> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Adobe Acrobat Sign ## After this article You will be able to connect Adobe Acrobat Sign to Lumos to sync users, groups, and roles, and to provision that access from Lumos. ## Capabilities | Functionality | Type | Sync | Provision | Description | | :- | :- | :- | :- | :- | | Users | Account | Yes | Yes | User accounts. Lumos can create users and activate or deactivate them | | Groups | Permission | Yes | Yes | Group memberships. Lumos can add a user to a group and remove non-primary groups | | Roles | Permission | Yes | Yes | Roles. Lumos can grant and revoke the `ADMIN` role | **Provisioning behavior:** * **Create:** Lumos creates the user via `POST /users`. **Email**, **first name**, and **last name** are all required. * **Assign or remove a role:** only the `ADMIN` role can be assigned or removed. Lumos updates the user's admin flag via `PUT /users/{user_id}`. The `MEMBER` role can't be assigned or removed, since it's the baseline every user has. * **Assign or remove a group:** Lumos sets the group membership to `ACTIVE` or `DELETED` via `PUT /users/{user_id}/groups`. A user's **primary group** can't be removed, because every user needs at least one. Change the primary group in the Adobe Acrobat Sign dashboard first. * **Activate:** sets the user's status back to `ACTIVE`. * **Deactivate:** account admins can't be deactivated. Remove the `ADMIN` role first, then deactivate. | Deprovisioning Action | Type | Description | | :- | :- | :- | | Deactivate | User | Sets the user's status to `INACTIVE`. Deletion is not supported. | Activity tracking is supported. Lumos reads the `/users/{user_id}/events` endpoint to record when a user last logged into Adobe Acrobat Sign. ## Required plan and roles * **Adobe Acrobat Sign role:** you need access to the Adobe Acrobat Sign account admin area to create an API application and read the account settings. * **OAuth scopes:** the integration authenticates with OAuth. Enable the `user_read` and `user_write` scopes with the `account` modifier when you configure the app. * `user_read:account` syncs user information into Lumos. * `user_write:account` covers all provisioning: creating users, activating and deactivating them, and managing group and role access. Leave it out if you want a read-only connection. * `user_login:account` syncs extra information about the user. ## Read-only access vs provisioning **Is read-only possible?** Yes. The OAuth application controls read and write through separate scopes, and leaving out the write scope provides a read-only connection. **What read-only requires.** An OAuth application configured with only the `user_read:account` scope (add `user_login:account` if you also want login activity synced). Follow the steps below, and when you reach the scope step in Phase 1, enable only `user_read` with the `account` modifier. **What full provisioning requires.** The same OAuth application with the `user_write:account` scope also enabled, which lets Lumos create users, activate and deactivate them, and manage group and role membership. **Watch out for.** Adding or removing the `user_write` scope means editing the existing OAuth application in Adobe Acrobat Sign (Phase 1, step 6, Configure OAuth for Application) and reconnecting, not creating a new one. Deactivation is the only deprovisioning action, account deletion is not supported. ## Instructions **Phase 1: Create an OAuth application in Adobe Acrobat Sign** 1. Log in to your Adobe Acrobat Sign account. 2. From the Home page, open the **API** page using the top navigation menu. 3. In the **API Application** section, click the **+** button to create a new application. 4. Fill in the **Name** and **Display Name** fields. 5. Select the **CUSTOMER** domain and save. 6. Click your new application and choose **Configure OAuth for Application**. 7. Set the redirect URL to `https://app.lumosidentity.com/integrations/ics_oauth2_callback`. 8. Enable the `user_read` and `user_write` scopes with the `account` modifier, then save. 9. Click the application again, select **View / Edit**, and copy the **Application (Client) ID** and **Client Secret**. You can return and edit the application later if you need to fix a step. **Phase 2: Gather your Account ID, Domain, and Shard** 1. From the Home page, open the **Account** page using the top navigation menu. Your **Account ID** is in the **Global Settings** section. 2. Note your **Adobe Domain**, either the legacy `echosign.com` or the newer `adobesign.com`. 3. Note your **URL Shard**, the regional subdomain segment in your account URL. For `https://secure.na1.adobesign.com`, the shard is `na1`. **Phase 3: Connect in Lumos** 1. Click the Adobe Acrobat Sign card in your Lumos integrations (reconnect an existing card or add a new one). 2. Paste the **Client ID**, **Client Secret**, **Account ID**, **Adobe Domain**, and **URL Shard** into their fields. 3. Click **Connect**. ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Troubleshooting **Can't connect the integration.** Recheck the redirect URL (`https://app.lumosidentity.com/integrations/ics_oauth2_callback`), confirm the `user_read` and `user_write` scopes are enabled with the `account` modifier, and verify the Account ID, Domain, and Shard match your account. You can reopen the API application in Adobe Acrobat Sign and correct any of these. **Provisioning actions fail on a read-only connection.** The `user_write:account` scope is required to create, activate, and deactivate users and to manage groups and roles. Add it to the OAuth app and reconnect. **Deactivating a user fails.** Account admins can't be deactivated. Remove the user's `ADMIN` role first, then retry the deactivation. **Removing a group fails.** The group is the user's primary group, which can't be removed. Change the user's primary group in the Adobe Acrobat Sign dashboard, then retry.