> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FireHydrant

## After this article

You'll be able to connect FireHydrant to Lumos to sync and provision users, groups, and roles.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User accounts. Lumos can create, activate, deactivate, and delete them |
| Groups | Permission | Yes | Yes | Groups and their membership. Lumos can add and remove members |
| Roles | Permission | Yes | Yes | Role definitions. Lumos can assign and change a user's role |

**Provisioning behavior:**

* **Create:** requires a username, first name, last name, and email. Lumos creates the user over SCIM and FireHydrant sends them an email invitation. Entitlements can't be assigned as part of creation, assign them separately afterward.
* **Assign a role:** a FireHydrant user holds exactly one role (owner, member, collaborator, or viewer), so assigning a new role replaces the current one. Assigning a role the user already holds returns an error rather than a silent no-op.
* **Remove a role:** Lumos resets the user to the **member** role. The member role itself can't be removed.
* **Add or remove a group member:** Lumos reads the group's current member list and writes the updated list back. Adding a member who's already in the group, or removing one who isn't, returns an error.
* **Activate and deactivate:** Lumos sets the SCIM `active` flag to true or false.

## Required plan and roles

* **SCIM requirement:** SCIM must be enabled and configured with an IdP in FireHydrant before you can use this connector. The connector can't sync without it.
* **FireHydrant role:** you need access to create an API key in FireHydrant.
* **API key access:** the connection uses a FireHydrant API key with **Write** access. This connector runs on SCIM, so it needs Write access even for read-only capabilities. A read-only token can't reach the SCIM API.

## Read-only access vs provisioning

**Is read-only possible?** No. FireHydrant sync runs entirely over its SCIM API, and a read-only API key can't reach the SCIM API at all. Write access is required even to sync.

**What full provisioning requires.** A FireHydrant API key created with **Write access** (Settings > API Keys > Create API Key), and SCIM enabled and configured with an IdP in FireHydrant before you connect. Follow the steps below.

**Watch out for.** A 401 on the SCIM endpoint after connecting usually isn't a bad credential, it's a token that lacks Write access. Regenerate the API key with Write access and reconnect. Also confirm SCIM is enabled and configured with an IdP in FireHydrant first, since the connector can't sync at all without it.

## Instructions

**Phase 1: Create an API key in FireHydrant**

1. Log in to FireHydrant.
2. Go to **Settings > API Keys**.
3. Click **Create API Key**.
4. Enter a name, check **Write access**, and click **Create**.
5. Copy the API key.

**Phase 2: Connect in Lumos**

1. Click the FireHydrant card in your Lumos integrations (reconnect an existing card or add a new one).
2. Paste the API key into Lumos to finish connecting the integration.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connected but no data, with a 401 on the SCIM endpoint.** This looks like bad credentials, but it usually means the token lacks write scope. A read-only token can't access the SCIM API. Regenerate the API key with Write access and reconnect.

**SCIM isn't set up.** Confirm SCIM is enabled and configured with an IdP in FireHydrant before you connect. The connector can't sync without it.