Skip to main content
Learn how to connect Opal to Axiom so you can invite people, change their built-in role, and manage group access. With the Axiom integration, you can:
  • Invite people into an Axiom organization and remove them when access ends
  • Assign and change built-in roles (Owner, Admin, User, Read-only, and None)
  • Add and remove people from Axiom groups
  • Import custom roles for visibility. Direct custom-role membership stays read-only in Opal

​
Supported resources

A person has exactly one built-in role. Granting a new built-in role replaces the current one. Revoking a built-in role sets them to None. None is the minimum role and cannot be revoked.

​
Requirements

Before you begin, you must:
  • Be an Opal Admin
  • Use an Axiom Cloud organization. A Personal plan has one user and cannot be used for invites, role changes, or group membership
  • Enable Axiom’s RBAC add-on. Opal reads groups and roles when you create the app, so the app cannot be saved without it
  • Create an advanced API token. A basic ingest token and a personal access token will not work

​
1. Create an advanced API token

In Axiom, go to Settings > API tokens > New API token and choose Advanced. Give the token these capabilities:
Axiom shows the token once. Save it before you leave the page. Token privileges cannot be edited later. To change scope, create a new token, update the token on the Axiom app in Opal, then delete the old token.
When you create the app, Opal checks that the token can read users, groups, and roles. If a check fails, the error names the missing capability or the RBAC add-on. Invite, role change, removal, and group updates use the write capabilities and fail later if those are missing.

​
2. Copy the organization ID

The organization ID is the first path segment in the Axiom URL: https://app.axiom.co/{organization-id}/... You can also copy it from Axiom Settings. The API token is already scoped to one organization. Paste the ID for that same organization.

​
3. Create the Axiom app in Opal

  1. In Opal, go to Inventory > + App and select Axiom.
  2. Enter an app name, app admin, description, and visibility.
  3. Paste the organization ID and the advanced API token.
  4. Select Create.

​
4. Turn on user provisioning

Open the Axiom app settings and turn on Provision Axiom users and Deprovision Axiom users. See User provisioning for how those settings behave across Opal.
  • Granting a built-in role to someone who is not in Axiom invites them at that role, including Owner and Admin.
  • Adding someone only to a group invites them as None, then adds them to the group.
  • Removing someone from the app removes them from the Axiom organization.
Opal matches people by email. If Axiom says an email already belongs to the organization, Opal links that existing person instead of creating a second account. An email that was recently removed can still be rejected. Check Axiom Settings > Users and retry later. Opal will not remove an Owner. Change their built-in role first, then remove them. Opal also will not change the last Owner to another role, so billing stays available. Give Owner to someone else before you change the last Owner.

​
5. Import items

After the app is saved, Opal syncs people into the app’s Accounts tab. Open … > Import items and import the built-in roles, groups, and custom roles you want to manage.

​
Limitations

  • Direct membership on a custom role is read-only. Change it in Axiom, or grant the custom role through a group that Opal manages.
  • Opal does not import groups managed by Axiom Directory Sync. If a group Opal already imported later becomes Directory Sync managed, Opal will not change it.
  • Axiom has no suspend or restore action. Removal deletes the person from that organization.
  • Each Opal app connects to one Axiom organization.
Last modified on October 14, 2026