--- title: "Opal Security MCP server for AI agents - actionlake" description: "Give Claude 201 Opal Security actions through one MCP server: resources, groups, bundles. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/opal-security updated: 2026-10-23 --- Connectors · Identity & security # Opal Security MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Opal Security and the rest of your systems. It gives your agent 201 Opal Security actions (92 reads, 77 writes and 32 that wait for a confirmation) and holds the Opal Security credential itself, so the agent never does. It paces Opal Security's limits and records every call. [Connect Opal Security free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "opal.users.list_users", intent: "check which Opal Security account is connected" } # List users · read · 1 upstream call ``` - 201 actions in one signed file - 92 read look, never change - 77 write create and update - 32 wait for a yes destructive, confirmed first Set up ## Connect Opal Security in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Opal Security. Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_token` Opal API token ``` account { op: "connections.requirements", service: "opal" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "opal.users.list_users" } # list users · read · 1 upstream call check { action: "opal.users.invite_user", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Opal Security at a glance **Sign-in** Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_token` **Limits we pace to** 10 calls a second, per connection **API covered** Opal API v1 (OpenAPI 3.1, api.opal.dev/v1)`api.opal.dev/v1` **Built from** Opal Security's documentation, read 23 October 2026[app.opal.dev](https://app.opal.dev/openapi.yaml) [docs.opal.dev](https://docs.opal.dev/reference) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 89 of 92 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Opal Security up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Opal Security. 201 actions in 29 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **92** read look, never change - **77** write create and update - **32** destructive wait for a confirmation 1. ### Resources 34 17 read · 12 write · 5 destructive Gives a non-human identity access to this resource · Adds a user to this resource · Creates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resources · Create resource custom access level 2. ### Groups 29 14 read · 12 write · 3 destructive Get groups · Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects) · Get group by ID · Deletes a group 3. ### Bundles 13 5 read · 5 write · 3 destructive Adds a group to a bundle · Adds a resource to a bundle · Creates a bundle · Returns a list of `Group` objects in a given bundle 4. ### Requests 12 4 read · 7 write · 1 destructive Create an access request · Get requests · Get request by ID · Approve an access request 5. ### Campaigns 11 4 read · 6 write · 1 destructive Returns a list of `Campaign` objects · Create campaign · Get campaign by ID · Update campaign 6. ### Tags 11 3 read · 4 write · 4 destructive Applies a tag to a group · Applies a tag to a resource · Applies a tag to a user · Creates a tag with the given key and value 7. ### Users 10 6 read · 2 write · 2 destructive List users · Invites a user to your organization · Get user by ID · Deletes a user from your organization 8. ### Owners 8 4 read · 3 write · 1 destructive Creates an owner · Gets the list of users for this owner, in escalation priority order if applicable · Get owners · Get owner by ID **21 more areas · 73 actions** - Paladin **8** - Scripts **6** - Apps **5** - Group bindings **5** - Idp group mappings **5** - Request templates **5** - Access rules **4** - Configuration templates **4** - Delegations **4** - Event streams **4** - Agents **3** - Message channels **3** - On call schedules **3** - Tokens **3** - Uars **3** - Events **2** - Role assignments **2** - Non human identities **1** - Queries **1** - Sessions **1** - Sync errors **1** Top actions ## The Opal Security API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 34 of Opal Security's 36 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `opal.users.list_users` List users | List users. | read | `identity.user.list` 474 connectors | | `opal.groups.list_groups` Get groups | Get groups. | read | `identity.group.list` 262 connectors | | `opal.users.invite_user` Invites a user to your organization | Invites a user to your organization. | write | `identity.user.create` 262 connectors | | `opal.groups.create_group` Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects) | Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects). | write | `identity.group.create` 205 connectors | | `opal.users.delete_user` Deletes a user from your organization | Deletes a user from your organization. | destructive | `identity.user.delete` 253 connectors | | `opal.users.whoami` Returns the user that the provided API token authenticates as | Returns the user that the provided API token authenticates as. | read | `identity.current_user.get` 307 connectors | | `opal.groups.list_group_users` Gets the list of users for this group | Gets the list of users for this group. | read | `identity.group_member.list` 103 connectors | | `opal.tokens.create_token` Create token | Create token. | write | `identity.api_key.create` 100 connectors | | `opal.tokens.list_tokens` Get tokens | Get tokens. | read | `identity.api_key.list` 96 connectors | | `opal.events.list_events` Returns a list of `Event` objects | Returns a list of `Event` objects. | read | `identity.audit_event.list` 51 connectors | | `opal.groups.update_group_user` Updates a user's access level or duration in this group | Updates a user's access level or duration in this group. | write | `identity.group_member.update` 34 connectors | | `opal.requests.create_request` Create an access request | Create an access request. | write | `identity.access_request.create` 12 connectors | Try it ## Prompts to paste into Claude. Each one names the Opal Security actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in Opal Security? List every user and their role. calls `opal.users.list_users` 2. Write write Invites a user to your organization in Opal Security. Show me exactly what you will send before you save it. calls `opal.users.invite_user` Governance for Opal Security ## Destructive actions wait for a yes. 32 Opal Security actions are destructive. The first 10: - Deletes a user from your organization `opal.users.delete_user` - Deletes a group `opal.groups.delete_group` - Delete token `opal.tokens.delete_token` - Removes a user's access from this group `opal.groups.delete_group_user` - Deletes a delegation by its ID `opal.delegations.delete_delegation` - Cancel request `opal.requests.cancel_request` - Delete app `opal.apps.delete_app` - UNSTABLE. May be removed at any time. Deletes a tag with the given id `opal.tags.delete_tag` - Deletes an owner `opal.owners.delete_owner` - Removes a tag from a user `opal.tags.remove_user_tag` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do opal.users.delete_user confirm_policy: **human** Deletes a user from your organization? **intent:** the user asked me to deletes a user from your organization run suspended · waiting for a named person · key _opal-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "opal-agent", allowed_actions: ["opal.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "opal.users.delete_user", approver: "lead@example.com" }, { match: "opal.groups.delete_group", approver: "lead@example.com" }, { match: "opal.tokens.delete_token", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Opal Security only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Opal Security costs on actionlake. Every Opal Security action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Opal Security refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 201 Opal Security actions - 201 actions page each page of a long list is one call - 89 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Opal Security action. 201 actions by area: the id your agent calls, what it does, and its effect. **Resources 34** - `opal.resources.add_resource_nhi` Gives a non-human identity access to this resource write - `opal.resources.add_resource_user` Adds a user to this resource write - `opal.resources.create_resource` Creates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resources write - `opal.resources.create_resource_custom_access_level` Create resource custom access level write - `opal.resources.delete_resource` Deletes a resource destructive - `opal.resources.delete_resource_custom_access_level` Delete resource custom access level destructive - `opal.resources.delete_resource_nhi` Removes a non-human identity's direct access from this resource destructive - `opal.resources.delete_resource_user` Removes a user's direct access from this resource destructive - `opal.resources.get_resource` Get resource by ID read - `opal.resources.get_resource_configuration_template` Get the ID of the configuration template linked to a resource read - `opal.resources.get_resource_user` Get resource user read - `opal.resources.get_resource_user_access_status` Get user's access status to a resource read - `opal.resources.get_resource_visibility` Gets the visibility of this resource read - `opal.resources.list_resource_access_levels` Get resource access levels read - `opal.resources.list_resource_custom_access_levels` List resource custom access levels read - `opal.resources.list_resource_groups` Returns a list of groups that grant access to the resource read - `opal.resources.list_resource_message_channels` Gets the list of audit message channels attached to a resource read - `opal.resources.list_resource_nhis` Gets the list of non-human identities with access to this resource read - `opal.resources.list_resource_reviewer_stages` Gets the list reviewer stages for a resource read - `opal.resources.list_resource_reviewers` Gets the list of owner IDs of the reviewers for a resource read - `opal.resources.list_resource_scoped_role_permissions` List resource scoped role permissions read - `opal.resources.list_resource_tags` Returns all tags applied to the resource read - `opal.resources.list_resource_users` Get resource users read - `opal.resources.list_resources` Get resources read - `opal.resources.list_user_resources` Gets the list of resources for this user read - `opal.resources.set_resource_message_channels` Sets the list of audit message channels attached to a resource write - `opal.resources.set_resource_reviewer_stages` Sets the list of reviewer stages for a resource write - `opal.resources.set_resource_reviewers` Sets the list of reviewers for a resource write - `opal.resources.set_resource_scoped_role_permissions` Sets all the scoped role permissions on an OPAL_SCOPED_ROLE resource destructive - `opal.resources.set_resource_visibility` Sets the visibility of this resource write - `opal.resources.update_resource_configuration_template` Set the ID of the configuration template linked to a resource write - `opal.resources.update_resource_custom_access_level` Update resource custom access level write - `opal.resources.update_resource_user` Updates a user's access level or duration on this resource write - `opal.resources.update_resources` Bulk updates a list of resources write **Groups 29** - `opal.groups.add_group_containing_group` Creates a new containing group write - `opal.groups.add_group_resource` Adds a resource to a group write - `opal.groups.add_group_user` Adds a user to this group write - `opal.groups.create_group` Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects) write - `opal.groups.delete_group` Deletes a group destructive - `opal.groups.delete_group_user` Removes a user's access from this group destructive - `opal.groups.get_group` Get group by ID read - `opal.groups.get_group_containing_group` Get nested group by ID read - `opal.groups.get_group_visibility` Gets the visibility of this group read - `opal.groups.list_group_access_levels` Get group access levels read - `opal.groups.list_group_containing_groups` Get nested groups read - `opal.groups.list_group_message_channels` Gets the list of audit and reviewer message channels attached to a group read - `opal.groups.list_group_on_call_schedules` Gets the list of on call schedules attached to a group read - `opal.groups.list_group_resources` Gets the list of resources that the group gives access to read - `opal.groups.list_group_reviewer_stages` Gets the list of reviewer stages for a group read - `opal.groups.list_group_reviewers` Gets the list of owner IDs of the reviewers for a group read - `opal.groups.list_group_tags` Returns all tags applied to the group read - `opal.groups.list_group_users` Gets the list of users for this group read - `opal.groups.list_groups` Get groups read - `opal.groups.list_user_groups` Returns all groups that the user is a member of read - `opal.groups.remove_group_containing_group` Removes a containing group from a group destructive - `opal.groups.set_group_message_channels` Sets the list of audit message channels attached to a group write - `opal.groups.set_group_on_call_schedules` Sets the list of on call schedules attached to a group write - `opal.groups.set_group_resources` Sets the list of resources that the group gives access to write - `opal.groups.set_group_reviewer_stages` Sets the list of reviewer stages for a group write - `opal.groups.set_group_reviewers` Sets the list of reviewers for a group write - `opal.groups.set_group_visibility` Sets the visibility of this group write - `opal.groups.update_group_user` Updates a user's access level or duration in this group write - `opal.groups.update_groups` Bulk updates a list of groups write **Bundles 13** - `opal.bundles.add_bundle_group` Adds a group to a bundle write - `opal.bundles.add_bundle_resource` Adds a resource to a bundle write - `opal.bundles.create_bundle` Creates a bundle write - `opal.bundles.delete_bundle` Deletes a bundle destructive - `opal.bundles.get_bundle` Get bundle by ID read - `opal.bundles.get_bundle_visibility` Gets the visibility of the bundle read - `opal.bundles.list_bundle_groups` Returns a list of `Group` objects in a given bundle read - `opal.bundles.list_bundle_resources` Returns a list of `Resource` objects in a given bundle read - `opal.bundles.list_bundles` Get bundles read - `opal.bundles.remove_bundle_group` Removes a group from a bundle destructive - `opal.bundles.remove_bundle_resource` Removes a resource from a bundle destructive - `opal.bundles.set_bundle_visibility` Sets the visibility of the bundle write - `opal.bundles.update_bundle` Updates a bundle write **Requests 12** - `opal.requests.approve_request` Approve an access request write - `opal.requests.cancel_request` Cancel request destructive - `opal.requests.create_request` Create an access request write - `opal.requests.create_request_comment` Comment on an access request write - `opal.requests.deny_request` Deny an access request write - `opal.requests.escalate_request` Escalate request to skip-manager write - `opal.requests.get_request` Get request by ID read - `opal.requests.list_request_comments` Returns a list of comments for a specific request read - `opal.requests.list_requests` Get requests read - `opal.requests.list_requests_relay` Get requests via Relay read - `opal.requests.remind_request` Send request reminder write - `opal.requests.remind_request_reviewer` Send reminder to a reviewer write **Campaigns 11** - `opal.campaigns.create_campaign` Create campaign write - `opal.campaigns.end_campaign` End campaign write - `opal.campaigns.get_campaign` Get campaign by ID read - `opal.campaigns.list_campaign_items` List campaign items read - `opal.campaigns.list_campaign_viewer_items` List viewer campaign items read - `opal.campaigns.list_campaigns` Returns a list of `Campaign` objects read - `opal.campaigns.review_campaign_items` Submit campaign item review decisions write - `opal.campaigns.start_campaign` Start campaign write - `opal.campaigns.stop_campaign` Stop campaign destructive - `opal.campaigns.update_campaign` Update campaign write - `opal.campaigns.update_campaign_item_reviewers` Update campaign item reviewers write **Tags 11** - `opal.tags.add_group_tag` Applies a tag to a group write - `opal.tags.add_resource_tag` Applies a tag to a resource write - `opal.tags.add_user_tag` Applies a tag to a user write - `opal.tags.create_tag` Creates a tag with the given key and value write - `opal.tags.delete_tag` UNSTABLE. May be removed at any time. Deletes a tag with the given id destructive - `opal.tags.get_tag` Get tag by ID read - `opal.tags.get_tag_by_key` Gets a tag with the given key and value read - `opal.tags.list_tags` Get tags read - `opal.tags.remove_group_tag` Removes a tag from a group destructive - `opal.tags.remove_resource_tag` Removes a tag from a resource destructive - `opal.tags.remove_user_tag` Removes a tag from a user destructive **Users 10** - `opal.users.delete_user` Deletes a user from your organization destructive - `opal.users.get_user` Get user by ID read - `opal.users.invite_user` Invites a user to your organization write - `opal.users.list_remote_users` Returns a list of remote users for your organization read - `opal.users.list_user_tags` Returns all tags applied to the user read - `opal.users.list_users` List users read - `opal.users.lookup_user` Returns a `User` object read - `opal.users.reset_user_mfa` Reset a user's Opal MFA destructive - `opal.users.update_user` Updates a user's position or manager write - `opal.users.whoami` Returns the user that the provided API token authenticates as read **Owners 8** - `opal.owners.create_owner` Creates an owner write - `opal.owners.delete_owner` Deletes an owner destructive - `opal.owners.get_owner` Get owner by ID read - `opal.owners.get_owner_by_name` Returns an `Owner` object. Does not support owners with `/` in their name, use /owners?name=... instead read - `opal.owners.list_owner_users` Gets the list of users for this owner, in escalation priority order if applicable read - `opal.owners.list_owners` Get owners read - `opal.owners.set_owner_users` Set owner users write - `opal.owners.update_owners` Bulk updates a list of owners write **Paladin 8** - `opal.paladin.create_paladin` Create Paladin write - `opal.paladin.create_paladin_context_source` Add a Paladin context source write - `opal.paladin.delete_paladin` Delete Paladin destructive - `opal.paladin.delete_paladin_context_source` Remove a Paladin context source destructive - `opal.paladin.get_paladin` Get Paladin by ID read - `opal.paladin.get_paladin_by_name` Get Paladins by name read - `opal.paladin.list_paladin_context_sources` List Paladin context sources read - `opal.paladin.update_paladin` Update Paladin write **Scripts 6** - `opal.scripts.create_opal_script` Create OpalScript write - `opal.scripts.delete_opal_script` Delete OpalScript destructive - `opal.scripts.get_opal_script` Get OpalScript by ID read - `opal.scripts.get_opal_script_by_name` Get OpalScript by name read - `opal.scripts.list_opal_scripts` List OpalScripts read - `opal.scripts.update_opal_script` Update OpalScript write **Apps 5** - `opal.apps.create_app` Create app write - `opal.apps.delete_app` Delete app destructive - `opal.apps.get_app` Get app by ID read - `opal.apps.list_apps` Get apps read - `opal.apps.update_app` Update app write **Group bindings 5** - `opal.group_bindings.create_group_binding` Creates a group binding write - `opal.group_bindings.delete_group_binding` Deletes a group binding destructive - `opal.group_bindings.get_group_binding` Get group binding by ID read - `opal.group_bindings.list_group_bindings` Get group bindings read - `opal.group_bindings.update_group_bindings` Bulk updates a list of group bindings write **Idp group mappings 5** - `opal.idp_group_mappings.create_idp_group_mapping` Create idp group mapping write - `opal.idp_group_mappings.delete_idp_group_mappings` Deletes an `IdpGroupMapping` object destructive - `opal.idp_group_mappings.get_idp_group_mapping` Gets an `IdpGroupMapping` object for an Okta app and group read - `opal.idp_group_mappings.list_idp_group_mappings` Returns the configured set of available `IdpGroupMapping` objects for an Okta app read - `opal.idp_group_mappings.update_idp_group_mappings` Updates the list of available `IdpGroupMapping` objects for an Okta app write **Request templates 5** - `opal.request_templates.create_request_template` Creates a request template write - `opal.request_templates.delete_request_template` Deletes a request template destructive - `opal.request_templates.get_request_template` Returns a `RequestTemplate` object read - `opal.request_templates.list_request_templates` Returns a list of `RequestTemplate` objects read - `opal.request_templates.update_request_template` Updates a request template write **Access rules 4** - `opal.access_rules.create_access_rule` Creates a new access rule config for the given group_id write - `opal.access_rules.get_access_rule` Returns a list of access rule config given the group_id of the access rule read - `opal.access_rules.list_access_rules` Returns a list of access rules for your organization read - `opal.access_rules.update_access_rule` Updates the access rule config for the given group_id write **Configuration templates 4** - `opal.configuration_templates.create_configuration_template` Creates a configuration template write - `opal.configuration_templates.delete_configuration_template` Deletes a configuration template destructive - `opal.configuration_templates.list_configuration_templates` Returns a list of `ConfigurationTemplate` objects read - `opal.configuration_templates.update_configuration_template` Update a configuration template write **Delegations 4** - `opal.delegations.create_delegation` Creates a new request reviewer delegation to delegate access review requests from one user to another write - `opal.delegations.delete_delegation` Deletes a delegation by its ID destructive - `opal.delegations.get_delegation` Get delegation by ID read - `opal.delegations.list_delegations` Get delegations read **Event streams 4** - `opal.event_streams.create_event_stream` Create event stream write - `opal.event_streams.delete_event_stream` Delete event stream destructive - `opal.event_streams.list_event_streams` Get event streams read - `opal.event_streams.update_event_stream` Update event stream write **Agents 3** - `opal.agents.get_agent_kill_switch` Get the agent kill switch read - `opal.agents.report_agent_activity` Report agent activity write - `opal.agents.set_agent_kill_switch` Set the agent kill switch write **Message channels 3** - `opal.message_channels.create_message_channel` Creates a `MessageChannel` objects write - `opal.message_channels.get_message_channel` Get message channel by ID read - `opal.message_channels.list_message_channels` Get message channels read **On call schedules 3** - `opal.on_call_schedules.create_on_call_schedule` Creates a `OnCallSchedule` objects write - `opal.on_call_schedules.get_on_call_schedule` Get on call schedule by ID read - `opal.on_call_schedules.list_on_call_schedules` Get on call schedules read **Tokens 3** - `opal.tokens.create_token` Create token write - `opal.tokens.delete_token` Delete token destructive - `opal.tokens.list_tokens` Get tokens read **Uars 3** - `opal.uars.create_uar` Starts a User Access Review. Deprecated in favor of `POST /campaigns` write - `opal.uars.get_uar` Retrieves a specific UAR. Deprecated in favor of `GET /campaigns/{campaign_id}` read - `opal.uars.list_uars` Returns a list of `UAR` objects. Deprecated in favor of `GET /campaigns` read **Events 2** - `opal.events.get_event` Get event by ID read - `opal.events.list_events` Returns a list of `Event` objects read **Role assignments 2** - `opal.role_assignments.add_role_assignments` Add role assignments destructive - `opal.role_assignments.list_role_assignments` List role assignments read **Non human identities 1** - `opal.non_human_identities.list_nhis` Returns a list of non-human identities for your organization read **Queries 1** - `opal.queries.run_query` Run an ad-hoc OpalQuery read **Sessions 1** - `opal.sessions.list_sessions` Returns a list of `Session` objects read **Sync errors 1** - `opal.sync_errors.list_sync_errors` Returns a list of recent sync errors that have occurred since the last successful sync read Questions ## The Opal Security MCP server, answered. **Is there an Opal Security MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 201 Opal Security actions across resources, groups, bundles and requests, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Opal Security. **What do I need to connect Opal Security?** Opal API token. The free call account { op: "connections.requirements", service: "opal" } lists exactly what to paste. **Can an AI agent delete or change things in Opal Security?** Only if its key allows it, and only with an explicit confirmation. 32 Opal Security actions are destructive, including deletes a user from your organization, deletes a group and delete token. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Opal Security API limit?** actionlake paces every call to the limits in the Opal Security service file: 10 calls a second per connection. Repeated reads are answered from cache (89 Opal Security actions can be), which never reaches Opal Security. **What does an Opal Security action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (201 Opal Security actions page). Cache hits, searches, dry runs and calls Opal Security refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Opal Security API does it cover?** The Opal API v1 (OpenAPI 3.1, api.opal.dev/v1) at api.opal.dev/v1. It is built from Opal Security's documentation as read on 23 October 2026. 201 actions in 29 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Opal Security data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Opal Security credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Opal Security Shares the most action names with - [Lumos 16](https://actionlake.com/connectors/lumos) - [Clerk 16](https://actionlake.com/connectors/clerk) - [SailPoint Identity Security Cloud 14](https://actionlake.com/connectors/sailpoint-identity-security-cloud) - [Bitwarden 11](https://actionlake.com/connectors/bitwarden) - [BeyondTrust Password Safe 10](https://actionlake.com/connectors/beyondtrust-password-safe) - [Zscaler Internet Access (ZIA) 8](https://actionlake.com/connectors/zscaler-internet-access-zia) Joins with, on shared entities - [HaloPSA 2](https://actionlake.com/connectors/halopsa) - [Slack 2](https://actionlake.com/connectors/slack) - [ServiceNow 2](https://actionlake.com/connectors/servicenow) - [Fortinet FortiGate 2](https://actionlake.com/connectors/fortinet-fortigate) - [Genesys Cloud CX 2](https://actionlake.com/connectors/genesys-cloud-cx) - [Commvault Cloud 2](https://actionlake.com/connectors/commvault-cloud) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Opal Security; the name is the vendor's own. Counts are from the Opal Security service file, version 1.0.0. ## Give your agent Opal Security today. [Connect Opal Security free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/opal-security More: https://actionlake.com/llms.txt