OneLogin
Connect OneLogin to Layer to sync users, the managed app catalog, and per-user app assignments for identity-driven access reviews and offboarding.
The OneLogin integration syncs users, every app in your OneLogin catalog, and per-user app assignments — so OneLogin-fronted SaaS shows up in Layer's asset inventory with the actual user roster attached.
What you'll need
- A OneLogin Account Owner or Super User role.
- The ability to create an API credential pair (
client_id+client_secret) in your OneLogin tenant. - Three minutes.
Set it up
Create an API credential pair in OneLogin
In OneLogin Admin, go to Developers → API Credentials and click New Credential.
Name it Axiom Layer and select the Manage Users scope. Click Save, then copy the Client ID and Client Secret — the secret is only shown once.
Find your OneLogin subdomain
Your OneLogin subdomain is the prefix on your Admin console URL — for example, acme for acme.onelogin.com. You can copy it from the URL bar of the OneLogin Admin console.
Paste the credentials into Layer
In Layer, go to Integrations, find OneLogin, and click Connect. Paste your subdomain, client ID, and client secret, then click Connect.
Wait for the first sync
The initial sync runs immediately. Most tenants finish in under 15 minutes.
What gets synced
| Object | Fields | Refresh cadence |
|---|---|---|
| Users | email, status, OneLogin user ID | Every 6 hours |
| Apps | app name, auth method, connector ID | Every 6 hours |
| App assignments | user → app links | Every 6 hours |
Per-user app access
Layer fetches each OneLogin app's assigned users from /api/2/apps/{appId}/users and creates:
- One App asset per app in your OneLogin catalog (visible in the Apps view), with the OneLogin app ID, auth method, and connector ID stored as metadata.
- One Uses relationship per user → app pairing.
This is what powers license true-up, SaaS spend reconciliation, and offboarding checks against your OneLogin-managed apps. Pagination is followed automatically, and per-app user enumeration is non-fatal — if the credential is missing the Manage Users scope, the SaaS app inventory still lands and Layer skips assignment emission silently.
Required scopes
The API credential needs Manage Users to enumerate per-app user assignments. Read Users alone is enough for the user roster and the app catalog, but per-user app assignments will be empty without Manage Users. Layer never writes to your OneLogin tenant.
Troubleshooting
The client ID or client secret may have been copied incorrectly, or the credential was revoked. Generate a new credential pair and re-enter both values in Layer.
The credential is missing the Manage Users scope. Edit the credential in Developers → API Credentials and grant Manage Users, then run Sync now in Layer.
Go to Integrations → OneLogin → Disconnect in Layer. To fully revoke, also delete the API credential under Developers → API Credentials in the OneLogin Admin console.
Okta
Connect Okta to Layer to sync users, groups, app assignments, and SSO sessions — the system-of-record source for identity-driven offboarding and access reviews.
JumpCloud
Connect JumpCloud to Layer to sync users, groups, memberships, and SSO-derived SaaS apps as the system of record for offboarding and access reviews.