> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Marketo

## After this article

You will be able to connect Marketo to Lumos to sync users, their roles, and last-login activity, and to deprovision Marketo users from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts. Lumos does not create Marketo users, but can permanently delete them (see below) |
| Roles | Permission | Yes | No | The roles associated with each Marketo user |

**Account status mapping:** Marketo returns the user → **Active**, deleted (Marketo no longer returns the user) → **Deprovisioned**.

**Last Login** is retrieved from the `lastLoginAt` field and represents the last time the user logged into Marketo.

| Deprovisioning action | Used by | What happens in Marketo |
| - | - | - |
| Deprovision | Offboarding, Access Reviews, License Management | Permanently removes the user and their data via the User Management `delete_user` endpoint. Reclaims a license. Lumos marks the account **Deprovisioned**. |

## Required plan and roles

* **Marketo plan:** API Access is required
* **Marketo role:** the connecting Marketo user must be an **Admin**.
* **API role permissions:** Lumos authenticates as a dedicated API-only user whose role must have these boxes checked:
  * **Access User Management Api** (from the Access API permissions group), for reading and deleting users
  * **Access Users** (from the Access Admin permissions group)
  * the **Admin** permissions group
* **Permission scoping:** the User Management API permission covers both reads and the user-delete action Lumos uses for deprovisioning. No read-only variant is documented.

## Read-only access vs provisioning

**Is read-only possible?** Not as a documented option. The API-only user's role bundles **Access User Management Api** with both the read calls Lumos uses to list users and the delete call it uses to deprovision them, and no narrower role or scope is documented for this connector.

**What full provisioning requires.** The dedicated API-only user and Custom Service described below, with the **Access User Management Api**, **Access Users**, and **Admin** permissions group boxes checked on its role. That single credential is what lets Lumos both sync users and permanently delete them during deprovisioning.

**Watch out for.** Deprovisioning in Marketo is permanent deletion, not deactivation. There's no separate suspend or deactivate action, so any workflow that deprovisions a user removes their Marketo data outright.

## Instructions

**Phase 1: Create an API-only user and Custom Service in Marketo**

1. Create a new **API Only User Role** with **Access User Management Api**, **Access Users**, and the **Admin** permissions group checked. Create a new role called `Lumos` rather than repurposing an existing one.
2. Create a new **API-only user** for Lumos and assign it the `Lumos` role.
3. Create a new **Custom Service** and assign it the API-only user.
4. Save the API credentials for the Custom Service: the **Client ID** and **Client Secret**.
5. Go to **Admin** → **Web Services** → **REST API** and save the **Endpoint** value.

**Phase 2: Connect in Lumos**

1. Find the Marketo card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the **Client ID** and **Client Secret** from the Custom Service.
3. For the **Munchkin ID**, copy only the part of the REST API Endpoint between `https://` and `/rest`.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Can't connect.** Follow the Marketo-side steps exactly, including creating a **new** API-only role for Lumos rather than reusing an existing role. Missing permission checkboxes on the role are the most common cause of failures.

**Connection fails on the Munchkin ID.** Enter only the portion of the REST API Endpoint between `https://` and `/rest` (from **Admin → Web Services → REST API**), not the full URL.

**A user deprovisioned from Lumos is gone entirely from Marketo.** This is expected. Deprovisioning permanently removes the user and their data in Marketo. There is no suspend/deactivate option in this connector.