> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenVPN

## After this article

You will be able to connect OpenVPN to Lumos to sync OpenVPN users for visibility, Access Reviews, and offboarding, including deprovisioning OpenVPN users directly from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Role | Entitlement | Yes | No | Whether the user is an OpenVPN Member, Admin, or Owner |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Delete | User | Permanently deletes the user from OpenVPN and reclaims a license |

**Status mapping:**

| OpenVPN user status | Lumos account status |
| - | - |
| Active | Active |
| Canceled, Suspended, or Suspended (IDP) | Suspended |
| Invited | Staged |
| Deleted (OpenVPN no longer returns the user) | Deprovisioned |

> **Warning:** deprovisioning an OpenVPN user through Lumos permanently deletes the user in OpenVPN. This action reclaims a license in OpenVPN.

## Required plan and roles

* **OpenVPN plan:** no minimum OpenVPN plan is required to connect this integration.
* **OpenVPN role:** the user who connects the integration must be at least an **Administrator**.
* **Credentials:** Lumos authenticates with an OpenVPN **Client ID** and **Client Secret** (API keys) scoped to your organization's **OpenVPN ID**.

## Read-only access vs provisioning

**Is read-only possible?** No. The connecting user must be at least an Administrator, and the Client ID and Client Secret it generates aren't described with any narrower or read-only scope, so the credential you connect with carries the same access used to delete users during deprovisioning.

**What full provisioning requires.** An OpenVPN Administrator generates a Client ID and Client Secret (API keys) scoped to your organization's OpenVPN ID, entered as described below.

**Watch out for.** Deprovisioning an OpenVPN user through Lumos permanently deletes the user in OpenVPN and reclaims a license, so there's no soft-suspend option. The Role entitlement (Member, Admin, Owner) is sync-only and Lumos can't change it. Delete is the only provisioning action available.

## Instructions

**Phase 1: Create API keys in OpenVPN**

1. Log into OpenVPN as an administrator.
2. Create API keys and temporarily save the **Client ID** and **Client Secret** values.
   1. Login to your OpenVPN account at[myaccount.openvpn.com/cvpn/portal-select](https://myaccount.openvpn.com/cvpn/portal-select) as an administrator
   2. Go to Account (top right) > Cloud API
   3. Create new credentials (be sure to save your client secret)
   4. Ensure the Cloud API is enabled for your organization (the switch at the top of the Cloud API page should be green, not red)
   5. Input the Client ID and Client Secret below
3. Retrieve your organization's OpenVPN ID (for example, `lumostester`).

**Phase 2: Connect in Lumos**

1. Find the OpenVPN card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter your organization's OpenVPN ID in the **OpenVPN ID** field.
3. Paste your OpenVPN Client ID in the **Client ID** field.
4. Paste your OpenVPN Client Secret in the **Client Secret** field.
5. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails.** Confirm the OpenVPN user who created the API keys is at least an Administrator, and that the OpenVPN ID, Client ID, and Client Secret were entered without extra spaces.

**A user disappeared from the sync.** OpenVPN stops returning deleted users, so Lumos marks the account **Deprovisioned**. Check the user's status in the OpenVPN admin console.