Connect LastPass

LastPass is a password manager for businesses and MSPs. StackJack connects to two LastPass admin APIs, and one LastPass connection can hold either one or both:

• The LastPass API, for users, admin levels and, on an MSP account, the companies you manage with their users, admin levels, billing cycles and billing reports. LastPass offers it in early access.
• The Enterprise API, for one LastPass Business account's user provisioning, groups, shared folders, events, and multifactor, password and session actions.

Connecting LastPass to StackJack gives your AI assistant a family of lastpass_ MCP tools; the Enterprise API's tools start with lastpass_enterprise_. MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. With them, your AI can:

• Look up people - the users of your company or of a managed company, with their account status, and one user's details
• Review admin access - the admin levels with their permissions, who holds each one, and the admin users across every company you manage
• Oversee managed companies (MSP accounts) - every managed company with its licence limit, status, type and add-ons, plus billing cycles and billing reports
• Read the Enterprise account - users with their groups and status, shared folders with their permissions, and the event log
• Make changes (on Pro plans) - create, invite, rename and delete users, grant and remove admin levels, create and change managed companies, provision users, change group memberships, and run multifactor, password and session actions

StackJack never reads vault contents: neither LastPass API returns stored passwords.

How StackJack authenticates to LastPass

Each API has its own credential. Set up the one you use, or both.

The LastPass API key

The LastPass API uses an API key that starts with lpkey_.

1. Request early access: the LastPass API is in early access, so submit LastPass's API early-access form and wait for LastPass to confirm that the API is enabled for your account. You need a LastPass Business, Business Max or MSP account.
2. Sign in to the LastPass Admin Console.
3. Go to Advanced, then LastPass API, and generate a key. It starts with lpkey_.
4. Copy the key. Treat it like a password: LastPass shows it once.

The Enterprise API account number and provisioning hash

The Enterprise API uses your account number (CID) and a provisioning hash.

1. Sign in to the LastPass Admin Console.
2. Go to Advanced, then Enterprise API.
3. Copy your account number (CID), and create or copy the provisioning hash.

Connect it in StackJack

1. Open Connectors, then LastPass.
2. Paste the API key into API Key, fill in the Account number (CID) and Provisioning hash, or do both.
3. Click Test connection. StackJack checks each API you filled in by reading one user, and changes nothing.

When you edit the connection later, the key and the hash boxes start empty: leaving them empty keeps what is stored. To stop using one of the APIs, tick its Remove box; a connection has to keep at least one.

What is worth knowing before you start

Using one API or both

Tools for an API you did not set up tell you which credential to add, and send nothing to LastPass. Both APIs share one connection, and one on/off state: if LastPass keeps rejecting either credential, three failed checks switch off the whole connection, the other API included. Fix or remove the failing credential, or keep each API on its own named connection.

Until LastPass enables the LastPass API for your account, the connection test reports that the key was not allowed, without counting it against the connection, and the Enterprise API keeps working.

What is marked destructive

These actions reach a person, change who can sign in or what they can reach, or remove something, so they ask for approval before they run:

• Creating, inviting and deleting users, and reinviting, enabling, disabling and deleting them through the Enterprise API
• Adding users to an admin level and removing them from one
• Provisioning users, changing a user's details or login email, and changing group memberships (a group grants access to its shared folders)
• Turning off a user's multifactor authentication, sending a password reset email, requiring a master password change, and ending a user's sessions
• Creating, replacing, updating and detaching managed companies

Renaming a user is not marked destructive: it changes nothing but the display name.

Managed company changes and billing

Creating, replacing or updating a managed company changes what LastPass bills your MSP: a company whose status is active is billed at the end of the month, a suspended one is not, and add-ons and licence limits change the bill. LastPass applies these changes asynchronously and answers at once, so read the company back to see the result. Replacing a company's settings sets every one of them: a licence limit left out becomes unlimited, and the add-ons you give replace the current ones.

Deleting a user through the Enterprise API

The Enterprise API removes a user in one of three ways: deactivating the account (sign-in is blocked, the data and the membership stay), removing the user from your LastPass Business account (the account itself stays active), or deleting the account entirely, which cannot be undone.

When LastPass refuses a call

• The API key is rejected: the key is wrong or was deleted. Generate a new one under Advanced, then LastPass API, and paste it in.
• The subscription has expired: the key is fine, but LastPass answers this way when the account's subscription has ended. Renew it, then test the connection.
• The key is not allowed this action: the LastPass API's early access may not be enabled yet, or the admin who made the key lacks the permission. MSP tools need an MSP account.
• The account number and provisioning hash are refused: check the account number under Advanced, then Enterprise API, set a new provisioning hash, and paste both in.
• The Enterprise API refuses a request: StackJack shows LastPass's reason, such as a user that does not exist. That is about the request, not the connection.

Paging through results

LastPass API lists return a page at a time, up to 500 items for users and managed companies and up to 50 for admin levels and billing reports, with a token for the next page. The Enterprise API reads users a page at a time (up to 2,000) and events up to 10,000 at a time, with a marker for the next batch. Event times are in Europe/Dublin time.

Plans and limits

Read tools are available on the Free tier. Everything that creates, changes or deletes is Pro. Business reaches the same tools as Pro and differs by monthly call quota. LastPass publishes no rate limit for either API, so StackJack paces its requests and backs off when LastPass asks it to.

See the generated LastPass tool reference for the current inventory, plan assignment, input schemas, and destructive-action labels.

LastPass tools

lastpass_ · 47 tools · Free 19 · Pro 28

Users

Admin levels

Managed companies

Managed company users

Managed company admin levels

Managed company reports

Enterprise users

Enterprise security actions

Enterprise groups and folders

Enterprise reporting