Skip to main content

​
After this article

You’ll be able to connect FireHydrant to Lumos to sync and provision users, groups, and roles.

​
Capabilities

Provisioning behavior:
  • Create: requires a username, first name, last name, and email. Lumos creates the user over SCIM and FireHydrant sends them an email invitation. Entitlements can’t be assigned as part of creation, assign them separately afterward.
  • Assign a role: a FireHydrant user holds exactly one role (owner, member, collaborator, or viewer), so assigning a new role replaces the current one. Assigning a role the user already holds returns an error rather than a silent no-op.
  • Remove a role: Lumos resets the user to the member role. The member role itself can’t be removed.
  • Add or remove a group member: Lumos reads the group’s current member list and writes the updated list back. Adding a member who’s already in the group, or removing one who isn’t, returns an error.
  • Activate and deactivate: Lumos sets the SCIM active flag to true or false.

​
Required plan and roles

  • SCIM requirement: SCIM must be enabled and configured with an IdP in FireHydrant before you can use this connector. The connector can’t sync without it.
  • FireHydrant role: you need access to create an API key in FireHydrant.
  • API key access: the connection uses a FireHydrant API key with Write access. This connector runs on SCIM, so it needs Write access even for read-only capabilities. A read-only token can’t reach the SCIM API.

​
Read-only access vs provisioning

Is read-only possible? No. FireHydrant sync runs entirely over its SCIM API, and a read-only API key can’t reach the SCIM API at all. Write access is required even to sync. What full provisioning requires. A FireHydrant API key created with Write access (Settings > API Keys > Create API Key), and SCIM enabled and configured with an IdP in FireHydrant before you connect. Follow the steps below. Watch out for. A 401 on the SCIM endpoint after connecting usually isn’t a bad credential, it’s a token that lacks Write access. Regenerate the API key with Write access and reconnect. Also confirm SCIM is enabled and configured with an IdP in FireHydrant first, since the connector can’t sync at all without it.

​
Instructions

Phase 1: Create an API key in FireHydrant
  1. Log in to FireHydrant.
  2. Go to Settings > API Keys.
  3. Click Create API Key.
  4. Enter a name, check Write access, and click Create.
  5. Copy the API key.
Phase 2: Connect in Lumos
  1. Click the FireHydrant card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Paste the API key into Lumos to finish connecting the integration.

​
API Endpoints Used

​
Troubleshooting

Connected but no data, with a 401 on the SCIM endpoint. This looks like bad credentials, but it usually means the token lacks write scope. A read-only token can’t access the SCIM API. Regenerate the API key with Write access and reconnect. SCIM isn’t set up. Confirm SCIM is enabled and configured with an IdP in FireHydrant before you connect. The connector can’t sync without it.