Skip to main content
With the Workato integration, you can manage access to your Workato workspace from Opal:
  • Allow users to request just-in-time access to a Workato project, at the exact project role they need, from the web and Slack
  • Manage collaborator group membership, and which project roles each group holds
  • Set the right resource owners to delegate approvals to those with the most context
  • Automatically revoke access when a time-bound grant expires
Opal connects to one Workato workspace through a Developer API client. The client’s role controls which endpoints Opal can call. To manage several workspaces, add a Workato app in Opal for each one.

​
Supported resources

Opal syncs every collaborator in your workspace. The integration doesn’t invite or remove collaborators, and it doesn’t manage environment roles. Pending invitations appear only after the collaborator accepts them.

​
How Workato access maps to Opal

  • Project access levels: each project role in your workspace, such as Project admin or Builder, is an access level on every project.
  • One role per project: Workato allows each collaborator or group one role per project. Requesting a different role on a project replaces the existing role. When that grant is revoked or expires, the collaborator loses access to the project.
  • Groups: a collaborator group can hold a project role, so granting a group access to a project gives every member that role. Workato’s built-in All collaborators group isn’t synced, because it always contains every collaborator.

​
Requirements

Before you begin, you must:
  • Be an Opal Admin
  • Be a Workato workspace admin who can create API client roles and API clients
  • Ask the Opal team to enable the Workato integration for your organization

​
Configuration steps

​
1. Create a client role

  1. In Workato, go to Workspace admin > API clients > Client roles, and select Add client role.
  2. Name the role, for example Opal.
  3. On the Admin tab, under Workspace collaborators, enable the following permissions:
Workato client role Admin tab with Get collaborators, the five collaborator group permissions, and List project roles enabled
  1. On the Projects tab, enable the following permissions, then select Save changes:
Workato client role Projects tab with List projects enabled under Projects & folders Workato client role Project access section with Delete project grant, List of project's project grants, and Upsert project's project grants enabled

​
2. Create an API client

  1. Go to Workspace admin > API clients > API clients, and select Create API client.
  2. Name the client, for example Opal, and select the client role from step 1.
  3. Under Project access, select All projects. If you select specific projects instead, Opal can only see and manage those projects.
  4. Select Create client, then copy the API token that Workato shows. You’ll enter it in Opal in step 3.
Workato Create a new API client page with the client named Opal and Project access set to All projects

​
3. Create the Workato app in Opal

In Opal, go to Inventory > +App and select Workato. Fill in the following fields: Opal checks the API token when you save the app.

​
4. Import projects and groups

After you save the app, import the projects and collaborator groups you want to manage: on the app’s Assets tab, select Import assets, and turn on requests for them. Opal pulls access only for imported items, so collaborators and members appear after the next sync.

​
Troubleshooting

Last modified on November 4, 2026