Skip to main content

​
After this article

You will be able to connect Netskope to Lumos to sync user and role information. This integration is read-only.

​
Capabilities

All Netskope objects are sync-only. This integration does not provision users or roles. Activity tracking: Supported. The connector retrieves the last activity timestamp for each user to track when they were last active.

​
Required plan and roles

  • Credentials: a Netskope API v2 token and your tenant URL / subdomain.
  • Privilege: you need enough privilege in Netskope to generate an API token.
  • Required scopes (all read):
    • /api/v2/platform/administration/scim/Users (read user information)
    • /api/v2/platform/rolesv2 (read role information)
    • /api/v2/platform/customroles (read custom roles)

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode. All Netskope objects this connector syncs (users, custom roles, and roles) are sync-only. This integration does not provision or change anything in Netskope. What read-only requires. An API v2 token scoped to Read permission on the three endpoints listed below (SCIM Users, rolesv2, customroles), plus your tenant subdomain. Follow the steps below to generate and scope the token. Watch out for. The token must carry Read permission on all three endpoints or the connection fails outright. There’s no separate provisioning credential to fall back to or upgrade toward for this connector.

​
Instructions

Phase 1: Generate an API v2 token in Netskope
  1. Log in at https://<tenant>.goskope.com with a user that has enough privilege to generate an API token.
  2. Go to Settings → Tools → REST API v2.
  3. Click the pencil next to REST API STATUS and enable the API. A NEW TOKEN button appears.
  4. Click NEW TOKEN and set the expiration date to the maximum value.
  5. Add these endpoints to the token scope with Read permission:
    • /api/v2/platform/administration/scim/Users
    • /api/v2/platform/rolesv2
    • /api/v2/platform/customroles
  6. Save, then copy the token.
Phase 2: Connect in Lumos
  1. Find the Netskope card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the API v2 token.
  3. Enter your Tenant URL / subdomain, the part between https:// and .goskope.com. For example your-subdomain or your-subdomain.eu for a localized instance.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Can’t connect the integration. Confirm the token carries Read permission on all three endpoints above, and that the tenant subdomain is only the part between https:// and .goskope.com (no full URL). Roles or users are missing. This integration is sync-only and reads users imported through SCIM plus role definitions. Objects outside those endpoints are not returned.