> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Cursor connector

> C1 provides identity governance for Cursor. Integrate your Cursor instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.

<Warning>
  The Cursor connector requires the Cursor **Enterprise** plan. The Admin API used by this connector is only available to Enterprise teams. Teams on the Business plan do not have access to the Admin API and cannot use this connector.
</Warning>

## Capabilities

The Cursor connector syncs the following resources:

| Resource | Sync                                                          | Provision                                                                                |
| :------- | :------------------------------------------------------------ | :--------------------------------------------------------------------------------------- |
| Account  | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> Create and delete via SCIM |
| Role     | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                                                          |

**Notes:**

* The connector syncs team members and their assigned roles (Owner, Member, Free Owner).
* Account provisioning (create and delete) is supported when SCIM is configured. New users are created in the identity provider and appear in Cursor after their first login. Deleting an account removes the user from the identity provider via SCIM, which triggers Cursor to deactivate the member on its next sync.
* Delete only works for SCIM-managed users. Members added directly in the Cursor dashboard (not through an IdP) cannot be removed by this connector.
* Role assignment provisioning is not supported. Cursor does not expose an API for changing user roles.

## Prerequisites

Before setting up the Cursor connector, confirm the following:

* Your Cursor team is on the **Enterprise** plan. The Admin API is not available on Business or other plans.
* You have the **administrator** role in your Cursor team. Only administrators can create API keys.
* **(Optional, for account provisioning)** SSO is enabled and SCIM is configured in your Cursor team. See the [Cursor SCIM documentation](https://cursor.com/docs/account/teams/scim) for setup guidance.

## Gather Cursor credentials

<Warning>
  To configure the Cursor connector, you need **administrator** permissions in your Cursor team.
</Warning>

<Steps>
  <Step>
    Log in to the [Cursor dashboard](https://cursor.com/dashboard).
  </Step>

  <Step>
    Navigate to **Settings** > **Advanced** > **Admin API Keys**.
  </Step>

  <Step>
    Click **Create New API Key** and provide a descriptive name (for example, `C1`).
  </Step>

  <Step>
    Copy the generated API key and save it securely. The key follows the format `key_` followed by a 64-character string. You cannot retrieve the key after leaving the page.
  </Step>
</Steps>

For more information, see the [Cursor Admin API documentation](https://cursor.com/docs/account/teams/admin-api).

### SCIM credentials (optional, for account provisioning)

If you want to enable account provisioning (create and delete users), you also need SCIM credentials:

<Steps>
  <Step>
    In the Cursor dashboard, navigate to **Settings** > **Advanced** > **SCIM**.
  </Step>

  <Step>
    Copy the **SCIM endpoint URL** and **SCIM bearer token**. You need both to configure account provisioning in the connector.
  </Step>
</Steps>

For more information, see the [Cursor SCIM documentation](https://cursor.com/docs/account/teams/scim).

## Configure the Cursor connector

<Warning>
  To complete this task, you need:

  * The **Connector Administrator** or **Super Administrator** role in C1
  * The Cursor API key gathered in the previous section
</Warning>

<Tabs>
  <Tab title="Cloud-hosted">
    **Follow these instructions to use a built-in, no-code connector hosted by C1.**

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Cursor** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Cursor connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
        * Add the connector to a managed app (select from the list of existing managed apps)
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter your Cursor API key in the **API Key** field.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Cursor connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    **Follow these instructions to use the Cursor connector, hosted and run in your own environment.**

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.
    This data is immediately available in the C1 UI for access reviews and access requests.

    ### Step 1: Set up a new Cursor connector

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Cursor connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
        * Add the connector to a managed app (select from the list of existing managed apps)
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials. You need them in Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Cursor connector deployment:

    #### Secrets configuration

    ```yaml theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-cursor-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-cursor-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # Cursor config
      BATON_CURSOR_API_KEY: <Cursor API key>

      # Optional: SCIM config (for account provisioning)
      BATON_CURSOR_SCIM_ENDPOINT: <Cursor SCIM endpoint URL>
      BATON_CURSOR_SCIM_TOKEN: <Cursor SCIM bearer token>

      # Optional: include if you want C1 to provision access using this connector
      BATON_PROVISIONING: true
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-cursor.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-cursor
      labels:
        app: baton-cursor
    spec:
      selector:
        matchLabels:
          app: baton-cursor
      template:
        metadata:
          labels:
            app: baton-cursor
            baton: true
            baton-app: cursor
        spec:
          containers:
          - name: baton-cursor
            image: ghcr.io/conductorone/baton-cursor:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-cursor
            envFrom:
            - secretRef:
                name: baton-cursor-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Cursor connector to. Cursor data should be found on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Cursor connector is now pulling access data into C1.
  </Tab>
</Tabs>

## Known limitations

* **Enterprise plan required.** The Cursor Admin API is only available on Enterprise plans. Teams on the Business plan cannot use this connector.
* **No role management API.** Cursor does not expose an API for changing user roles. Role assignments are synced for visibility only.
* **SCIM requires Enterprise and SSO.** Account provisioning (create and delete) requires SCIM, which is only available on Enterprise plans with SSO enabled. Without SCIM credentials, the connector operates in sync-only mode.
* **Delete is SCIM-only.** Account deletion removes users from the identity provider via SCIM. Members added directly in the Cursor dashboard (not through an IdP) cannot be removed by this connector.