monday.com

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the items, column values and updates on the monday.com boards you name, so delivery agents can answer from the project’s own tracker. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	monday.com, version 1.0.0
Reads	monday.com: monday.com platform API (GraphQL) (the vendor's documentation)
Family	Engineering
Kind	Work management
Ways to connect	Access token
Scopes	Read:
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	Contact, Content
Hosts it may contact	api.monday.com
Vendor API versions	GraphQL API 2025-04
Lowest engine version	0.46.0

What it reads

• For each board you name, every item: its name, group, board name, each column’s title and text value, and the latest updates (text, date, author name; updates, default 20, at most 100).
• Only the boards you name, by id. A whole account is never the default.
• Each board is read whole on every pull; only what changed is written. monday.com’s API cannot filter items by the time they changed, so the collector reads the board in pages of 100 (items_page, then next_items_page by cursor) and emits an item only when its updated_at is newer than the board’s cursor. An unchanged board writes nothing.

It does not read other boards, users, files or documents.

How to connect

1. In monday.com, make an API token: a person’s own, or better one made for an integration account added only to the boards you will name.
2. In LightHouse, open Setup and admin, Connectors, choose monday.com, and give the board ids.
3. Paste the token. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (MONDAY_CREDENTIAL by default) with one field, token.

Permissions

• monday.com does not state a token’s permissions: a token carries its user’s, which is why the boards are named and the account should see no more than them. Give the integration account viewer access to those boards only.
• What the collector does: monday.com’s API is GraphQL over POST, so every request is a POST to /v2, but the collector sends query documents only: its two queries are fixed text in the source, and none is a mutation. Its read-only test asserts that every request body is a query and none contains mutation.
• One host: api.monday.com for every request.

Limits

• GraphQL API version 2025-04.
• Pages of 1 to 500 items (page_size, default 100).
• Because each board is read whole, a very large board costs a full read on every pull. The cost is monday.com’s complexity budget, not a write.
• The rate limit is a complexity budget. A query over budget answers with a ComplexityException (or 429) naming the seconds until it resets; the pull waits that long (at most a minute, three times) and asks again, and fails rather than return part of a board.
• A full read is also the deletion check: an item no longer on the board is removed from the corpus on the same pull.

Data handling

• Items and updates name people and may hold personal data in their text. Documents carry the label you give the source.
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.
• An error from monday.com is reported by its code only, never its message.

Troubleshooting

What you see	What it means	What to do
credential variable 'MONDAY_CREDENTIAL' is not set	The deployment holds no credential for this source	Connect monday.com again in LightHouse
name the boards to sync; a whole account is never the default	No board ids were given	Name the boards
not monday.com board ids: [...]	A board id is not numeric	Use the number in the board’s address
monday.com board 123 is not visible to this token	The token’s user cannot see the board	Add the integration account to the board
monday.com refused the query: ...	monday.com answered an error (its code is shown)	Check the token and the code in monday.com’s reference
monday.com's complexity budget did not reset in time	The account is over its budget	Wait for the next run, or read fewer boards

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	GraphQL API 2025-04	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only