> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ironclad

## After this article

You'll be able to connect Ironclad to Lumos, sync users and their group entitlements, ingest your Ironclad contracts into the Found Documents tab, and resolve common connection issues.

*Ironclad has 4 connector versions. Only the OAuth version works. Ironclad has deprecated the API token method, so use Sandbox OAuth or Production OAuth.*

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts, read for visibility (see status mapping) |
| Groups | Permission | Yes | No | The Ironclad Groups a user belongs to |
| Contracts | Document | Yes | No | Contract records and documents from your Ironclad Repository, placed in the Found Documents tab |

**Status mapping:** Lumos maps Ironclad user status to a Lumos account status.

| Ironclad User Status | Lumos Account Status |
| - | - |
| active | Active |
| inactive | Suspended |
| deleted (Ironclad no longer returns the user) | Deprovisioned |

**Contract ingestion notes:**

* Documents ingested from Ironclad show up with an Ironclad logo in the Found Documents tab.
* Lumos filters for contract records using parameters available on Ironclad's APIs. Records that don't match these filters are never fetched, processed, or stored by Lumos.
* For the Lumos contract **Start Date**, Lumos takes the first non-empty value of the record's `startDate`, `serviceStartDate`, then `agreementDate`, in that order.
* For the Lumos contract **End Date**, Lumos takes the first non-empty value of `agreementExpirationDate`, `expirationDate`, `serviceEndDate`, then `terminationDate`, in that order. If there's no end date, Lumos assumes a contract duration of 1 year.
* To adjust the filters Lumos uses to query your Ironclad contract data, contact Lumos Support at [support@lumos.com](mailto:support@lumos.com) or via Slack.

## Required plan and roles

* **Ironclad role:** you need the **Company Administrator** role. Only Company Admins can set up the OAuth integration with Ironclad.
* **Connection type:** OAuth only. Pick **Sandbox OAuth** or **Production OAuth** when you connect.

## Read-only access vs provisioning

**Is read-only possible?** Yes. The Sandbox OAuth or Production OAuth connection described in this article only syncs users, groups, and contracts.

**What read-only requires.** The same Company Administrator-authorized OAuth connection described above, follow the steps below to connect either the Sandbox or Production version.

**Watch out for.** The OAuth connection and the SCIM provisioning path are separate integrations against the same Ironclad tenant. SCIM account creation fails with a 409 error if the person already has an existing Ironclad user record, and Ironclad blocks SCIM user creation entirely if the tenant has more than one SAML configuration. If you run more than one Ironclad connection, confirm which Ironclad tenant (sandbox vs. production host) each one points to before acting on it, since the connection's display name in Lumos is free text and doesn't control which environment it reaches.

## Instructions

**Phase 1: Find your Instance Name in Ironclad**

1. Log in to Ironclad.
2. On the Ironclad homepage, find the **Company Name** listed in the top left of the screen. You'll use this as the **Instance Name** value in Lumos.

**Phase 2: Connect in Lumos**

1. Find the Ironclad card in your Lumos integrations (reconnect an existing card or add a new one).
2. Choose the version you want to connect, **Sandbox OAuth** or **Production OAuth**.
3. Click **Connect Ironclad** to start the OAuth connection process with Ironclad and finish authorizing.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Credentials are not valid" during sync.** This can be a transient connectivity blip rather than a bad credential. Re-trigger the sync and it usually resolves.

**The connection won't complete.** Confirm the user authorizing the connection has the **Company Administrator** role. Only Company Admins can set up OAuth with Ironclad.

**You picked the API token version.** The API token method is deprecated by Ironclad and won't work. Reconnect using **Sandbox OAuth** or **Production OAuth**.

**Can I limit which Ironclad contracts Lumos can see?** Yes. You can restrict access to specific contracts in Ironclad, and Lumos can adjust the parameters used in the Ironclad query. Contact [support@lumos.com](mailto:support@lumos.com) or reach out via Slack to change the filters.

**"Credentials are not valid" appears intermittently.** Often a transient connectivity blip rather than a bad token. Re-trigger the sync (or reconnect with a valid API token) and it typically clears.

**Ironclad says its OAuth setup supports only one application, and that slot is already taken.** Lumos does not use an OAuth application that you register in Ironclad. Lumos connects using its own registered OAuth application, and you authorize it through Ironclad's consent screen (open the Ironclad app in Lumos, go to the **Integrations** tab, click **Reconnect**, then click **Allow** in Ironclad). Connecting Lumos therefore does not consume or replace the custom Ironclad developer OAuth application that another integration such as your identity provider is using. They are two separate authorized applications.

**"Authorization error" when completing the OAuth consent flow.** The person clicking through the Ironclad consent screen needs the **Company Administrator** role in the exact Ironclad tenant being connected. If you are connecting **Sandbox OAuth**, that means Company Administrator in the Ironclad sandbox tenant, which is a separate tenant from production, so production admin rights on their own are not enough. Have someone who holds the role in the target tenant complete the authorization.

**Do you lose functionality by moving off the API token version?** No. The move to OAuth came from Ironclad's own security requirements rather than from Lumos, and Ironclad deprecated the legacy API method. The underlying functionality, meaning contract ingestion plus user and group data, is essentially the same on the OAuth versions.