to take remediation actions. Omit it for read-only discovery.
    </Note>
  </Step>

  <Step title="Copy your Enterprise Account ID and token">
    Copy and save the following values - you will need them when connecting in Oleria:

    * **Enterprise Account ID** - found in your Airtable admin panel URL. It starts with `ent` (for example, `entXXXXXXXXXXXXX`).
    * **Personal Access Token** - the token value shown when you create the token.

    <Warning>
      The token value is shown only once. Store it securely - if you lose it, you must create a new token and update the connection in Oleria.
    </Warning>
  </Step>
</Steps>

## Connect Airtable to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Airtable**.
  </Step>

  <Step title="Choose an Authentication Method">
    Select **OAuth (recommended)** or **Personal Access Token** from the Authentication Method dropdown. The fields below change depending on which you choose.
  </Step>

  <Step title="Complete the connection form">
    | Field                 | Required for               | Notes                                                                                                                                      |
    | :-------------------- | :------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------- |
    | Enterprise Account ID | Both                       | Paste the Enterprise Account ID from the Airtable admin panel. Starts with `ent` and cannot be changed after the integration is connected. |
    | Personal Access Token | Personal Access Token only | Paste the Personal Access Token you created in Airtable. Not shown when OAuth is selected.                                                 |
  </Step>

  <Step title="Connect">
    Select **Connect to Airtable**.

    * **If you selected OAuth**, you're redirected to Airtable to sign in and approve the requested scopes. After you approve, you're returned to Oleria and the integration is created automatically.
    * **If you selected Personal Access Token**, the integration is created immediately using the token you pasted.
  </Step>
</Steps>

## Verify the integration

Confirm the Airtable instance appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered accounts, groups, roles, resources, and activity in your Oleria workspace.

<Note>
  **If you connected with OAuth**, Oleria refreshes your access automatically - no action is needed on your part. If you revoke Oleria's access from within Airtable, discovery stops until you reconnect.

  **If you connected with a Personal Access Token**, update the token in Oleria by editing the integration whenever you rotate it in Airtable. An expired or revoked token will cause discovery to stop.
</Note>

## Remediation actions

Beyond discovery, Oleria can act on Airtable access to remediate risk. The following actions are supported:

| Action                         | What it does                                                                                                            | Revert                                                                                                  |
| :----------------------------- | :---------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------ |
| Remove User from Enterprise    | Removes the user from the Airtable enterprise account, and from every descendant workspace and base they had access to. | Not supported. The user must be re-invited to Airtable, and their workspace and base access re-granted. |
| Grant Enterprise Admin Access  | Grants the user enterprise admin access.                                                                                | Revokes enterprise admin access.                                                                        |
| Revoke Enterprise Admin Access | Revokes the user's enterprise admin access.                                                                             | Grants enterprise admin access.                                                                         |

<Note>
  Remediation requires the `enterprise.user:write` scope. OAuth connections request this automatically. A Personal Access Token created without this scope can still perform discovery but will return a permission error when an action runs.
</Note>

<Note>
  Oleria's Airtable integration governs enterprise-level access only. Adding, removing, or updating a user's collaborator permissions on a specific workspace or base is not yet supported as a standalone remediation action. The one exception is **Remove User from Enterprise**, which cascades to every workspace and base the user could access.
</Note>

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).