> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Drata

## After this article

You will be able to connect Drata to Lumos to sync users and their roles for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Roles | Permission | Yes | No | Roles in Drata |

## Required plan and roles

* **Token scopes:** grant the blanket **All Read** scope, or the granular scopes:
  * **Personnel: List Personnel** lists all personnel records
  * **Personnel: Get Personnel** covers per-person reads, required in addition to List Personnel
  * **Users: List Users** lists user accounts
  * **Users: Get User** covers per-user reads, required in addition to List Users
  * **Company Settings: Get Company Settings** reads company information (credential validation)
* **Permission scoping:** this is a **read-only** integration. Lumos syncs users and role information but does not provision or deprovision anything in Drata.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode this integration supports. Lumos syncs users and role information but doesn't provision or deprovision anything in Drata.

**What read-only requires.** An API key with either the blanket All Read scope or the granular Personnel: List Personnel, Personnel: Get Personnel, Users: List Users, Users: Get User, and Company Settings: Get Company Settings scopes. Follow the steps below to create the key and connect.

**Watch out for.** The **Users: Get User** and **Personnel: Get Personnel** scopes are often missed because the List scopes alone don't cover the per-record reads the connector performs. Leaving out either scope causes syncs to partially fail on individual users. Drata API keys also expire, so a sync that suddenly stops working may need a fresh key from Settings → API Keys.

## Instructions

**Phase 1: Create an API key in Drata**

1. Log in to [app.drata.com](https://app.drata.com).
2. Go to your profile (bottom left) → **Settings** → **API Keys**.
3. Click **Create API Key** and fill out the details (name, expiration).
4. Select the scopes listed in **Required plan and roles** above.
5. Click **Save** and copy the token.

**Phase 2: Connect in Lumos**

1. Find the Drata card in your Lumos integrations (reconnect an existing card or add a new one).
2. Paste the token into the **Rest API Token** field.
3. Set **Region** to match your Drata instance: `https://public-api.drata.com` is the NA region, `https://public-api.eu.drata.com` is the EU region.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails with a valid token.** Check that the **Region** setting matches where your Drata instance lives: NA tokens only work against `public-api.drata.com`, EU tokens only against `public-api.eu.drata.com`.

**Sync partially fails on individual users.** Confirm the API key includes the **Users: Get User** and **Personnel: Get Personnel** scopes. The connector performs per-record reads that the List scopes alone do not cover.

**Sync stops working after a period.** Drata API keys are created with an expiration date. Create a new API key in **Settings → API Keys** and reconnect.

**Integration listed as read/write elsewhere.** The Lumos integration listing is correct: Drata is read-only in Lumos. External marketing material implying read/write is inaccurate.