How to Integrate Retool with LastPass

The LastPass Provisioning API authenticates using two credentials: your account's Account Number (a numeric identifier for your LastPass Business or Enterprise account) and a Provisioning Hash (a secret API key). Log in to the LastPass Admin Console at lastpass.com/company. In the Admin Console left navigation, expand the Advanced section and click 'Enterprise API'. On this page, you will see your Account Number displayed at the top — it is a numeric string like 12345678. Below the account number, you will find the option to generate or view your Provisioning Hash. If no hash exists, click 'Generate Provisioning Hash' to create one. Copy the hash value — it is a long alphanumeric string that serves as your API secret key. Store it securely. Note that the Provisioning Hash can be regenerated at any time in the Admin Console (invalidating the previous one), so treat it like a password and store it in Retool's Configuration Variables rather than hardcoding it anywhere. Also note the API endpoint URL shown on this page — LastPass's Provisioning API base URL is https://lastpass.com/enterpriseapi.php. Unlike typical REST APIs, LastPass's Provisioning API uses POST requests for most operations with a JSON body that includes the command type and authentication credentials.

In Retool, navigate to the Resources tab in the left sidebar and click Add Resource. Select REST API from the resource type list. Name the resource 'LastPass Enterprise API'. LastPass's Provisioning API uses a single endpoint URL for all operations (a command pattern rather than separate REST endpoints), so in the Base URL field enter https://lastpass.com. Do not append any path to the base URL — the API path /enterpriseapi.php will be specified in individual query configurations. Leave the Authentication dropdown set to None since LastPass authentication is handled by including the Account Number and Provisioning Hash in the request body. Add a default header for Content-Type with value application/json. Click Save Changes. LastPass's API design is unusual: almost all operations use HTTP POST to /enterpriseapi.php, and the operation type is specified as a 'cmd' field in the JSON request body, along with 'apiuser', 'apikey' credentials, and operation-specific parameters. This means each Retool query will be a POST request to /enterpriseapi.php with a different body depending on the operation. Store your Account Number and Provisioning Hash in Retool's Configuration Variables (Settings → Configuration Variables, mark both as secrets) rather than embedding them in individual query bodies — reference them as {{ retoolContext.configVars.LASTPASS_ACCOUNT_NUMBER }} and {{ retoolContext.configVars.LASTPASS_PROVISIONING_HASH }}.

Create a new query named 'getUsers' in your Retool app's Code panel. Select your LastPass Enterprise API resource. Set Method to POST and Path to /enterpriseapi.php. Set Body Type to JSON. In the Body field, write the JSON payload for the 'getuserdata' command — this returns data for all users in your LastPass Enterprise account including usernames, email addresses, group memberships, admin status, and account creation dates. The JSON body must include the 'cmd', 'apiuser' (your Account Number), and 'apikey' (your Provisioning Hash) fields. The response is a JSON object where the 'Users' key contains an object keyed by username, where each value is a user record with fields for username, groups, admin, disabled, mpasswdreset, and more. Add a transformer to convert this object format (keyed by username) into an array of rows suitable for a Retool Table. To get security score data, create a second query named 'getSecurityScores' also POSTing to /enterpriseapi.php with the 'getuserdata' command plus the 'data' parameter set to 'securityemail,score' to request security-related fields. Note: Security score data may require the LastPass Reporting API at a different endpoint depending on your plan.

1// Request body for getUsers query (POST to /enterpriseapi.php)
2{
3  "apiuser": "{{ retoolContext.configVars.LASTPASS_ACCOUNT_NUMBER }}",
4  "apikey": "{{ retoolContext.configVars.LASTPASS_PROVISIONING_HASH }}",
5  "cmd": "getuserdata",
6  "data": {
7    "pagesize": 1000,
8    "pagenum": 0
9  }
10}

In the app canvas, add a stat row at the top with three Statistic components: Total Users (COUNT of users from getUsers.data), Users with Score Below 50 (filtered count), and Average Security Score (computed from transformer). Below the stats, add filter controls: a Text Input for username/email search and a Number Range Slider for security score filtering (0-100). Add a Table component bound to {{ getUsers.data }} with columns for username, email, groups (displayed as a comma-joined string), security_score (with conditional formatting — red for <50, yellow for 50-75, green for >75), disabled status, and last_login. Create a query named 'updateUser' with POST method, Path /enterpriseapi.php, and Body Type JSON. The body should use the 'editusergroups' or 'disableuser' command depending on the selected action. Add an action panel below the table with: a 'Disable User' button (triggers 'disableuser' command with { username: selectedRow.username }) and a 'Reset Master Password' button (triggers 'resetpassword' command). Both should have Confirm Modal dialogs before executing. Create a second query named 'getGroups' using the 'getgroupdata' command to list all LastPass groups — use this to populate a group assignment Select component in the user detail panel.

1// Transformer: convert LastPass Users object to array
2const usersObj = data.Users || {};
3return Object.entries(usersObj).map(([username, user]) => ({
4  username: username,
5  email: user.username || username,
6  fullname: user.fullname || '',
7  groups: Array.isArray(user.groups) ? user.groups.join(', ') : '',
8  admin: user.admin === '1' ? 'Yes' : 'No',
9  disabled: user.disabled === '1' ? 'Disabled' : 'Active',
10  security_score: user.score ? parseInt(user.score) : null,
11  created: user.created || '',
12  last_login: user.last_login || 'Never'
13}));

Create a query named 'getSharedFolders' using the 'getsfdata' command in a POST to /enterpriseapi.php — this returns all shared folders (shared credential groups) in your LastPass Enterprise account with their names, members, and access levels. Add a transformer to flatten the shared folder data into rows: each shared folder becomes a row with name, member_count, hidden status, and the list of member usernames. Create a detail panel for selected shared folders that shows the full member list with their access level (can_administer, read_only, give). Add a 'Remove from Folder' button per member that triggers a POST with the 'updatesharedfolderusers' command to revoke access. Create a third query named 'getGroupData' using the 'getgroupdata' command to list all LastPass groups (these are different from shared folders — groups organize users while shared folders store credentials). Build a Tab component with three tabs: Users (main security dashboard), Shared Folders (access audit), and Groups (group management). For the Groups tab, show a Table of all groups with member counts and add a group membership editor that allows adding or removing users from groups using the 'adduserstogroup' and 'deleteusersfromgroup' commands. For complex security compliance reporting combining LastPass data with your HRIS, Active Directory, or identity provider, RapidDev's team can help architect your Retool security operations solution.

1// Request body for getSharedFolders query
2{
3  "apiuser": "{{ retoolContext.configVars.LASTPASS_ACCOUNT_NUMBER }}",
4  "apikey": "{{ retoolContext.configVars.LASTPASS_PROVISIONING_HASH }}",
5  "cmd": "getsfdata"
6}