Retool

Probo reads your Retool organization’s users through the Retool API so you can review who has access.

Caution

Use an API access token carrying the Users > Read scope, created under Settings > Retool API. A token without that scope authenticates and is then refused on the users endpoint, because Retool checks scopes per endpoint rather than per token, and it names the missing scope when it refuses.

Retool gates that scope behind its Enterprise plan. Its pricing page gives Business “limited access” to the platform APIs and reserves “full access to all API scopes” for Enterprise, and the token dialog bears that out: neither Team nor Business lists a Users scope at all. On those plans no token can read the roster and this connector cannot be used.

Prerequisites

• Probo organization administrator access
• A Retool organization admin account. Only organization admins can create API access tokens
• A Retool Enterprise plan. The Users scope this connector needs is absent from the token dialog on Team and on Business, so confirm the dialog offers it before going further
• An access token granted the Users > Read scope. Scopes are chosen when the token is created and cannot be changed afterwards, since the only action Retool offers on an existing token is deleting it
• Self-hosted only: the Base URL of your Retool instance. Retool Cloud customers leave this empty, because a cloud token already identifies the organization it belongs to

Collected Fields

Probo field	Retool field	Notes
Name	first_name, last_name	Either may be empty. A user with neither is listed under their email address
Email	email
Role	is_admin, seat_type, user_type	Three separate things a reviewer acts on differently, so each is listed on its own: Admin for an organization admin, the seat (Builder, Internal User, External User), and the account kind when it is not the ordinary one (Mobile, Embed)
Admin	is_admin	Flagged when Retool reports the user as an organization admin
Status	active	A deactivated user is listed as inactive
MFA	two_factor_auth_enabled	Retool reports this for every user, so a Retool campaign always shows whether two-factor authentication is on
Last login	last_active	Empty for a user who has never signed in
External ID	id	Stable identifier used to track the account across reviews
Created at	created_at	When the user was created in the organization

Group membership comes from a separate Retool endpoint and is not part of the roster. A Retool campaign therefore covers organization-level access, not per-app permissions.

Step 1: Create an API Access Token

1. In Retool, signed in as an organization admin, go to Settings > Retool API.
2. Click Create new and name the token, for example Probo Access Review.
3. Under scopes, select Users > Read. If the dialog offers no Users scope, the organization is not on Enterprise and the connector cannot read its roster.
4. Copy the token and store it securely. Retool shows it only once, and the scopes cannot be changed later.

Step 2: Connect in Probo

1. In Probo, go to Access Review > Connections.
2. Find Retool, click API Key, and paste the token.
3. On Retool Cloud, leave Base URL (leave empty for Retool Cloud) empty. On a self-hosted instance, enter the address you use to reach Retool, for example https://retool.example.com.
4. Click Connect.

Probo pulls your Retool users into your campaigns.

Troubleshooting

• Key rejected. Confirm the token was copied whole and has not been revoked.
• The token dialog offers no Users scope. The scope is Enterprise only. A Team plan offers Retool RPC and Custom Component Libraries; Business adds Apps, User Invites and User Attributes. None of those reads the roster, and a token created on Business with every scope selected is still refused with missing one of "users:read". No other endpoint substitutes either: /user_invites returns invitations rather than current members, and the usage endpoints need a usage scope that dialog does not offer. Until the organization is on Enterprise, use a CSV source.
• No members appear. The token needs the Users > Read scope. Retool names the missing scope when it refuses, and a token’s scopes cannot be edited, so create a new token that carries it.
• Self-hosted instance does not connect. Probo calls the Base URL from its own infrastructure, so it cannot reach an instance that is only available on a private network. Self-hosted Retool serves the API from version 3.18 onward.