> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Duo Admin API

> Connect each client's Duo account to Triggr with a Duo Admin API application.

The Duo integration administers a Duo account in full: users, groups, devices, verification pushes, administrators, settings and logs. If your clients are subaccounts of a Duo MSP account, [Duo Accounts](https://kb.mspprocess.com/integrations/duo/accounts-api.md) covers all of them with one set of keys; to verify people, use [Duo Auth](https://kb.mspprocess.com/integrations/duo/auth-api.md).

Each Duo account needs Duo Premier, Duo Advantage or Duo Essentials (or an Advantage or Premier trial), and you need its Owner role.

## Set up Duo

Repeat these steps in each Duo account: your own, and each client's.

**1. Add an Admin API application**

In the Duo Admin Panel, go to **Applications → Application Catalog**, find Admin API and click + Add.

**2. Grant permissions**

Tick what your workflows need and click Save. If you fill in Networks for API Access, include Triggr's [outbound IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md).

| Permission | Lets Triggr |
| - | - |
| Grant resource - Read | Read users, groups, phones, tokens, bypass codes, WebAuthn credentials, desktop authenticators, endpoints, registered devices and push responses |
| Grant resource - Write | Change those objects, enrol users, send SMS links and verification pushes, run bulk user operations and directory syncs |
| Grant administrators - Read | Read administrators, pending activations and administrative units |
| Grant administrators - Write | Change administrators, administrative units and activation links, and sync administrators |
| Grant read log | Read logs and Trust Monitor events |
| Grant settings | Read and change settings, the logo and custom messaging |
| Grant read information | Read the account summary, telephony credits and authentication attempts |

**3. Copy the application details**

Copy the Integration key, Secret key and API hostname from Details.

Directory sync actions also need the directory's key, from Users → Directory Sync. See Duo's [Admin API first steps](https://duo.com/docs/adminapi#first-steps).

## Connect it in Triggr

**1. Open the account's configuration**

Go to **Integrations > Duo** and click **Configure** on the client's row in the Per-Client Configuration card, or on the Base Configuration card for your own account.

![The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=11464b4946bea0b580c73330d9114a41)

**2. Enter the application details**

Enter Hostname as `https://` plus the API hostname, with no trailing `/` or path (for example `https://api-XXXXXXXX.duosecurity.com`), add the SecretKey and IntegrationKey, then click **Save Configuration**.

![The Duo configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/duo-admin-api/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=0365cea8808b8df7cbd2331cf8a3c190)

Per-client integrations never fall back to the Base Configuration, so every client whose workflows use Duo needs its own row.

## Troubleshooting

> [accordion] 401 errors
>
> 40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing `/` or path.

> [accordion] 403 errors
>
> Tick the permission the action needs in the Duo Admin Panel, and check the keys come from an Admin API application, not Auth API.

> [accordion] no Duo integration is configured for this client
>
> Configure Duo for that client on the Per-Client Configuration card.

> [accordion] Requests are blocked
>
> Add Triggr's [outbound IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md) to the application's Networks for API Access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.