# Airtable + Lutril: setup guide

> Lutril connects to Airtable with a personal access token belonging to an enterprise admin. It lists every member of your enterprise over SCIM and enriches each one from the Enterprise API with their state, their last activity, their admin rights and whether your enterprise actually manages the account. Access is time boxed through Airtable's own reversible deactivation: a grant provisions the account or reinstates one Lutril deactivated earlier, and the deadline deactivates it again. Workspace and base collaborations survive, so reinstating somebody gives them back exactly what they had.

Source: https://www.lutril.com/fr/integrations/airtable
Category: Productivity
Auth: api_key
Last verified: 2026-11-09

---

## Setup

1. [object Object]
2. [object Object]
3. Copy the token when it appears. Airtable shows it once.
4. [object Object]
5. In Lutril, connect Airtable, paste the token and the enterprise account ID. The token is encrypted at rest.
6. [object Object]
7. Accounts are created without a password. Airtable provisions SCIM users for single sign on only, so Lutril never generates a password and has nothing to send anyone. The person signs in through your identity provider.
8. Lutril never calls Airtable's delete endpoint. The only removal it performs is the reversible one: deactivation revokes the licence and blocks sign in while keeping the account, and reinstating it restores the workspaces and bases the person was part of. Deleting a user stays a deliberate action in the Airtable admin panel.
9. Airtable refuses a state change on four kinds of account: your own, an external user, a free login account, and any user your enterprise does not manage because the domain is not claimed. Lutril reports which of the four applies rather than passing Airtable's error code on to whoever asked.
10. Service accounts are listed as service accounts and read only share link users as such, rather than all being folded into Member. That keeps an access review about the people who actually hold access.

## Access requested

- enterprise.scim.usersAndGroups:manage (list the enterprise over SCIM, and provision a new account). SCIM is the only endpoint that can enumerate an enterprise, because the Enterprise API can only answer about people you can already name.
- enterprise.user:read (each member's state, last activity, admin rights and managed flag)
- enterprise.user:write (deactivate an account at a deadline, and reinstate it on the next request)

## References

- [Airtable documentation](https://airtable.com/developers/web/api/scopes)
- [Airtable console](https://airtable.com/create/tokens)
- [Airtable API scopes](https://airtable.com/developers/web/api/scopes)
- [List users over SCIM](https://airtable.com/developers/web/api/list-scim-users)
- [Create a user over SCIM](https://airtable.com/developers/web/api/create-scim-user)
- [Get users by ID or email](https://airtable.com/developers/web/api/get-users-by-id-or-email)
- [Manage a user](https://airtable.com/developers/web/api/manage-user)
- [Deactivating and reactivating enterprise users](https://support.airtable.com/docs/deactivating-and-reactivating-enterprise-users)