Skip to main content

​
After this article

You’ll be able to connect Ironclad to Lumos, sync users and their group entitlements, ingest your Ironclad contracts into the Found Documents tab, and resolve common connection issues. Ironclad has 4 connector versions. Only the OAuth version works. Ironclad has deprecated the API token method, so use Sandbox OAuth or Production OAuth.

​
Capabilities

Status mapping: Lumos maps Ironclad user status to a Lumos account status. Contract ingestion notes:
  • Documents ingested from Ironclad show up with an Ironclad logo in the Found Documents tab.
  • Lumos filters for contract records using parameters available on Ironclad’s APIs. Records that don’t match these filters are never fetched, processed, or stored by Lumos.
  • For the Lumos contract Start Date, Lumos takes the first non-empty value of the record’s startDate, serviceStartDate, then agreementDate, in that order.
  • For the Lumos contract End Date, Lumos takes the first non-empty value of agreementExpirationDate, expirationDate, serviceEndDate, then terminationDate, in that order. If there’s no end date, Lumos assumes a contract duration of 1 year.
  • To adjust the filters Lumos uses to query your Ironclad contract data, contact Lumos Support at support@lumos.com or via Slack.

​
Required plan and roles

  • Ironclad role: you need the Company Administrator role. Only Company Admins can set up the OAuth integration with Ironclad.
  • Connection type: OAuth only. Pick Sandbox OAuth or Production OAuth when you connect.

​
Read-only access vs provisioning

Is read-only possible? Yes. The Sandbox OAuth or Production OAuth connection described in this article only syncs users, groups, and contracts. What read-only requires. The same Company Administrator-authorized OAuth connection described above, follow the steps below to connect either the Sandbox or Production version. Watch out for. The OAuth connection and the SCIM provisioning path are separate integrations against the same Ironclad tenant. SCIM account creation fails with a 409 error if the person already has an existing Ironclad user record, and Ironclad blocks SCIM user creation entirely if the tenant has more than one SAML configuration. If you run more than one Ironclad connection, confirm which Ironclad tenant (sandbox vs. production host) each one points to before acting on it, since the connection’s display name in Lumos is free text and doesn’t control which environment it reaches.

​
Instructions

Phase 1: Find your Instance Name in Ironclad
  1. Log in to Ironclad.
  2. On the Ironclad homepage, find the Company Name listed in the top left of the screen. You’ll use this as the Instance Name value in Lumos.
Phase 2: Connect in Lumos
  1. Find the Ironclad card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Choose the version you want to connect, Sandbox OAuth or Production OAuth.
  3. Click Connect Ironclad to start the OAuth connection process with Ironclad and finish authorizing.

​
API Endpoints Used

​
Troubleshooting

“Credentials are not valid” during sync. This can be a transient connectivity blip rather than a bad credential. Re-trigger the sync and it usually resolves. The connection won’t complete. Confirm the user authorizing the connection has the Company Administrator role. Only Company Admins can set up OAuth with Ironclad. You picked the API token version. The API token method is deprecated by Ironclad and won’t work. Reconnect using Sandbox OAuth or Production OAuth. Can I limit which Ironclad contracts Lumos can see? Yes. You can restrict access to specific contracts in Ironclad, and Lumos can adjust the parameters used in the Ironclad query. Contact support@lumos.com or reach out via Slack to change the filters. “Credentials are not valid” appears intermittently. Often a transient connectivity blip rather than a bad token. Re-trigger the sync (or reconnect with a valid API token) and it typically clears. Ironclad says its OAuth setup supports only one application, and that slot is already taken. Lumos does not use an OAuth application that you register in Ironclad. Lumos connects using its own registered OAuth application, and you authorize it through Ironclad’s consent screen (open the Ironclad app in Lumos, go to the Integrations tab, click Reconnect, then click Allow in Ironclad). Connecting Lumos therefore does not consume or replace the custom Ironclad developer OAuth application that another integration such as your identity provider is using. They are two separate authorized applications. “Authorization error” when completing the OAuth consent flow. The person clicking through the Ironclad consent screen needs the Company Administrator role in the exact Ironclad tenant being connected. If you are connecting Sandbox OAuth, that means Company Administrator in the Ironclad sandbox tenant, which is a separate tenant from production, so production admin rights on their own are not enough. Have someone who holds the role in the target tenant complete the authorization. Do you lose functionality by moving off the API token version? No. The move to OAuth came from Ironclad’s own security requirements rather than from Lumos, and Ironclad deprecated the legacy API method. The underlying functionality, meaning contract ingestion plus user and group data, is essentially the same on the OAuth versions.