> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Avalara

## After this article

You'll be able to connect Avalara to Lumos and sync Avalara users and their security roles for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | No | User account records |
| Security Roles | Permission | Yes | No | Roles in Avalara |

## Required plan and roles

* **Avalara role:** the connecting user must hold one of these Avalara roles: AccountAdmin, AccountOperator, AccountUser, BatchServiceAdmin, CompanyAdmin, CompanyUser, Compliance Root User, ComplianceAdmin, ComplianceUser, CSPAdmin, CSPTester, ECMAccountUser, ECMCompanyUser, FirmAdmin, FirmUser, Registrar, SiteAdmin, SSTAdmin, SystemAdmin, TechnicalSupportAdmin, TechnicalSupportUser, TreasuryAdmin, or TreasuryUser.
* **Authentication:** the integration authenticates with an Avalara **username and password** (basic authentication against the AvaTax REST API).
* **Permission scoping:** this is a **read-only** integration. Lumos syncs users and security roles but doesn't provision or deprovision anything in Avalara.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode this connector supports. Avalara connects with a username and password, and Lumos only syncs users and security roles. It never provisions or deprovisions anything in Avalara.

**What read-only requires.** An Avalara username and password for a user holding one of the supported Avalara roles listed above (for example AccountAdmin, CompanyAdmin, or SiteAdmin), plus your Tenant Identifier. Follow the steps below to connect.

**Watch out for.** The username and password used carry whatever permissions that Avalara user already has. There's no separate reduced-scope credential type for this connector. Make sure you're connecting to the right environment, since sandbox uses a different AvaTax base URL than production.

## Instructions

**Phase 1: Prepare Avalara**

1. Identify or create the Avalara user account Lumos will authenticate as, and confirm it holds one of the supported roles listed above.
2. Have the account's username and password ready, along with your Tenant Identifier.

**Phase 2: Connect in Lumos**

1. Click the Avalara card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the **Username**, **Password**, and **Tenant Identifier**.
3. If you're connecting a sandbox (non-production) Avalara environment, select the sandbox environment option. Sandbox uses a different AvaTax base URL than production.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails with an authentication error.** Verify the username and password are correct and that the connecting user holds one of the supported Avalara roles listed above.

**A sandbox account won't connect.** Sandbox uses a different AvaTax base URL than production (`rest.avatax.com`). Make sure the environment selection in Lumos matches where the credentials were created.