Skip to main content

​
After this article

You will be able to connect Marketo to Lumos to sync users, their roles, and last-login activity, and to deprovision Marketo users from Lumos.

​
Capabilities

Account status mapping: Marketo returns the user → Active, deleted (Marketo no longer returns the user) → Deprovisioned. Last Login is retrieved from the lastLoginAt field and represents the last time the user logged into Marketo.

​
Required plan and roles

  • Marketo plan: API Access is required
  • Marketo role: the connecting Marketo user must be an Admin.
  • API role permissions: Lumos authenticates as a dedicated API-only user whose role must have these boxes checked:
    • Access User Management Api (from the Access API permissions group), for reading and deleting users
    • Access Users (from the Access Admin permissions group)
    • the Admin permissions group
  • Permission scoping: the User Management API permission covers both reads and the user-delete action Lumos uses for deprovisioning. No read-only variant is documented.

​
Read-only access vs provisioning

Is read-only possible? Not as a documented option. The API-only user’s role bundles Access User Management Api with both the read calls Lumos uses to list users and the delete call it uses to deprovision them, and no narrower role or scope is documented for this connector. What full provisioning requires. The dedicated API-only user and Custom Service described below, with the Access User Management Api, Access Users, and Admin permissions group boxes checked on its role. That single credential is what lets Lumos both sync users and permanently delete them during deprovisioning. Watch out for. Deprovisioning in Marketo is permanent deletion, not deactivation. There’s no separate suspend or deactivate action, so any workflow that deprovisions a user removes their Marketo data outright.

​
Instructions

Phase 1: Create an API-only user and Custom Service in Marketo
  1. Create a new API Only User Role with Access User Management Api, Access Users, and the Admin permissions group checked. Create a new role called Lumos rather than repurposing an existing one.
  2. Create a new API-only user for Lumos and assign it the Lumos role.
  3. Create a new Custom Service and assign it the API-only user.
  4. Save the API credentials for the Custom Service: the Client ID and Client Secret.
  5. Go to Admin → Web Services → REST API and save the Endpoint value.
Phase 2: Connect in Lumos
  1. Find the Marketo card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the Client ID and Client Secret from the Custom Service.
  3. For the Munchkin ID, copy only the part of the REST API Endpoint between https:// and /rest.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Can’t connect. Follow the Marketo-side steps exactly, including creating a new API-only role for Lumos rather than reusing an existing role. Missing permission checkboxes on the role are the most common cause of failures. Connection fails on the Munchkin ID. Enter only the portion of the REST API Endpoint between https:// and /rest (from Admin → Web Services → REST API), not the full URL. A user deprovisioned from Lumos is gone entirely from Marketo. This is expected. Deprovisioning permanently removes the user and their data in Marketo. There is no suspend/deactivate option in this connector.