> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Coupa Contract Ingestion

*Lumos offers two Coupa connectors, each its own integration card. This article covers **Coupa (with Contract Ingestion):** user access management plus importing your Coupa SaaS contracts into the Lumos Vendors area. For user access management only (no contract import), use [Coupa Software](/integrations/library/coupa/coupa).*

## After this article

You will be able to connect Coupa to Lumos to sync and manage user access, and to import your Coupa SaaS contracts into the Lumos Vendors area.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User accounts. Access managed via `core.user` read/write scopes |
| User Groups | Permission | Yes | Yes | Coupa user groups. Managed via `core.user_group` read/write scopes |
| Contracts | Vendor data | Yes | No | SaaS contracts imported into the Lumos Vendors area, using read scopes for contracts, purchase orders, requisitions, and suppliers |

## Required plan and roles

* **Lumos plan:** No minimum plan requirement is documented for this integration.
* **Coupa role:** A user with **Admin** access in Coupa must perform the setup, the OAuth client is created under **Setup → Integrations → Oauth2/OpenID Connect Clients**, which requires admin permissions.
* **Permission scoping:** Lumos uses an OAuth 2.0 client (Client Credentials grant). The following scopes are **required** for user access management:
  * `core.user.read`, read user accounts
  * `core.user.write`, manage user access (required for Lumos access management)
  * `core.user_group.read`, read user groups
  * `core.user_group.write`, manage user group membership
  * `core.common.read`
  * `email`, `login`, `openid`, `profile`, `offline_access`, OpenID Connect scopes for the client identity
    For contract ingestion into Lumos Vendors, additionally select these read-only scopes:
  * `core.contract.read`, read contracts (imported into Lumos Vendors)
  * `core.purchase_order.read`, read purchase orders
  * `core.requisition.read`, read requisitions
  * `core.supplier.read`, read suppliers
    There is no read-only variant of this connector: the `write` scopes above are the baseline for Lumos user access management.

## Instructions

*Note: If you wish to upgrade an existing [Coupa Software](/integrations/library/coupa/coupa) integration to add contract ingestion, adding the extra scopes to your OAuth client is not enough, you must disconnect the existing integration and add the **Coupa (with Contract Ingestion)** integration.*

If this is your first time setting up a Coupa OAuth client, Coupa's official guide is [OAuth 2.0 Getting Started with Coupa API](https://success.coupa.com/Integrate/KB/OAuth_2.0_Getting_Started_with_Coupa_API).

**Phase 1: Create the OAuth client in Coupa**

1. Log into your Coupa control panel as an admin and go to **Setup → Oauth2/OpenID Connect Clients**. (Type "oauth" in the Setup search box to find it fast.)
2. Click **Create**. For **Grant Type**, select **Client credentials**. Leave the JWKS URI field blank. You can use the following client details:
   * Name: `Lumos Integration Client`
   * Login: `lumos-integration`
   * Contact First Name: `Lumos`
   * Contact Last Name: `Integration`
   * Contact Email: `support@lumosidentity.com`
3. Select all 10 base scopes listed in **Required plan and roles** above, plus the 4 contract-ingestion read scopes (`core.contract.read`, `core.purchase_order.read`, `core.requisition.read`, `core.supplier.read`).
4. Click **Save**.
5. Open the client you just created. Copy the **Identifier** string, this is your Client ID. Click **Show/Hide** to reveal, then copy, the **Client Secret**.

**Phase 2: Connect in Lumos**

1. Open the **Coupa (with Contract Ingestion)** integration card in Lumos.
2. **Instance Identifier:** your Coupa instance URL, following the pattern `domain.coupahost.com` or `domain.coupacloud.com` (no `https://` prefix).
3. **Client ID:** the Identifier from your Coupa OAuth client.
4. **Client Secret:** the secret from your Coupa OAuth client.
5. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

* **Contract ingestion doesn't appear after adding scopes to an existing Coupa integration.** Adding the contract-ingestion scopes to your existing [Coupa Software](/integrations/library/coupa/coupa) OAuth client is not sufficient. Disconnect the existing Coupa integration and add the **Coupa (with Contract Ingestion)** integration instead.
* **Connection fails with a valid Client ID/Secret.** Check the **Instance Identifier** format, it must be `domain.coupahost.com` or `domain.coupacloud.com`, with no `https://` or trailing path.
* **Sync errors or missing data.** Verify every required scope was selected on the OAuth client in **Setup → Oauth2/OpenID Connect Clients**. A missing scope (e.g. `core.common.read` or one of the contract-ingestion read scopes) causes partial or failed syncs.
* **Contracts don't appear in Lumos Vendors.** Confirm the four contract-ingestion read scopes (`core.contract.read`, `core.purchase_order.read`, `core.requisition.read`, `core.supplier.read`) were all selected on the OAuth client, and that you connected the **Coupa (with Contract Ingestion)** card rather than the standard Coupa card.
* **Wrong credentials copied.** In Coupa, the Client ID is the **Identifier** field on the OAuth client. The secret is hidden behind **Show/Hide**. Make sure you are copying from the client created for Lumos, not another integration's client.