# Dotfile

the platform reads your Dotfile workspace's members through the Dotfile API so you can review who has access.

:::caution
Use a workspace API key created by a workspace **admin**. A Dotfile API key is workspace wide and Dotfile documents no scopes or permissions on it, so any workspace API key can call the users endpoint. Dotfile hashes and encrypts the key, so copy it when you create it. You cannot recover a lost key and will have to generate a new one.
:::

## Prerequisites

- the platform organization administrator access
- The **admin** role in the Dotfile workspace (Dotfile requires you to be an admin of the workspace to generate API keys)

## Collected Fields

| the platform field | Dotfile field                                            | Notes                                                         |
| ----------- | -------------------------------------------------------- | ------------------------------------------------------------- |
| Name        | `first_name` and `last_name`                             | Falls back to the email address                               |
| Email       | `email`                                                  |                                                               |
| Role        | `role`                                                   | `owner`, `admin`, `member`, or the name of a custom role      |
| Admin       | `role`                                                   | Flagged as an administrator when `role` is `owner` or `admin` |
| Status      | `suspended_at`                                           | Inactive once a suspension timestamp is set                   |
| MFA         |  |                                                               |
| Last login  |  |                                                               |
| External ID | `id`                                                     | Stable identifier used to track the account across reviews    |
| Created at  | `created_at`                                             | When the user was created in the workspace                    |

the platform requests suspended users as well as active ones, so a suspended member still appears in the campaign, marked inactive.

## Step 1: Create an API Key

1. In the [Dotfile console](https://app.dotfile.com), signed in as a workspace **admin**, go to **Workspace settings** > **API keys**.
2. Create a new key and give it a name (e.g. `Probo Access Review`). Dotfile documents no scope or permission to set on a key.
3. Copy the key and store it securely (password manager, secret manager). Dotfile hashes and encrypts it, so you cannot read it again.

## Step 2: Connect in the platform

1. In the platform, go to **Access Reviews** > **Sources** > **Add Source**.
2. Find **Dotfile**, click **API Key**, paste the key, and click **Connect**.

the platform names the source after your Dotfile workspace and pulls its members into your campaigns.

## Troubleshooting

- **Key rejected.** Confirm a workspace admin generated the key and that it has not been replaced since. the platform sends it in the `X-DOTFILE-API-KEY` header, so a key from a different workspace will not authenticate.
- **No members appear.** An API key is workspace wide, so check that it belongs to the workspace you intend to review.