> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-api-common-tasks-cookbook.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Monday.com connector

> C1 provides identity governance and just-in-time provisioning for Monday.com. Integrate your Monday.com instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.

## Capabilities

| Resource  | Sync                                                          | Provision                                                     | Delete                                                        |
| :-------- | :------------------------------------------------------------ | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Account   | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                               |
| Role      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                               |
| Team      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Board     | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                               | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Workspace | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                               | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

**Additional functionality:**

<Icon icon="square-check" iconType="solid" color="#c937ae" /> Supports [automatic account provisioning](/product/admin/account-provisioning) <br />
<Icon icon="square-check" iconType="solid" color="#c937ae" /> Supports account lifecycle actions (enable and disable user) <br />
<Icon icon="square-check" iconType="solid" color="#c937ae" /> Supports resource create for teams, boards, and workspaces <br />

Monday.com does not expose a hard delete for human users. Use the **Disable User** connector action to deactivate accounts.

Board and workspace owner/subscriber entitlements are synced for access reviews but are not provisioned by this connector. Boards sync nested under their workspace when `workspace_id` is present; otherwise they sync at the top level. Board and workspace delete are not implemented by this connector.

### Connector actions

| Action       | Description                                                                         |
| :----------- | :---------------------------------------------------------------------------------- |
| Enable User  | Reactivates a previously deactivated user via the `activate_users` GraphQL mutation |
| Disable User | Deactivates (soft-disables) a user via the `deactivate_users` GraphQL mutation      |

### User states and provisioning

Monday.com users keep the same ID from invitation through deactivation. The connector maps each lifecycle state to a C1 account status and blocks unsupported operations with clear errors.

**How users appear in C1 after sync:**

| User state                        | C1 account status | Included in sync |
| :-------------------------------- | :---------------- | :--------------- |
| Pending invite (not yet accepted) | Disabled          | Yes              |
| Active member                     | Enabled           | Yes              |
| Deactivated (soft-disabled)       | Disabled          | Yes              |

**What each state supports:**

| Operation               | Pending invite                              | Active                               | Deactivated                               |
| :---------------------- | :------------------------------------------ | :----------------------------------- | :---------------------------------------- |
| Team member grant       | Supported                                   | Supported                            | Not supported — run **Enable User** first |
| Team member revoke      | Supported                                   | Supported                            | Supported                                 |
| Role grant / revoke     | Supported                                   | Supported                            | Supported                                 |
| **Enable User** action  | Not supported — invitation not accepted yet | Idempotent success if already active | Supported                                 |
| **Disable User** action | Not supported — invitation not accepted yet | Supported                            | Idempotent success if already disabled    |

Pending invites can still receive team and role entitlements because Monday.com accepts those changes before the user accepts the invitation. Team grants on deactivated users are blocked before the API call; role grants on deactivated users remain supported because Monday.com accepts them.

### Provisioned entitlements

| Resource | Entitlement | Operation                                                                          |
| :------- | :---------- | :--------------------------------------------------------------------------------- |
| Role     | Assigned    | Grant or revoke a user's account-level base role (Admin, Member, View Only, Guest) |
| Team     | Team Member | Add or remove a user from a team                                                   |

### Resource create

| Resource  | Operation                                                      |
| :-------- | :------------------------------------------------------------- |
| Team      | Create a team (`create_team`) or delete a team (`delete_team`) |
| Board     | Create a board in a workspace (`create_board`)                 |
| Workspace | Create a workspace (`create_workspace`)                        |

## Gather Monday.com credentials

<Warning>
  To generate credentials, you'll need a user with the **Admin** role in Monday.com.
</Warning>

Configuring the connector requires you to pass in information from Monday.com. Gather these configuration details before you move on.

Here's the information you'll need:

* An API key generated from **Developers** > **My Access Tokens** in Monday.com

See the Monday.com docs for information on how to acquire credentials: [View the documentation](https://developer.monday.com/api-reference/docs/authentication)

**Done.** Next, move on to the connector configuration instructions.

## Configure the Monday.com connector

<Warning>
  To complete this task, you'll need:

  * The **Connector Administrator** or **Super Administrator** role in C1
  * Access to the set of Monday.com configuration information gathered by following the instructions above
</Warning>

<Tabs>
  <Tab title="Cloud-hosted">
    **Follow these instructions to use a built-in, no-code connector hosted by C1.**

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Monday.com** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Monday.com connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

        * Add the connector to a managed app (select from the list of existing managed apps)

        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the configuration information from the previous section.

        * **monday-api-key** (required): API Key for Monday
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Monday.com connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    **Follow these instructions to use the Monday.com connector, hosted and run in your own environment.**

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

    ### Resources

    [Contact C1's support team](mailto:support@conductorone.com) to download the latest version of the connector.

    ### Step 1: Set up a new Monday.com connector

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Monday.com connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

        * Add the connector to a managed app (select from the list of existing managed apps)

        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials. We'll use them in Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Monday.com connector deployment:

    #### Secrets configuration

    ```yaml expandable theme={null}
    # baton-monday-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-monday-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # Monday.com config
      BATON_MONDAY_API_KEY: <API Key for Monday>

      # Optional: include if you want C1 to provision access using this connector
      BATON_PROVISIONING: true
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={null}
    # baton-monday.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-monday
      labels:
        app: baton-monday
    spec:
      selector:
        matchLabels:
          app: baton-monday
      template:
        metadata:
          labels:
            app: baton-monday
            baton: true
            baton-app: monday
        spec:
          containers:
          - name: baton-monday
            image: ghcr.io/conductorone/baton-monday:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-monday
            envFrom:
            - secretRef:
                name: baton-monday-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Monday.com connector to. Monday.com data should be found on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Monday.com connector is now pulling access data into C1.
  </Tab>
</Tabs>