> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OneLogin setup

> Connect OneLogin to Ravenna by creating API credentials with full Manage All scope so user, group, role, and application sync can run automatically.

Connect using API client credentials. Requires OneLogin administrator access to create API credentials.

## Prerequisites

Before you begin, ensure you have:

* OneLogin administrator access
* Permissions to create API credentials in the OneLogin Admin Console

## Setup guide

### Create API credentials in OneLogin

<Steps>
  <Step title="Access the OneLogin Admin Console">
    Log in to your [OneLogin Admin Console](https://app.onelogin.com) as an administrator
  </Step>

  <Step title="Navigate to API credentials">
    Go to **Developers** > **API Credentials**
  </Step>

  <Step title="Create a new credential">
    Click **New Credential** and provide a descriptive name (e.g., "Ravenna Integration")
  </Step>

  <Step title="Select the appropriate scope">
    Select **Manage All** to enable both sync and workflow actions, or **Read All** for read-only sync.

    <Warning>
      **Manage All** is required if you want to use workflow actions like activating users, managing group memberships, or resetting passwords.
    </Warning>
  </Step>

  <Step title="Copy your credentials">
    Copy the **Client ID** and **Client Secret**.

    <Warning>
      Store these credentials securely. You will not be able to view the client secret again after navigating away.
    </Warning>
  </Step>
</Steps>

<Callout icon="link" color="#3B82F6">
  For more details, see [OneLogin's API credentials documentation](https://developers.onelogin.com/api-docs/2/getting-started/working-with-api-credentials)
</Callout>

### Add integration in Ravenna

<Steps>
  <Step title="Navigate to integrations">
    Go to **Settings > Integrations**
  </Step>

  <Step title="Select OneLogin">
    Find **OneLogin** in the available integrations and click **Connect**
  </Step>

  <Step title="Enter credentials">
    Provide the following information:

    <ParamField path="clientId" type="string" required>
      The client ID from your OneLogin API credential
    </ParamField>

    <ParamField path="clientSecret" type="string" required>
      The client secret from your OneLogin API credential
    </ParamField>

    <ParamField path="subdomain" type="string" required>
      Your OneLogin subdomain (e.g., `acme` for `acme.onelogin.com`)
    </ParamField>

    <ParamField path="region" type="string">
      Your OneLogin region, if outside the US
    </ParamField>
  </Step>

  <Step title="Complete setup">
    Click **Add OneLogin** to complete the integration. Ravenna will validate your credentials and begin syncing users, groups, roles, and applications.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid credentials error">
    **Cause**: Client ID or client secret is incorrect.

    **Solution**:

    * Verify the client ID and client secret are copied correctly
    * Ensure there are no extra spaces or characters
    * Check that the API credential still exists in OneLogin
    * Try creating a new credential if the original was regenerated
  </Accordion>

  <Accordion title="Missing scopes or partial sync">
    **Cause**: The API credential lacks one or more of the required scopes.

    **Behavior**: Ravenna no longer blocks integration setup when some scopes are missing. The integration is created with the scopes you granted, and any resource Ravenna can't read (users, groups, or applications) syncs as empty until the missing scope is added.

    **Solution**:

    * Verify the credential has at least **Read All** scope
    * For workflow actions, ensure **Manage All** scope is selected
    * After updating the credential, trigger a resync from the integration page — no need to disconnect and reconnect
  </Accordion>

  <Accordion title="Subdomain not found error">
    **Cause**: Incorrect OneLogin subdomain.

    **Solution**:

    * Verify the subdomain matches your OneLogin organization URL (e.g., `acme` for `acme.onelogin.com`)
    * Ensure the subdomain is active and accessible
    * Check for typos in the subdomain value
  </Accordion>

  <Accordion title="Users or groups not syncing">
    **Cause**: Sync may still be in progress or the credential has limited scope.

    **Solution**:

    * Allow a few minutes for the initial sync to complete
    * Verify the integration status shows as connected in **Settings > Integrations**
    * Check that users and groups exist in the OneLogin organization linked to your credentials
  </Accordion>
</AccordionGroup>