Skip to main content

​
After this article

You’ll be able to connect Snyk to Lumos to sync user, group, and role information. This integration is read-only.

​
Capabilities

​
Required plan and roles

  • Snyk role: You must be an admin of the group, and the connection uses a Snyk Service Account with the Group Admin role.
  • Credentials: The service account’s Client ID and Client Secret.
  • Scopes: Add org.read and org.project.read.
  • Setup: Make sure the correct group settings are selected before you connect.

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode. This integration performs no create, update, or delete actions in Snyk, every row in the capabilities matrix is sync-only. What read-only requires. A Snyk Service Account with the Group Admin role, connected with the org.read and org.project.read scopes. Follow the steps below to create the service account and connect it. Watch out for. The account creating the service account must itself be a group admin, and the correct group settings must be selected before you connect, or the connection fails. If you’re on the EU-hosted version of Snyk, reconnect on a current connector version so it targets the EU API host.

​
Instructions

Phase 1: Create a Service Account in Snyk
  1. Log in to Snyk as a Group Admin.
  2. Go to Settings → Service Accounts.
  3. Name the service account (for example, Lumos).
  4. Select Group Admin as the role.
  5. Click Create Service Account.
  6. Copy the Client ID and Client Secret.
Phase 2: Connect in Lumos
  1. Find the Snyk card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Add org.read and org.project.read as scopes.
  3. Enter the Client ID and Client Secret from Phase 1.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Can’t connect the integration. Confirm you’re an admin of the group, the service account has the Group Admin role, and both org.read and org.project.read scopes are added. Check that the Client ID and Client Secret came from the same service account. Connecting the EU-hosted version of Snyk fails. EU-region support was added so the connector targets the EU API host instead of the default region. Reconnect on a current connector version if you’re on EU-hosted Snyk.