Skip to main content
This doc covers the Enterprise-plan Monday.com connector. The tile reads “Monday (Enterprise)”. The Enterprise plan is required. For non-Enterprise plans, use Monday.com (Basic).

​
After this article

You’ll be able to connect the Enterprise Monday.com integration to Lumos, sync users, teams, roles, and team memberships, and provision or deprovision users through the SCIM API.

​
Capabilities

Provisioning behavior:
  • Create: Lumos creates the user through SCIM (POST /Users) with the email as the username plus the given and family name. All three fields are required. New users are created active. Roles and team memberships can’t be included in the create request, so Lumos assigns them afterward.
  • Assign a role: Lumos replaces the user’s userType with the requested role (admin, member, viewer, or guest). A user holds exactly one role, so assigning a role replaces the previous one, and a role can’t be unassigned on its own.
  • Team membership: Lumos adds the user to a team with a SCIM add operation on the group, and removes them with a remove operation.
  • Deactivate and reactivate: Lumos flips the SCIM active flag, so reactivating a deactivated account is supported.
User status mapping The user sync includes inactive users, so deactivated accounts stay visible in Lumos as Suspended. Activity tracking: supported (Last Activity and Last Login). Lumos reads last activity from the GraphQL users query, and last login events from the audit_logs query. The audit_logs query requires the Personal API Token account to have the manage_account_security permission.

​
Required plan and roles

  • Monday.com plan: the Enterprise plan is required.
  • Monday.com role: you must be an organizational admin to complete the steps below.
  • Permission scoping: this integration can’t be scoped to read-only. It needs full provisioning access to work.
  • Connection fields: Lumos needs a Bearer Token (SCIM Secret Token), your subdomain, and a Personal API Token.

​
Instructions

Phase 1: Generate the Bearer Token in Monday.com
  1. Log in to your Monday.com account.
  2. Click your profile picture in the left navigation pane.
  3. Navigate to Admin > Security.
  4. Under the Login tab, select Open in the SCIM section.
  5. Click Generate to create a new Secret Token. This is your Bearer Token.
Phase 2: Find your subdomain
  1. Look at your Monday.com URL. The subdomain is the part before .monday.com.
  2. For example, if your URL is https://yourcompany.monday.com, the subdomain is yourcompany.
Phase 3: Generate the Personal API Token
  1. Make sure you have the manage_account_security permission enabled on your account. Lumos needs it to read login events for activity tracking.
  2. Click the menu icon next to your profile picture in the top right corner.
  3. Navigate to Admin > Connections > Personal API token and generate your token.
Phase 4: Connect in Lumos
  1. Search for Monday.com (Enterprise) in Lumos.
  2. Gather all fields and enter them into Lumos.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Authentication fails when connecting. The Bearer Token and the Personal API Token are different credentials from different admin pages. Confirm the Bearer Token is the SCIM Secret Token from Admin > Security > SCIM, the Personal API Token comes from Admin > Connections, the subdomain matches your Monday.com URL, and neither token has been regenerated since you copied it. Last login data is missing. The audit_logs query only works when the account that generated the Personal API Token has the manage_account_security permission. Enable it and reconnect. Creating a user fails. SCIM user creation requires an email, a given name, and a family name. All three are mandatory. A role can’t be removed from a user. This is expected. Every user holds exactly one account role, so Lumos can only replace a role with another one, not remove it. Deactivated users still appear in Lumos. This is expected. The sync includes inactive users and maps them to the Suspended status, which keeps them visible for Access Reviews and reactivation.