# monday.com > monday.com: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the items, column values and updates on the monday.com boards you name, so delivery agents can answer from the project’s own tracker. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse. ## At a glance | Collector | monday.com, version `1.0.0` | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | Reads | monday.com: monday.com platform API (GraphQL) ([the vendor's documentation](https://developer.monday.com/api-reference/docs)) | | Family | Engineering | | Kind | Work management | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | Contact, Content | | Hosts it may contact | `api.monday.com` | | Vendor API versions | GraphQL API 2025-04 | | Lowest engine version | `0.46.0` | ## What it reads - For each board you name, every item: its name, group, board name, each column’s title and text value, and the latest updates (text, date, author name; `updates`, default 20, at most 100). - Only the boards you name, by id. A whole account is never the default. - **Each board is read whole on every pull; only what changed is written.** monday.com’s API cannot filter items by the time they changed, so the collector reads the board in pages of 100 (`items_page`, then `next_items_page` by cursor) and emits an item only when its `updated_at` is newer than the board’s cursor. An unchanged board writes nothing. It does not read other boards, users, files or documents. ## How to connect 1. In monday.com, make an API token: a person’s own, or better one made for an integration account added only to the boards you will name. 2. In LightHouse, open **Setup and admin, Connectors**, choose **monday.com**, and give the board ids. 3. Paste the token. Your browser seals it to your deployment; LightHouse never sees it. The credential is JSON in the variable the source names (`MONDAY_CREDENTIAL` by default) with one field, `token`. ## Permissions - monday.com does not state a token’s permissions: a token carries **its user’s**, which is why the boards are named and the account should see no more than them. Give the integration account viewer access to those boards only. - **What the collector does:** monday.com’s API is GraphQL over `POST`, so every request is a `POST` to `/v2`, but the collector sends **query documents only**: its two queries are fixed text in the source, and none is a mutation. Its read-only test asserts that every request body is a `query` and none contains `mutation`. - **One host:** `api.monday.com` for every request. ## Limits - GraphQL API version `2025-04`. - Pages of 1 to 500 items (`page_size`, default 100). - Because each board is read whole, a very large board costs a full read on every pull. The cost is monday.com’s complexity budget, not a write. - **The rate limit is a complexity budget.** A query over budget answers with a `ComplexityException` (or 429) naming the seconds until it resets; the pull waits that long (at most a minute, three times) and asks again, and fails rather than return part of a board. - A full read is also the deletion check: an item no longer on the board is removed from the corpus on the same pull. ## Data handling - Items and updates name people and may hold personal data in their text. Documents carry the `label` you give the source. - Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential. - The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served. - An error from monday.com is reported by its code only, never its message. ## Troubleshooting | What you see | What it means | What to do | | --------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------------ | | `credential variable 'MONDAY_CREDENTIAL' is not set` | The deployment holds no credential for this source | Connect monday.com again in LightHouse | | `name the boards to sync; a whole account is never the default` | No board ids were given | Name the boards | | `not monday.com board ids: [...]` | A board id is not numeric | Use the number in the board’s address | | `monday.com board 123 is not visible to this token` | The token’s user cannot see the board | Add the integration account to the board | | `monday.com refused the query: ...` | monday.com answered an error (its code is shown) | Check the token and the code in monday.com’s reference | | `monday.com's complexity budget did not reset in time` | The account is over its budget | Wait for the next run, or read fewer boards | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | GraphQL API 2025-04 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/monday/