Skip to main content

​
After this article

You will be able to connect dbt Labs (dbt Cloud) to Lumos to sync users, groups, roles, and licenses for visibility, Access Reviews, and license management.

​
Capabilities

Activity tracking is supported: the integration tracks user last login.

​
Required plan and roles

  • dbt Labs role: the connection uses a service token created with the Account Admin permission set.
  • Connection fields: Token, Region, Account ID, and (single-tenant only) Account Prefix.
  • Permission scoping: the integration is sync-only. Users, groups, roles, and licenses are synced, and no provisioning actions are supported. The Account Admin service token permission is the baseline, and there is no documented reduced-scope option.
  • Deployment support: both multi-tenant and single-tenant dbt Cloud deployments are supported.

​
Read-only access vs provisioning

Is read-only possible? The integration only reads from dbt Cloud. It syncs users, groups, roles, and licenses and performs no provisioning actions. The credential itself is not scoped down, though. The connection uses a service token created with the Account Admin permission set, and there is no documented reduced-scope option, so a narrower read-only token isn’t available. What full provisioning requires. Provisioning is not supported by this connector. Lumos does not create, update, or deactivate dbt Cloud users, and it does not assign or remove groups, roles, or licenses. Manage access changes in dbt Cloud directly. Watch out for. The Account Admin token grants write access in dbt Cloud even though Lumos only uses it to read. Confirm the token hasn’t been revoked under Account Settings → API tokens → Service tokens if sync suddenly stops.

​
Instructions

Phase 1: Create a service token and gather account details in dbt Cloud
  1. In the dbt Labs UI, click your account name in the left sidebar and select Account Settings.
  2. Go to API tokens → Service tokens → Create service token.
  3. Name the token and add the Account Admin permission. Save the token value.
  4. On the account settings page, note your Account ID.
  5. Note your Account Prefix and Region. Both appear on the account settings page and in your deployment URL:
    • Single-tenant deployments use the format accountprefix.region.dbt.com (e.g. mycompany.us1.dbt.com).
    • Multi-tenant deployments have no account prefix: US1 uses cloud.getdbt.com, EMEA1 uses emea.dbt.com, other regions use region.dbt.com.
Phase 2: Connect in Lumos
  1. Find the DBT Labs card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the Token, Region (defaults to US1), and Account ID.
  3. Enter the Account Prefix if you are on a single-tenant deployment. Leave it empty for multi-tenant.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Connection fails with a valid token. Check that the Region and Account Prefix match your deployment URL. Multi-tenant deployments must leave Account Prefix empty. Single-tenant deployments must supply the subdomain from accountprefix.region.dbt.com. Authorization errors on sync. Confirm the service token was created with the Account Admin permission and has not been revoked under Account Settings → API tokens → Service tokens. Wrong Account ID. The Account ID is shown on your account settings page in dbt Cloud. It is numeric and distinct from the account prefix.