> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snyk

## After this article

You'll be able to connect Snyk to Lumos to sync user, group, and role information. This integration is read-only.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Groups | Permission | Yes | No | Group profiles |
| Custom Roles | Permission | Yes | No | Custom roles |
| Standard Roles | Permission | Yes | No | Permission sets |

## Required plan and roles

* **Snyk role:** You must be an **admin of the group**, and the connection uses a **Snyk Service Account** with the **Group Admin** role.
* **Credentials:** The service account's **Client ID** and **Client Secret**.
* **Scopes:** Add **`org.read`** and **`org.project.read`**.
* **Setup:** Make sure the correct group settings are selected before you connect.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode. This integration performs no create, update, or delete actions in Snyk, every row in the capabilities matrix is sync-only.

**What read-only requires.** A Snyk Service Account with the Group Admin role, connected with the `org.read` and `org.project.read` scopes. Follow the steps below to create the service account and connect it.

**Watch out for.** The account creating the service account must itself be a group admin, and the correct group settings must be selected before you connect, or the connection fails. If you're on the EU-hosted version of Snyk, reconnect on a current connector version so it targets the EU API host.

## Instructions

**Phase 1: Create a Service Account in Snyk**

1. Log in to Snyk as a **Group Admin**.
2. Go to **Settings → Service Accounts**.
3. Name the service account (for example, `Lumos`).
4. Select **Group Admin** as the role.
5. Click **Create Service Account**.
6. Copy the **Client ID** and **Client Secret**.

**Phase 2: Connect in Lumos**

1. Find the Snyk card in your Lumos integrations ([reconnect](https://app.lumosidentity.com/integrations?tab=connected) an existing card or [add a new one](https://app.lumosidentity.com/integrations?tab=can_integrate)).
2. Add **`org.read`** and **`org.project.read`** as scopes.
3. Enter the **Client ID** and **Client Secret** from Phase 1.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Can't connect the integration.** Confirm you're an admin of the group, the service account has the Group Admin role, and both `org.read` and `org.project.read` scopes are added. Check that the Client ID and Client Secret came from the same service account.

**Connecting the EU-hosted version of Snyk fails.** EU-region support was added so the connector targets the EU API host instead of the default region. Reconnect on a current connector version if you're on EU-hosted Snyk.