baton-rpa: Browser automation integration

Baton RPA is a connector framework, not a connector for a single application. It syncs identity and access data from web applications that expose no IAM API — the data is read from the application’s web UI, driven by a declarative YAML playbook. Each application gets its own playbook, and production connectors typically embed Baton RPA as a library rather than running this binary directly.If you are setting up a specific application, use that application’s connector page. This page documents the framework itself.

Capabilities

Baton RPA declares no compiled-in resource types. The resource types it syncs are defined by the playbook passed to the connector, so its capabilities are determined per playbook rather than per build. A playbook can map extracted data to any of the following resource types:

Resource	Sync	Provision
Accounts
Groups
Roles
Apps

Notes:

Baton RPA is sync-only. It does not provision or deprovision access, and it does not support account provisioning.
Which of the resource types above appear in a given sync depends entirely on the playbook. A playbook that only lists users produces accounts and nothing else.
Entitlements and grants are produced from the playbook’s grant extraction and CEL mappings.

Understanding playbooks

A playbook is a YAML file that tells the connector how to authenticate to the application and how to extract each resource type. It has two parts:

connect: the login flow (password, SSO, TOTP) and browser settings. Baton RPA signs in once, then reuses the session.
resource_types: for each resource type, how to reach the data and how to map it to C1 resources using CEL expressions.

Extraction uses one of three strategies, chosen per resource type:

Strategy	When to use	Browser exposure
Browser auth plus HTTP	The application is a single-page app with discoverable API endpoints. This is the recommended strategy.	Login only
DOM scraping	The application is a server-rendered admin panel with no usable endpoints.	The entire sync
JavaScript extraction	The application holds its data in client-side state with no REST API.	Page load and script execution

For the complete YAML syntax, see the Playbook Reference.

Gather application credentials

The credentials Baton RPA needs are the credentials of a user who can sign in to the target application’s web UI and see its administrative pages. Grant that account the least privilege that still lets it view the user, group, and role lists you want to sync.

Create or identify a dedicated service account in the target application.Use a dedicated account rather than a person’s account. The connector signs in as this account on every sync, and a person’s account can be disabled, rotated, or challenged by step-up authentication without warning.

Grant the account read access to the administrative pages that list the data you want to sync — typically the users, groups, and roles pages.

Record the sign-in credentials the playbook’s login flow needs. This varies by application, but is usually a username and password, plus a TOTP secret if the application enforces multi-factor authentication.

Have each credential ready to supply to the connector. The playbook references credentials by name, and the connector refuses to start if a referenced one is unset. A cloud-hosted connector takes them in the C1 connector configuration; a self-hosted connector takes them as environment variables with a BATON_ prefix.

Configure the Baton RPA connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.A cloud-hosted Baton RPA connector runs inside C1 and drives a browser hosted on AWS Bedrock AgentCore, so there is no Chromium or other infrastructure for you to run.

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton RPA and click Add.

Choose how to set up the new connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.

Click Next.

Upload your playbook YAML file to the connector’s configuration.

Fill in the credentials the playbook references, such as the service account’s username and password. C1 stores them encrypted and supplies them to the playbook at sync time.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Baton RPA connector is now pulling access data into C1.

Follow these instructions to use the Baton RPA connector, hosted and run in your own environment.When running in service mode, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Step 1: Set up a new connector in C1

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Click Next.

Upload your playbook YAML file to the connector’s configuration.

Fill in the credentials the playbook references, such as the service account’s username and password.

Step 2: Write the playbook

Write a YAML playbook for the target application and make it available to the connector — mounted from a config map, baked into your image, or written to disk by your deployment.

Validate the playbook before deploying it:

baton-rpa --config-path playbook.yaml
baton resources -f sync.c1z
baton grants -f sync.c1z

Step 3: Configure the connector

Enter the required configuration:

config-path (required): Path to the Baton RPA YAML playbook configuration file. Environment variable: BATON_CONFIG_PATH.
enable-agent-core: Run the playbook against the AWS Bedrock AgentCore remote browser instead of launching Chromium locally. Environment variable: BATON_ENABLE_AGENT_CORE.

Any variables the playbook references are supplied as additional BATON_-prefixed environment variables.

Step 4: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Baton RPA connector deployment:

Secrets configuration

# baton-rpa-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-rpa-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Playbook location
  BATON_CONFIG_PATH: /etc/baton-rpa/playbook.yaml

  # Credentials referenced by the playbook
  BATON_APP_USERNAME: <Service account username>
  BATON_APP_PASSWORD: <Service account password>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-rpa.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-rpa
  labels:
    app: baton-rpa
spec:
  selector:
    matchLabels:
      app: baton-rpa
  template:
    metadata:
      labels:
        app: baton-rpa
        baton: true
        baton-app: rpa
    spec:
      containers:
      - name: baton-rpa
        image: public.ecr.aws/conductorone/baton-rpa:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-rpa
        envFrom:
        - secretRef:
            name: baton-rpa-secrets

Browser automation is resource-hungry. Size the pod for Chromium — at least 2 GB of memory — and expect syncs to take minutes rather than seconds. To run without a local Chromium, set BATON_ENABLE_AGENT_CORE=true and provide AWS credentials in the standard credential chain; the connector then drives a browser hosted on AWS Bedrock AgentCore.

Step 5: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the Baton RPA connector to. The application’s data should be found on the Entitlements and Accounts tabs.

Done. Your Baton RPA connector is now pulling access data into C1.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Custom connectors

Configurable connectors

Pre-built connectors

baton-rpa: Browser automation integration

Capabilities

Understanding playbooks

Gather application credentials

Configure the Baton RPA connector

Step 1: Set up a new connector in C1

Step 2: Write the playbook

Step 3: Configure the connector

Step 4: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 5: Deploy the connector

​Capabilities

​Understanding playbooks

​Gather application credentials

​Configure the Baton RPA connector

​Step 1: Set up a new connector in C1

​Step 2: Write the playbook

​Step 3: Configure the connector

​Step 4: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 5: Deploy the connector

Capabilities

Understanding playbooks

Gather application credentials

Configure the Baton RPA connector

Step 1: Set up a new connector in C1

Step 2: Write the playbook

Step 3: Configure the connector

Step 4: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 5: Deploy the connector