> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# dbt Labs

## After this article

You will be able to connect dbt Labs (dbt Cloud) to Lumos to sync users, groups, roles, and licenses for visibility, Access Reviews, and license management.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Groups | Permission | Yes | No | dbt Cloud groups |
| Roles | Permission | Yes | No | Roles (permission sets) |
| Licenses | Permission | Yes | No | License assignments |

Activity tracking is supported: the integration tracks user last login.

## Required plan and roles

* **dbt Labs role:** the connection uses a **service token** created with the **Account Admin** permission set.
* **Connection fields:** Token, Region, Account ID, and (single-tenant only) Account Prefix.
* **Permission scoping:** the integration is sync-only. Users, groups, roles, and licenses are synced, and no provisioning actions are supported. The Account Admin service token permission is the baseline, and there is no documented reduced-scope option.
* **Deployment support:** both multi-tenant and single-tenant dbt Cloud deployments are supported.

## Read-only access vs provisioning

**Is read-only possible?** The integration only reads from dbt Cloud. It syncs users, groups, roles, and licenses and performs no provisioning actions. The credential itself is not scoped down, though. The connection uses a service token created with the Account Admin permission set, and there is no documented reduced-scope option, so a narrower read-only token isn't available.

**What full provisioning requires.** Provisioning is not supported by this connector. Lumos does not create, update, or deactivate dbt Cloud users, and it does not assign or remove groups, roles, or licenses. Manage access changes in dbt Cloud directly.

**Watch out for.** The Account Admin token grants write access in dbt Cloud even though Lumos only uses it to read. Confirm the token hasn't been revoked under Account Settings → API tokens → Service tokens if sync suddenly stops.

## Instructions

**Phase 1: Create a service token and gather account details in dbt Cloud**

1. In the dbt Labs UI, click your account name in the left sidebar and select **Account Settings**.
2. Go to **API tokens → Service tokens → Create service token**.
3. Name the token and add the **Account Admin** permission. Save the token value.
4. On the account settings page, note your **Account ID**.
5. Note your **Account Prefix** and **Region**. Both appear on the account settings page and in your deployment URL:
   * Single-tenant deployments use the format `accountprefix.region.dbt.com` (e.g. `mycompany.us1.dbt.com`).
   * Multi-tenant deployments have no account prefix: US1 uses `cloud.getdbt.com`, EMEA1 uses `emea.dbt.com`, other regions use `region.dbt.com`.

**Phase 2: Connect in Lumos**

1. Find the DBT Labs card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the **Token**, **Region** (defaults to US1), and **Account ID**.
3. Enter the **Account Prefix** if you are on a single-tenant deployment. Leave it empty for multi-tenant.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails with a valid token.** Check that the **Region** and **Account Prefix** match your deployment URL. Multi-tenant deployments must leave Account Prefix empty. Single-tenant deployments must supply the subdomain from `accountprefix.region.dbt.com`.

**Authorization errors on sync.** Confirm the service token was created with the **Account Admin** permission and has not been revoked under **Account Settings → API tokens → Service tokens**.

**Wrong Account ID.** The Account ID is shown on your account settings page in dbt Cloud. It is numeric and distinct from the account prefix.