Skip to main content
Lumos offers two Coupa connectors, each its own integration card. This article covers Coupa (with Contract Ingestion): user access management plus importing your Coupa SaaS contracts into the Lumos Vendors area. For user access management only (no contract import), use Coupa Software.

​
After this article

You will be able to connect Coupa to Lumos to sync and manage user access, and to import your Coupa SaaS contracts into the Lumos Vendors area.

​
Capabilities

​
Required plan and roles

  • Lumos plan: No minimum plan requirement is documented for this integration.
  • Coupa role: A user with Admin access in Coupa must perform the setup, the OAuth client is created under Setup → Integrations → Oauth2/OpenID Connect Clients, which requires admin permissions.
  • Permission scoping: Lumos uses an OAuth 2.0 client (Client Credentials grant). The following scopes are required for user access management:
    • core.user.read, read user accounts
    • core.user.write, manage user access (required for Lumos access management)
    • core.user_group.read, read user groups
    • core.user_group.write, manage user group membership
    • core.common.read
    • email, login, openid, profile, offline_access, OpenID Connect scopes for the client identity For contract ingestion into Lumos Vendors, additionally select these read-only scopes:
    • core.contract.read, read contracts (imported into Lumos Vendors)
    • core.purchase_order.read, read purchase orders
    • core.requisition.read, read requisitions
    • core.supplier.read, read suppliers There is no read-only variant of this connector: the write scopes above are the baseline for Lumos user access management.

​
Instructions

Note: If you wish to upgrade an existing Coupa Software integration to add contract ingestion, adding the extra scopes to your OAuth client is not enough, you must disconnect the existing integration and add the Coupa (with Contract Ingestion) integration. If this is your first time setting up a Coupa OAuth client, Coupa’s official guide is OAuth 2.0 Getting Started with Coupa API. Phase 1: Create the OAuth client in Coupa
  1. Log into your Coupa control panel as an admin and go to Setup → Oauth2/OpenID Connect Clients. (Type “oauth” in the Setup search box to find it fast.)
  2. Click Create. For Grant Type, select Client credentials. Leave the JWKS URI field blank. You can use the following client details:
    • Name: Lumos Integration Client
    • Login: lumos-integration
    • Contact First Name: Lumos
    • Contact Last Name: Integration
    • Contact Email: support@lumosidentity.com
  3. Select all 10 base scopes listed in Required plan and roles above, plus the 4 contract-ingestion read scopes (core.contract.read, core.purchase_order.read, core.requisition.read, core.supplier.read).
  4. Click Save.
  5. Open the client you just created. Copy the Identifier string, this is your Client ID. Click Show/Hide to reveal, then copy, the Client Secret.
Phase 2: Connect in Lumos
  1. Open the Coupa (with Contract Ingestion) integration card in Lumos.
  2. Instance Identifier: your Coupa instance URL, following the pattern domain.coupahost.com or domain.coupacloud.com (no https:// prefix).
  3. Client ID: the Identifier from your Coupa OAuth client.
  4. Client Secret: the secret from your Coupa OAuth client.
  5. Click Connect.

​
API Endpoints Used

​
Troubleshooting

  • Contract ingestion doesn’t appear after adding scopes to an existing Coupa integration. Adding the contract-ingestion scopes to your existing Coupa Software OAuth client is not sufficient. Disconnect the existing Coupa integration and add the Coupa (with Contract Ingestion) integration instead.
  • Connection fails with a valid Client ID/Secret. Check the Instance Identifier format, it must be domain.coupahost.com or domain.coupacloud.com, with no https:// or trailing path.
  • Sync errors or missing data. Verify every required scope was selected on the OAuth client in Setup → Oauth2/OpenID Connect Clients. A missing scope (e.g. core.common.read or one of the contract-ingestion read scopes) causes partial or failed syncs.
  • Contracts don’t appear in Lumos Vendors. Confirm the four contract-ingestion read scopes (core.contract.read, core.purchase_order.read, core.requisition.read, core.supplier.read) were all selected on the OAuth client, and that you connected the Coupa (with Contract Ingestion) card rather than the standard Coupa card.
  • Wrong credentials copied. In Coupa, the Client ID is the Identifier field on the OAuth client. The secret is hidden behind Show/Hide. Make sure you are copying from the client created for Lumos, not another integration’s client.