> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Rippling

> Learn how to connect Opal to Rippling to manage access to Rippling supergroups, and to sync employees, departments, and teams.

With the Rippling integration, you can manage workforce platform access through Opal:

* Let people request just-in-time access to Rippling supergroups from the web and Slack
* Sync employees, departments, and teams into Opal for visibility and access reviews
* Set the right owners to delegate approvals to those with the most context
* Review who belongs to each supergroup

Departments and teams sync for visibility only. Their membership comes from each employee's record in Rippling, so you cannot assign people to them in Opal.

## Supported resources

| Resource | Read | Grant and revoke access | Notes |
| - | - | - | - |
| Users | ✔️ | | Active workers only. Opal does not create, update, or deactivate Rippling users. |
| Supergroups | ✔️ | ✔️ | Synced as groups. Only supergroups that are editable in Rippling. Department- and team-backed supergroups are read only in Rippling and are not imported. |
| Departments | ✔️ | | Synced as resources. Membership follows each employee's department in Rippling. |
| Teams | ✔️ | | Synced as groups. Membership follows each employee's teams in Rippling. |

Rippling permission profiles are not available in Opal. Rippling does not expose them through its API.

## Requirements

Before you begin, you must:

* Be an Opal admin.
* Be a Rippling admin with access to **Tools** > **Developer** > **API Tokens**.
* Have the Rippling integration enabled for your Opal organization. If you do not see Rippling under **+ App**, contact Opal support.
* Be on version 1.1239.0 or greater, if you self-host Opal.

## 1. Create a Rippling API token

In Rippling, go to **Tools** > **Developer** > **API Tokens**, or search for `API Tokens`. Select **Create API Token**, give it a name (for example, `Opal`) and a unique identifier, select the latest API version, and grant the following scopes.

| Scope | What it unlocks |
| - | - |
| `user.read` | Read employee identities, including names and work emails |
| `workers.read` | Sync employees, and derive department and team membership |
| `departments.read` | Sync departments |
| `teams.read` | Sync teams |
| `supergroups.read` | Sync supergroups and their members |
| `supergroups.write` | Add and remove supergroup members |

> [!NOTE]
>
> A Rippling token is limited to what the admin who created it can already see.
> Create it with an admin who has visibility into every department, team, and
> supergroup you want to manage in Opal.

Save the token and copy it. Rippling shows the value only once.

## 2. Create a Rippling app in Opal

In Opal, go to **Inventory** > **+ App** and select **Rippling**. Fill in the following fields and create the app.

| Field | Value |
| - | - |
| App name | An identifiable name for this Rippling connection. |
| App admin | The team or user that should own the Rippling app in Opal. |
| Description | Let requesters know what they are requesting access to. |
| API Token | The token from [step 1](#1-create-a-rippling-api-token). |
| Visibility | Global, or restricted to specific groups. |

Opal tests the token before saving the app. If the token cannot read workers and departments, app creation fails with a validation error.

## 3. Import Rippling items

After creating the app, import departments, teams, and supergroups from **...** > **Import items**. People can then request supergroup membership through Opal.

## Additional information

### Supergroups

Granting access adds the person to the supergroup's inclusion list, and revoking removes them. Rippling has no expiry on membership, so Opal revokes time-bound access on its own schedule.

Supergroups that Rippling marks as read only, including those backed by a department or a team, are not imported.

### Departments and teams

Both sync so you can review who sits where. Membership is managed in Rippling, and Opal reports an unsupported status if a grant is attempted.

### Users

Opal syncs active workers and matches people by their Rippling work email. Workers without a work email are skipped.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.