> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create new permissions with a provisioning group

> Create two permissions underneath an application in Lumos automatically and link it to a provisioning group.

<RequestExample>
  ```python Python theme={null}
  import requests

  APP_ID = "<APP_ID>"
  GROUP_ID = "<GROUP_ID>"

  API_TOKEN = "<YOUR_API_TOKEN>"

  url = "https://api.lumos.com/appstore/requestable_permissions"

  headers = {
      "accept": "application/json",
      "authorization": "Bearer <YOUR_API_TOKEN>",
  }

  payload_with_lumos_group_id = {
      "request_config": {
          "appstore_visibility": "VISIBLE",
          "allowed_groups": {"type": "ALL_GROUPS"},
          "request_fulfillment_config": {"provisioning_group": {"id": GROUP_ID}},
      },
      "app_id": APP_ID,
      "label": "New Permission!",
  }

  response = requests.post(url, json=payload_with_lumos_group_id, headers=headers)
  print(response.json())

  GROUP_INTEGRATION_SPECIFIC_ID = "<GROUP_INTEGRATION_SPECIFIC_ID>"
  GROUP_APP_ID = "<GROUP_APP_ID>"

  payload_with_external_group_id = {
      "request_config": {
          "appstore_visibility": "VISIBLE",
          "allowed_groups": {"type": "ALL_GROUPS"},
          "request_fulfillment_config": {
              "provisioning_group": {
                  "app_id": GROUP_APP_ID,
                  "integration_specific_id": GROUP_INTEGRATION_SPECIFIC_ID,
              }
          },
      },
      "app_id": APP_ID,
      "label": "New Permission",
  }
  response = requests.post(url, json=payload_with_external_group_id, headers=headers)
  print(response.json())
  ```
</RequestExample>

<Steps>
  <Step title="Find the app id">
    First, you'll need the Lumos ID for the app you're looking to add your permissions to. You can find it by using the API itself, or by inspecting the URL of your app of choice in the All Apps page: [https://app.lumosidentity.com/apps?tab=apps](https://app.lumosidentity.com/apps?tab=apps).

    Replace `<APP_ID>` with the app ID.
  </Step>

  <Step title="Find the group id">
    \[Note] This step is optional. To keep provisioning for your AppStore permissions manual, skip this step. You can alternatively associate an [inline webhook](/reference/access-request-webhooks) to the permission to build your own provisioning flow.

    Next, you'll need to find the Lumos id of the provisioning group you'd like to set as the provisioning group for this permission.

    Once this provisioning group is set on the permission, Lumos will automatically provision to and deprovision from the group in Okta.

    You can use the groups API endpoints to find the right group.

    Lumos syncs groups from third party services. You can also use the third-party identifier on the group for this API routine. A later step covers this.
  </Step>

  <Step title="Setup your API token and URL">
    This recipe uses this endpoint to create permissions. Replace `<YOUR_API_TOKEN>` with an API token from [https://app.lumosidentity.com/settings/api\_tokens](https://app.lumosidentity.com/settings/api_tokens).
  </Step>

  <Step title="Build the first payload">
    * Set the AppStore visibility to "VISIBLE" so the permission appears in the AppStore.
    * Pass in "ALL\_GROUPS" so everyone can see this permission.
    * Set the provisioning group you found earlier as the "provisioning\_group" on the "request\_fulfillment\_config".
    * Pass in the APP\_ID of the app to create the permission on, and a label that end users see: "New Permission!"

    This payload doesn't set an approver on the permission, so the application-level approver also approves access to this permission. To customize approvals later, use the `request_approval_config` field on the payload.
  </Step>

  <Step title="Create the permission">
    This will create the permission and return a JSON with its metadata. You should now be able to see it in the Lumos AppStore UI as well.
  </Step>

  <Step title="Find alternative identifiers for a group">
    Sometimes you might already have the external identifier of the Group handy, for example from Google Workspace or Okta.

    You can use the external group id from these tools here as well by filling out the GROUP\_INTEGRATION\_SPECIFIC\_ID. You'll also need to find the GROUP\_APP\_ID, which is the Lumos id of the app that sourced this group. It should be the app of your Google Workspace or Okta integration in Lumos.

    Keep in mind it's possible the external group may not have been brought over to Lumos via an automated sync yet. New groups in third party services come into Lumos daily.
  </Step>

  <Step title="Create the permission">
    This will create the permission and return a JSON with its metadata. You should now be able to see it in the Lumos AppStore UI as well.
  </Step>
</Steps>