> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grammarly

## After this article

You'll be able to connect Grammarly to Lumos to sync users and roles for visibility and Access Reviews. You can connect with read-only access or with read plus delete access, which lets Lumos deprovision Grammarly users directly.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User account |
| Roles | Permission | Yes | No | Roles |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Delete User | User | Deletes a user in Grammarly. Available only when the `users-api:write` scope is provided. |

**Activity tracking:** supported for last activity timestamp only. The Grammarly integration tracks the last activity timestamp for user accounts.

## Required plan and roles

* **Grammarly role:** you need admin access to your Grammarly admin panel to create the OAuth 2.0 credentials used for the connection.
* **Authentication:** OAuth 2.0 Client Credentials. Lumos authenticates with a **Client ID** and **Client Secret** rather than an API key, so the raw credentials aren't exposed on each request.
* **Scopes:** from the License Management API. A read plus delete connection needs `users-api:read` and `users-api:write`. A read-only connection needs `users-api:read` only.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Grammarly supports a read-only connection using OAuth 2.0 credentials scoped to `users-api:read` only.

**What read-only requires.** An OAuth 2.0 Client ID and Client Secret created in the Grammarly admin panel under Organization → OAuth 2.0 credentials, with only the read scope for the License Management API assigned. Follow the steps below, selecting the read scope only when you create the credential.

**What full provisioning requires.** The same OAuth credential with the additional `users-api:write` scope assigned, which lets Lumos delete users in Grammarly during offboarding.

**Watch out for.** The delete capability only works if `users-api:write` was granted when the credential was created. If you start read-only and later need deprovisioning, add the write scope to the existing credential or create a new one, since it won't appear on its own.

## Instructions

**Phase 1: Create OAuth 2.0 credentials in Grammarly**

1. Go to your Grammarly admin panel.
2. Open the **Organization** tab and choose **OAuth 2.0 credentials** in the **Configurations** section.
3. Click **Add credential** in the upper-right corner.
4. Enter a name and check the box next to the API you'll use. Select the **License Management API** option and assign the read and write scopes for user management. For a read-only connection, assign the read scope only.
5. Click **Create**.
6. Click **Copy to clipboard** to save your Client ID and Client Secret.

**Phase 2: Connect in Lumos**

1. Click the Grammarly card in your Lumos integrations (reconnect an existing card or add a new one).
2. Provide the **Client ID** and **Client Secret** you copied from Grammarly.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Invalid credentials" or "Unauthorized" error.** Verify the Client ID and Client Secret are correct and haven't expired. Confirm you have admin access to create OAuth credentials in Grammarly.

**Connection fails during the OAuth token request.** Check that your network can reach `https://auth.grammarly.com`. Confirm the Client Secret is stored securely and hasn't been exposed, and that the OAuth credentials have the required scopes enabled.

**Users aren't syncing.** Verify the users have accepted their team invitations and have active Grammarly accounts. Confirm email addresses match between the two systems, and that the OAuth credentials carry the `users-api:read` scope.

**Activity timestamp isn't updating.** Confirm the users have recent login activity and that the integration has permission to read user activity.