Skip to main content

​
After this article

You will be able to connect StrongDM to Lumos to sync users, service accounts, and permission data from your StrongDM deployment. StrongDM is a zero-trust privileged access management platform that provides secure access to databases, servers, clusters, and other infrastructure.

​
Capabilities

Activity tracking is supported. The StrongDM integration can track last user login.

​
Required plan and roles

  • StrongDM API key: an API key generated in the StrongDM Admin UI under Principals > Tokens > Add API Key. Use a key generated by an Admin.
  • Scopes required on the API key:
    • users.list: list users and service accounts.
    • audit.activities: audit StrongDM account activities.

​
Read-only access vs provisioning

Is read-only possible? Yes, and it’s the only mode. Every capability row (Users, Service Accounts, Permissions) is sync-only, and the API key scopes this connector uses, users.list and audit.activities, are both read scopes. What read-only requires. An API key generated in the StrongDM Admin UI under Principals → Tokens → Add API Key, scoped to users.list and audit.activities, generated by an Admin. Follow the steps below to create the key and connect. Watch out for. Use a key generated by an Admin. A key restricted to specific resource scopes, or one that lacks read permissions for accounts, resources, and roles, causes 403 errors even though the connector never attempts a write.

​
Instructions

Phase 1: Create a StrongDM API key
  1. In the StrongDM Admin UI, go to Principals > Tokens > Add API Key.
  2. Create the key with the users.list and audit.activities scopes, then copy the Access Key and the Secret Key.
  3. Find your Web Domain in the Admin UI under Settings > Account > Web Domain.
Phase 2: Connect in Lumos
  1. Click the StrongDM card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Provide the required input fields:
    • Secret Key: the API Secret Key from Principals > Tokens > Add API Key in the Admin UI.
    • Access Key: the API Access Key from the same Principals > Tokens > Add API Key section of the Admin UI.
    • Web Domain: the web domain of your StrongDM instance, found in the Admin UI under Settings > Account > Web Domain. This identifies your StrongDM app instance.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Authentication issues (“Invalid credentials” or “401 Unauthorized”). Verify both the Access Key ID and Secret Key were copied correctly, check for extra spaces or missing characters, ensure the API key has not been revoked or deleted, verify the API key is active, and try generating a new API key. Permission errors (“403 Forbidden” or “Insufficient permissions”). Verify the API key has read permissions for accounts, resources, and roles, check that the key is not restricted to specific resource scopes, use an Admin-generated API key, and try a key with full read permissions temporarily. No users syncing. Verify users exist, check that the key can access user accounts, ensure users are active and not suspended, review the Lumos integration logs, and test the API manually. Connection issues (“Unable to connect to StrongDM”). Verify api.strongdm.com is reachable, check firewall rules, ensure the StrongDM service is operational, and retry after a few minutes. Rate limiting (“429 Too Many Requests”). Wait for the limit to reset, verify no other apps use the same key excessively, and contact StrongDM support if needed. Lumos automatically handles pagination and rate limiting, though large environments may take longer to sync.