> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sentry > Learn how to connect Opal to Sentry to manage organization roles, team membership and team roles, and team access to projects. With the Sentry integration, you can manage access to your Sentry organization from Opal: * Allow users to request just-in-time access to an organization role, such as **Manager**, from the web and Slack * Allow users to request membership of a Sentry team, as a **Contributor** or **Team Admin** * Manage which teams have access to each project * Set the right resource owners to delegate approvals to those with the most context * Automatically revoke access when a time-bound grant expires Opal connects to one Sentry organization through an Owner's personal token. To manage several organizations, add a Sentry app in Opal for each one. ## Supported resources | Resource | Read | Grant and revoke access | | - | - | - | | Sentry organization (organization roles) | ✔️ | ✔️ (Revoke: not **Member**) | | Sentry teams (membership and team roles) | ✔️ | ✔️ | | Sentry projects (team access) | ✔️ | ✔️ | Opal syncs every member of your organization. The integration doesn't invite or remove members, which arrive through SSO or your identity provider, and it doesn't sync pending invitations until they're accepted. ### How Sentry access maps to Opal * **Organization roles**: your organization appears in Opal as **Sentry Organization**, with the access levels **Billing**, **Member**, **Admin**, **Manager**, and **Owner**. Each member holds one role, so requesting a different role changes the existing one. Revoking a role returns the user to **Member**, and the user keeps their teams and team roles. * Opal doesn't revoke **Member**, because Sentry has no lower role, so revoking it would mean removing the user from the organization. Remove users through your identity provider instead. * **Admin** is synced, but it isn't offered in access requests. Sentry no longer lets anyone be given Admin on Business and Enterprise plans, where Team Admin replaces it. If your plan still allows Admin, you can make it requestable on the resource's **Roles** tab. * **Teams**: each team appears in Opal as a **Sentry Team**, with the access levels **Contributor** and **Team Admin**. Each team member holds one team role, so Sentry keeps the highest role Opal grants. If a user holds both and their **Team Admin** grant is revoked or expires, they stay on the team as a **Contributor**. Revoking a user's only team role removes them from the team. * **Projects**: each project appears in Opal as a **Sentry Project**. Sentry gives access to a project only through the teams added to it, so you grant project access by giving a team access to the project. ### Limitations * Team roles require a Sentry Business or Enterprise plan. On other plans, every team member is a **Contributor**. * Sentry gives organization **Managers** and **Owners** the **Team Admin** role on every team they belong to, and reports them as **Contributor**. Granting them **Team Admin** has no effect, and they appear as **Contributor** after the next sync. * Self-hosted Sentry isn't supported. ## Requirements Before you begin, you must: * Be an Opal Admin * Be an Owner of the Sentry organization * Ask the Opal team to enable the Sentry integration for your organization ## Configuration steps ### 1. Create a personal token 1. In Sentry, go to **User Settings** > **Personal Tokens**, and select **Create New Token**. 2. Name the token, for example `Opal`, and set the following permissions: | Permission | Level | | - | - | | Organization | **Read** | | Member | **Admin** | | Team | **Admin** | | Project | **Admin** | 3. Select **Create Token**, then copy the token. You'll enter it in Opal in step 2. The token acts as the Owner who created it. Sentry only lets an Owner change organization roles, and it rejects role changes made with an internal integration's token. If the token's creator stops being an Owner, Opal can no longer change access. ### 2. Create the Sentry app in Opal In Opal, go to **Inventory** > **+App** and select **Sentry**. Fill in the following fields: | Field | Value | | - | - | | App name | A name for the Sentry app in Opal, for example `Sentry`. | | App admin | The owner who administers the app in Opal. | | Description | A short description that helps requesters understand what this app is. | | Visibility | Who in your organization can see the app. | | Region | `sentry.io` or `us.sentry.io` for organizations in the US, or `de.sentry.io` for organizations in the EU. | | Organization slug | The slug in your Sentry URL, for example `acme` in `https://acme.sentry.io`. | | Auth token | The personal token from step 1. | Opal checks the token when you save the app. ### 3. Import the organization, teams, and projects After you save the app, import the items you want to manage: on the app's **Assets** tab, select **Import assets**, choose **Sentry Organization**, the teams, and the projects, and turn on requests for them. Opal pulls access only for imported items, so roles, team members, and team access appear after the next sync. ## Troubleshooting | Error | Fix | | - | - | | An authentication error when you save the app | Copy the token again, and check that **Region** and **Organization slug** match your Sentry URL. | | An access change fails with a `403` error | Check that the token has the permissions in step 1, and that its creator is still an Owner of the organization. | | Granting **Admin** fails | Sentry no longer allows Admin on Business and Enterprise plans. Grant **Manager**, or **Team Admin** on the teams the user needs. | | A team role doesn't change in Sentry | If the user is an organization **Manager** or **Owner**, Sentry already gives them **Team Admin** on every team. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.