> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Unleash

> Feature flags — users & access

<Tabs>
  <Tab title="Overview">
    Connect Unleash with your instance URL and an Admin service-account token to sync console users and projects, and run access reviews. Read-only. Works for Unleash cloud and self-hosted OSS alike.

    <Info>
      **Read-only access.** DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product.
    </Info>

    <Info>
      **What you'll see.** The Access page lists every **user** of your Unleash instance with their name, email or username, root role (**Admin**, **Editor** or **Viewer**, or **Member** when Unleash reports none) and the date they were created. Service accounts are left out — Unleash keeps them on a separate endpoint. Unleash reports no account status or MFA state, so every user is shown as **Active** with MFA **Unknown**.
    </Info>

    <Note>
      **An Admin service-account token is required.** Unleash's user directory is only readable with the Admin root role; a service account with the Viewer or Editor role receives a 403, and SDK tokens from **API access** cannot call any admin endpoint.
    </Note>

    <Note>
      DSALTA collects this integration's data when you connect it — you can refresh it at any time with **Sync from integrations** on the **Integrations** page. The compliance checks below re-run once a day at 02:00 America/New\_York.
    </Note>

    ## What DSALTA reads

    DSALTA reads the Unleash user roster — names, emails, root roles and creation dates — which appears on your **Access** page; and your Unleash **projects**, which appear on your **Inventory** page with their health score, feature count and member count. Feature flags and their configurations are not read.

    It calls these Unleash admin endpoints on your instance URL:

    * `/api/admin/user-admin`
    * `/api/admin/projects`

    Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Unleash environment.

    ## Troubleshooting

    <AccordionGroup>
      <Accordion title="The connection is rejected">
        Three causes, in order of likelihood: the token is an SDK token from **Access control → API access** (it looks like `*:development.…`) rather than a service-account token; the service account has the **Viewer** or **Editor** role instead of **Admin**; or the **Instance URL** is missing the tenant path — for Unleash cloud it is `https://<region>.app.getunleash.io/<tenant>`, copied from the address bar.
      </Accordion>

      <Accordion title="The token stopped working">
        Service-account tokens carry an expiry chosen at creation. Generate a new token for the service account, then disconnect and connect again. Note that disconnecting permanently deletes the data already collected from Unleash.
      </Accordion>
    </AccordionGroup>

    <AccordionGroup>
      <Accordion title="How do I check whether the connection is healthy?">
        Open **Integrations** in the DSALTA sidebar, stay on the **Connected** tab, and click **Manage** on the integration's card. Open the **Status** tab: it shows either **Connected and working properly** or **Connection issues detected**.

        Use the **Status** tab, not **Overview** — Overview always reports **Connected** regardless of the real state.
      </Accordion>

      <Accordion title="A check shows Failed and nothing changed on my side">
        On an integration-powered check, **Failed** normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to **Source Data**, and read the result code: **403** is a missing permission, **428** is a setting DSALTA still needs, **500** is a failure on DSALTA's side.

        A real compliance gap shows **207** and leaves the test looking **Completed**. See [Understanding Test Results](/guides/compliance/test-results).
      </Accordion>

      <Accordion title="Data looks out of date">
        Compliance checks re-run once a day at 02:00 America/New\_York. To refresh sooner, open **Integrations → Connected** and click **Sync from integrations** at the top right — it refreshes every connected integration at once.
      </Accordion>

      <Accordion title="How do I repair a broken connection?">
        There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again.

        <Warning>
          **Disconnecting is destructive and cannot be undone.** DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see [Integration errors](/troubleshooting/integration-errors).
        </Warning>
      </Accordion>

      <Accordion title="Configure scope will not let me change anything">
        That is expected. **Configure scope** is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again.
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="How to connect">
    Your Unleash instance URL plus a service-account Admin token. Read-only. Works for Unleash cloud and self-hosted OSS alike.

    **Before you begin**

    * An Unleash instance, cloud or self-hosted, and the **Admin** root role in it — only Admins can create service accounts.
    * Your full instance URL including the tenant path, copied from your browser address bar. For Unleash cloud it looks like `https://us.app.getunleash.io/<tenant>`; self-hosted Unleash uses your own base URL.

    You will need:

    | Field                     | Where to find it                                            | Example                             |
    | ------------------------- | ----------------------------------------------------------- | ----------------------------------- |
    | **Instance URL**          | Your browser address bar                                    | `https://us.app.getunleash.io/acme` |
    | **Service account token** | **Admin settings → Service accounts → New service account** | `user:v2_…`                         |

    <Steps>
      <Step title="Start in DSALTA">
        Open **Integrations** in the DSALTA sidebar, find **Unleash**, and click **Connect** to open the connect panel.
      </Step>

      <Step title="Create an Admin service account">
        In Unleash, open **Admin settings → Service accounts** and click **New service account**. Enter a name and username, set the root role to **Admin**, choose to generate a token now, and click **Save service account**. Copy the token — it starts with `user:v2_`.

        <Warning>
          The role must be **Admin**. Unleash only lets the Admin root role read the user directory; a **Viewer** or **Editor** service account gets a 403 on the endpoint DSALTA needs. The token therefore carries admin rights over your Unleash instance — keep it in DSALTA only.
        </Warning>
      </Step>

      <Step title="Do not use an SDK token">
        Tokens created under **Access control → API access** are backend and frontend SDK tokens for flag evaluation. They look like `*:development.…` and fail on every admin endpoint. Only a token from **Service accounts** works here.
      </Step>

      <Step title="Find your instance URL">
        Copy your Unleash address from the browser address bar, including the tenant path — for example `https://us.app.getunleash.io/<tenant>`. Self-hosted Unleash uses your own base URL.
      </Step>

      <Step title="Connect Unleash">
        Return to the connect panel, paste the instance URL and the service-account token, and click **Connect**.
      </Step>
    </Steps>

    <Check>
      DSALTA validates the pair when you click **Connect**, by reading the user directory. On success the integration moves to the **Connected** tab, and **Manage → Status** reads **Connected and working properly**. Checks begin reporting after the first sync.
    </Check>

    <Warning>
      **If the connection is rejected.** An SDK token instead of a service-account token, a service account without the Admin role, or an instance URL missing the tenant path.

      The on-screen message is generic — see [Connection error messages](/troubleshooting/connection-error-messages).
    </Warning>
  </Tab>

  <Tab title="Automated checks">
    Each check below re-runs once a day, at 02:00 America/New\_York, while this integration is connected. Click any check for step-by-step remediation guidance.

    | Check                                                                                                                  | Severity | What it verifies                                                                   |
    | ---------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------------------------------------------------------------------- |
    | [User access to Critical System should be valid](/integrations/unleash/user-access-to-critical-system-should-be-valid) | Info     | Checks that everyone with Unleash access is an active employee on the People page. |
    | [Offboarded users should not have active access](/integrations/unleash/offboarded-users-should-not-have-active-access) | High     | Checks that offboarded employees no longer have active Unleash access.             |
  </Tab>

  <Tab title="Useful links">
    | Topic       | Link                                                                      |
    | ----------- | ------------------------------------------------------------------------- |
    | Setup       | [Service accounts](https://docs.getunleash.io/reference/service-accounts) |
    | Remediation | [Role-based access control](https://docs.getunleash.io/reference/rbac)    |
    | General     | [Unleash](https://www.getunleash.io)                                      |
    | DSALTA      | [Connection error messages](/troubleshooting/connection-error-messages)   |
  </Tab>
</Tabs>