> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Brex

## After this article

You will be able to connect Brex to Lumos to sync Brex users and their roles for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | No | User accounts |
| Roles | Permission | Yes | No | Roles in Brex |

## Required plan and roles

* **Brex role:** an **account admin or card admin** in Brex must create the API token.
* **Token scope:** `Users.ReadOnly`, list user information. This is the only scope the integration requires.
* **Permission scoping:** this is a **read-only** integration, Lumos syncs users and roles but does not provision or deprovision anything in Brex.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode available. Brex authenticates with an API token scoped to `Users.ReadOnly`, so every connection syncs users and roles without writing anything back to Brex.

**What read-only requires.** An account admin or card admin creates the token in Brex under Company settings, Developer, Settings, choosing the `users.readonly` data-access level. Follow the steps below to generate and enter the token.

**Watch out for.** The token is tied to the admin who created it, if that admin's account is deactivated or their role is downgraded, syncs stop and you need a new token from an active account or card admin. Make sure the Use Brex Sandbox setting matches where the token was created, sandbox tokens only work against the sandbox API.

## Instructions

**Phase 1: Generate an API token in Brex**

1. Log in to [dashboard.brex.com](https://dashboard.brex.com) as an account admin or card admin.
2. Click **Profile** → **Company settings**.
3. Go to **Developer** → **Settings**.
4. Click **Create Token**, name the token, and choose the level of data access, `users.readonly` is required for this integration.
5. On the confirmation screen, verify the information and select **Allow Access**.
6. Copy the token.

**Phase 2: Connect in Lumos**

1. Find the Brex card in your Lumos integrations (reconnect an existing card or add a new one).
2. Paste the token into the **API Token** field.
3. Enable **Use Brex Sandbox** only if you are using the sandbox (staging) version of the Brex API.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails with an authorization error.** Confirm the token was created with the `users.readonly` data-access level and hasn't been revoked in **Company settings → Developer → Settings**.

**Connection fails with valid credentials.** Check that the **Use Brex Sandbox** setting matches where the token was created: sandbox tokens only work against the sandbox API, production tokens only against production.

**Users stop syncing.** Brex tokens are tied to the admin who created them. If that admin's account is deactivated or their role downgraded, generate a new token from an active account/card admin and reconnect.