Skip to main content

​
After this article

You will be able to connect Drata to Lumos to sync users and their roles for visibility and Access Reviews.

​
Capabilities

​
Required plan and roles

  • Token scopes: grant the blanket All Read scope, or the granular scopes:
    • Personnel: List Personnel lists all personnel records
    • Personnel: Get Personnel covers per-person reads, required in addition to List Personnel
    • Users: List Users lists user accounts
    • Users: Get User covers per-user reads, required in addition to List Users
    • Company Settings: Get Company Settings reads company information (credential validation)
  • Permission scoping: this is a read-only integration. Lumos syncs users and role information but does not provision or deprovision anything in Drata.

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode this integration supports. Lumos syncs users and role information but doesn’t provision or deprovision anything in Drata. What read-only requires. An API key with either the blanket All Read scope or the granular Personnel: List Personnel, Personnel: Get Personnel, Users: List Users, Users: Get User, and Company Settings: Get Company Settings scopes. Follow the steps below to create the key and connect. Watch out for. The Users: Get User and Personnel: Get Personnel scopes are often missed because the List scopes alone don’t cover the per-record reads the connector performs. Leaving out either scope causes syncs to partially fail on individual users. Drata API keys also expire, so a sync that suddenly stops working may need a fresh key from Settings → API Keys.

​
Instructions

Phase 1: Create an API key in Drata
  1. Log in to app.drata.com.
  2. Go to your profile (bottom left) → Settings → API Keys.
  3. Click Create API Key and fill out the details (name, expiration).
  4. Select the scopes listed in Required plan and roles above.
  5. Click Save and copy the token.
Phase 2: Connect in Lumos
  1. Find the Drata card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Paste the token into the Rest API Token field.
  3. Set Region to match your Drata instance: https://public-api.drata.com is the NA region, https://public-api.eu.drata.com is the EU region.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Connection fails with a valid token. Check that the Region setting matches where your Drata instance lives: NA tokens only work against public-api.drata.com, EU tokens only against public-api.eu.drata.com. Sync partially fails on individual users. Confirm the API key includes the Users: Get User and Personnel: Get Personnel scopes. The connector performs per-record reads that the List scopes alone do not cover. Sync stops working after a period. Drata API keys are created with an expiration date. Create a new API key in Settings → API Keys and reconnect. Integration listed as read/write elsewhere. The Lumos integration listing is correct: Drata is read-only in Lumos. External marketing material implying read/write is inaccurate.