> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bynder

## After this article

You will be able to connect Bynder to Lumos to sync Bynder users, their roles, and last login. You can also suspend or permanently deprovision users during offboarding and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts. Lumos reads the `active` field for status and `lastLogin` for last activity |
| Roles | Permission | Yes | No | Roles associated with the user's security profile (via the user's `profileId`) |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Suspend | User | Deactivates the user in Bynder (sets `active` to false). The user can no longer log in, and the license is reclaimed. Lumos marks the account Suspended |
| Deprovision | User | Permanently removes the user and their data from Bynder and reclaims the license. This is irreversible. Lumos marks the account Deprovisioned |

**User status mapping** (Bynder to Lumos):

* `active` becomes Active.
* `inactive` becomes Suspended.
* A user Bynder no longer returns becomes Deprovisioned.

## Required plan and roles

* **Lumos plan:** there is no minimum plan required to connect Bynder.
* **Bynder role:** you must be logged into Bynder as a user with the **Manage users** permission.
* **Authentication:** OAuth. You accept the requested scopes in Bynder during connection, and no API token is created manually.
* **Permission scoping:** the integration reads users, security-profile roles, and last login, and can write user status (deactivate) and delete users. These write operations are required for Lumos offboarding and Access Review remediation.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Even though the token used is Manage Users, this connector only supports syncing information today.

**What full provisioning requires.** OAuth consent from a Bynder user with the Manage users permission, granted during the connect flow, which lets Lumos read users, roles, and last login, and also suspend or delete users. Follow the steps below to connect and accept the requested scopes.

**Watch out for.** Both Suspend and Deprovision reclaim the Bynder license, but Deprovision also permanently removes the user's data and can't be undone, use Suspend instead if you might need to restore the account later.

## Instructions

**Phase 1: Get your Bynder domain**

1. Make sure that you as the authorizing user has the "**USERMANAGEMENT**" role.
   * Find the authorizing user profile by clicking the settings icon in top right, then select Users & rights > User Management.
   * Find the assigned roles for the authorizing user by clicking the settings icon in top right, then select Users & rights > Permission Management.
2. Find your Bynder domain from your login URL and copy it. This may be of the form ' [**SUBDOMAIN**.bynder.com](http://SUBDOMAIN.bynder.com) ' or a fully custom domain.
3. Enter your full domain below (ex: [lumosidentity.bynder.com](http://lumosidentity.bynder.com))
4. Create a new Bynder OAuth application by following [<u>these instructions</u>](https://support.bynder.com/hc/en-us/articles/360013875180-Create-OAuth-Apps). Enter the client id and secret below.
   * The required scopes are:
     * offline
     * admin.profile:read
     * admin.user:read
     * admin.user:write
     * current.user:read
     * current.profile:read
   * The callback URL is: [https://app.lumosidentity.com/integrations/bynder\_oauth2\_callback](https://app.lumosidentity.com/integrations/bynder_oauth2_callback)

**Phase 2: Connect in Lumos**

1. Click the Bynder card in your Lumos integrations (reconnect an existing card or add a new one).
2. Paste the full domain of your Bynder tenant (e.g. `subdomain.bynder.com`) into the **Full Domain** field.
3. Click **Connect** and accept the OAuth scopes to connect the integration.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Credentials are missing" error after a previously successful connection:** This can be caused by a credential-storage issue on the Lumos side rather than anything you omitted. If reconnecting with the correct Full Domain doesn't resolve it, contact Lumos support.

**Deprovision removed a user's data:** Expected. Bynder's delete-user operation permanently removes the user and their data and cannot be undone. Use **Suspend** if you may need to restore the account.