> ## Documentation Index > Fetch the complete documentation index at: https://docs.opal.dev/llms.txt > Use this file to discover all available pages before exploring further. # Workato > Learn how to connect Opal to Workato to manage project roles and collaborator group membership. With the Workato integration, you can manage access to your Workato workspace from Opal: * Allow users to request just-in-time access to a Workato project, at the exact project role they need, from the web and Slack * Manage collaborator group membership, and which project roles each group holds * Set the right resource owners to delegate approvals to those with the most context * Automatically revoke access when a time-bound grant expires Opal connects to one Workato workspace through a Developer API client. The client's role controls which endpoints Opal can call. To manage several workspaces, add a Workato app in Opal for each one. ## Supported resources | Resource | Read | Grant and revoke access | | - | - | - | | Workato projects (project roles) | ✔️ | ✔️ | | Collaborator groups (membership) | ✔️ | ✔️ | Opal syncs every collaborator in your workspace. The integration doesn't invite or remove collaborators, and it doesn't manage environment roles. Pending invitations appear only after the collaborator accepts them. ### How Workato access maps to Opal * **Project access levels**: each project role in your workspace, such as **Project admin** or **Builder**, is an access level on every project. * **One role per project**: Workato allows each collaborator or group one role per project. Requesting a different role on a project replaces the existing role. When that grant is revoked or expires, the collaborator loses access to the project. * **Groups**: a collaborator group can hold a project role, so granting a group access to a project gives every member that role. Workato's built-in **All collaborators** group isn't synced, because it always contains every collaborator. ## Requirements Before you begin, you must: * Be an Opal Admin * Be a Workato workspace admin who can create API client roles and API clients * Ask the Opal team to enable the Workato integration for your organization ## Configuration steps ### 1. Create a client role 1. In Workato, go to **Workspace admin** > **API clients** > **Client roles**, and select **Add client role**. 2. Name the role, for example `Opal`. 3. On the **Admin** tab, under **Workspace collaborators**, enable the following permissions: | Section | Permissions | | - | - | | Collaborators | **Get collaborators** | | Collaborator groups | **List user groups**, **Get user group**, **List user group members**, **Add user group member**, **Remove user group member** | | Project roles | **List project roles** | ![Workato client role Admin tab with Get collaborators, the five collaborator group permissions, and List project roles enabled](https://mintcdn.com/opalsecurity/4kD2jgNFbayapXR-/images/docs/workato-role-admin.png?fit=max\&auto=format\&n=4kD2jgNFbayapXR-\&q=85\&s=0a58a6cc333938c85f7f6b252d9cbe0e) 4. On the **Projects** tab, enable the following permissions, then select **Save changes**: | Section | Permissions | | - | - | | Projects & folders | **List projects** | | Project Grants | **List of project's project grants**, **Upsert project's project grants**, **Delete project grant** | ![Workato client role Projects tab with List projects enabled under Projects & folders](https://mintcdn.com/opalsecurity/4kD2jgNFbayapXR-/images/docs/workato-role-projects.png?fit=max\&auto=format\&n=4kD2jgNFbayapXR-\&q=85\&s=4439bfdd46a4ef1e417557a48e5407ef) ![Workato client role Project access section with Delete project grant, List of project's project grants, and Upsert project's project grants enabled](https://mintcdn.com/opalsecurity/4kD2jgNFbayapXR-/images/docs/workato-role-grants.png?fit=max\&auto=format\&n=4kD2jgNFbayapXR-\&q=85\&s=1fd8fafe967fe8595fc252ccc86e9cc7) ### 2. Create an API client 1. Go to **Workspace admin** > **API clients** > **API clients**, and select **Create API client**. 2. Name the client, for example `Opal`, and select the client role from step 1. 3. Under **Project access**, select **All projects**. If you select specific projects instead, Opal can only see and manage those projects. 4. Select **Create client**, then copy the API token that Workato shows. You'll enter it in Opal in step 3. ![Workato Create a new API client page with the client named Opal and Project access set to All projects](https://mintcdn.com/opalsecurity/4kD2jgNFbayapXR-/images/docs/workato-create-client.png?fit=max\&auto=format\&n=4kD2jgNFbayapXR-\&q=85\&s=63c4d05c214f62cf404c0714e5c0184b) ### 3. Create the Workato app in Opal In Opal, go to **Inventory** > **+App** and select **Workato**. Fill in the following fields: | Field | Value | | - | - | | App name | A name for the Workato app in Opal, for example `Workato`. | | App admin | The owner who administers the app in Opal. | | Description | A short description that helps requesters understand what this app is. | | Visibility | Who in your organization can see the app. | | Data center | The host you sign in to Workato at, for example `www.workato.com` or `app.eu.workato.com`. An API token only works in its own data center. | | API token | The API token from step 2. | Opal checks the API token when you save the app. ### 4. Import projects and groups After you save the app, import the projects and collaborator groups you want to manage: on the app's **Assets** tab, select **Import assets**, and turn on requests for them. Opal pulls access only for imported items, so collaborators and members appear after the next sync. ## Troubleshooting | Error | Fix | | - | - | | `authentication_failed` when you save the app | Copy the API token again, and check that **Data center** matches the host you sign in to Workato at. | | A sync or an access change fails | Check that the client role has every permission in step 1. Workato rejects calls to endpoints the client role doesn't include. | | A project doesn't appear in Opal | Set the API client's **Project access** to **All projects**, or add the project to it, then sync the app. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.