> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Duo Admin API

> Connect each client's Duo account to Triggr with a Duo Admin API application.

The Duo integration administers a Duo account in full: users, groups, devices, verification pushes, administrators, settings and logs. If your clients are subaccounts of a Duo MSP account, [Duo Accounts](/integrations/duo/accounts-api) covers all of them with one set of keys; to verify people, use [Duo Auth](/integrations/duo/auth-api).

Each Duo account needs Duo Premier, Duo Advantage or Duo Essentials (or an Advantage or Premier trial), and you need its Owner role.

## Set up Duo

Repeat these steps in each Duo account: your own, and each client's.

<Steps>
  <Step title="Add an Admin API application">
    In the Duo Admin Panel, go to **Applications → Application Catalog**, find Admin API and click + Add.
  </Step>

  <Step title="Grant permissions">
    Tick what your workflows need and click Save. If you fill in Networks for API Access, include Triggr's [outbound IP addresses](/security/ip-allowlist).

    | Permission | Lets Triggr |
    | - | - |
    | Grant resource - Read | Read users, groups, phones, tokens, bypass codes, WebAuthn credentials, desktop authenticators, endpoints, registered devices and push responses |
    | Grant resource - Write | Change those objects, enrol users, send SMS links and verification pushes, run bulk user operations and directory syncs |
    | Grant administrators - Read | Read administrators, pending activations and administrative units |
    | Grant administrators - Write | Change administrators, administrative units and activation links, and sync administrators |
    | Grant read log | Read logs and Trust Monitor events |
    | Grant settings | Read and change settings, the logo and custom messaging |
    | Grant read information | Read the account summary, telephony credits and authentication attempts |
  </Step>

  <Step title="Copy the application details">
    Copy the Integration key, Secret key and API hostname from Details.
  </Step>
</Steps>

Directory sync actions also need the directory's key, from Users → Directory Sync. See Duo's [Admin API first steps](https://duo.com/docs/adminapi#first-steps).

## Connect it in Triggr

<Steps>
  <Step title="Open the account's configuration">
    Go to **Integrations > Duo** and click **Configure** on the client's row in the Per-Client Configuration card, or on the Base Configuration card for your own account.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=11464b4946bea0b580c73330d9114a41" alt="The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button." width="2272" height="646" data-path="images/integrations-common/per-client-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the application details">
    Enter Hostname as `https://` plus the API hostname, with no trailing `/` or path (for example `https://api-XXXXXXXX.duosecurity.com`), add the SecretKey and IntegrationKey, then click **Save Configuration**.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/duo-admin-api/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=0365cea8808b8df7cbd2331cf8a3c190" alt="The Duo configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1354" data-path="images/duo-admin-api/configure.png" />
    </Frame>
  </Step>
</Steps>

Per-client integrations never fall back to the Base Configuration, so every client whose workflows use Duo needs its own row.

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 errors">
    40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing `/` or path.
  </Accordion>

  <Accordion title="403 errors">
    Tick the permission the action needs in the Duo Admin Panel, and check the keys come from an Admin API application, not Auth API.
  </Accordion>

  <Accordion title="no Duo integration is configured for this client">
    Configure Duo for that client on the Per-Client Configuration card.
  </Accordion>

  <Accordion title="Requests are blocked">
    Add Triggr's [outbound IP addresses](/security/ip-allowlist) to the application's Networks for API Access.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.