> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# baton-rpa: Browser automation integration

> C1 provides identity governance for web applications that have no identity API. Baton RPA drives the application's own web UI from a declarative playbook, giving C1 unified visibility and governance over user access.

> [!NOTE]
>
> **Baton RPA is a connector framework, not a connector for a single application.** It syncs identity and access data from web applications that expose no IAM API — the data is read from the application's web UI, driven by a declarative YAML playbook. Each application gets its own playbook, and production connectors typically embed Baton RPA as a library rather than running this binary directly.
>
> If you are setting up a specific application, use that application's connector page. This page documents the framework itself.

## Capabilities

Baton RPA declares no compiled-in resource types. The resource types it syncs are defined by the playbook passed to the connector, so its capabilities are determined per playbook rather than per build.

A playbook can map extracted data to any of the following resource types:

| Resource | Sync | Provision |
| :- | :- | :- |
| Accounts | | |
| Groups | | |
| Roles | | |
| Apps | | |

**Notes:**

* Baton RPA is sync-only. It does not provision or deprovision access, and it does not support account provisioning.
* Which of the resource types above appear in a given sync depends entirely on the playbook. A playbook that only lists users produces accounts and nothing else.
* Entitlements and grants are produced from the playbook's grant extraction and CEL mappings.

## Understanding playbooks

A playbook is a YAML file that tells the connector how to authenticate to the application and how to extract each resource type. It has two parts:

* **`connect`**: the login flow (password, SSO, TOTP) and browser settings. Baton RPA signs in once, then reuses the session.
* **`resource_types`**: for each resource type, how to reach the data and how to map it to C1 resources using [CEL](https://github.com/google/cel-spec) expressions.

Extraction uses one of three strategies, chosen per resource type:

| Strategy | When to use | Browser exposure |
| :- | :- | :- |
| Browser auth plus HTTP | The application is a single-page app with discoverable API endpoints. This is the recommended strategy. | Login only |
| DOM scraping | The application is a server-rendered admin panel with no usable endpoints. | The entire sync |
| JavaScript extraction | The application holds its data in client-side state with no REST API. | Page load and script execution |

For the complete YAML syntax, see the [Playbook Reference](https://github.com/conductorone/baton-rpa/blob/main/docs/playbook-reference.md).

## Gather application credentials

> [!WARNING]
>
> The credentials Baton RPA needs are the credentials of a user who can sign in to the target application's web UI and see its administrative pages. Grant that account the least privilege that still lets it view the user, group, and role lists you want to sync.

**Step 1**

Create or identify a dedicated service account in the target application.

Use a dedicated account rather than a person's account. The connector signs in as this account on every sync, and a person's account can be disabled, rotated, or challenged by step-up authentication without warning.

**Step 2**

Grant the account read access to the administrative pages that list the data you want to sync — typically the users, groups, and roles pages.

**Step 3**

Record the sign-in credentials the playbook's login flow needs. This varies by application, but is usually a username and password, plus a TOTP secret if the application enforces multi-factor authentication.

**Step 4**

Have each credential ready to supply to the connector. The playbook references credentials by name, and the connector refuses to start if a referenced one is unset. A cloud-hosted connector takes them in the C1 connector configuration; a self-hosted connector takes them as environment variables with a `BATON_` prefix.

## Configure the Baton RPA connector

> [tab] Cloud-hosted
>
> Follow these instructions to use a built-in, no-code connector hosted by C1.
>
> A cloud-hosted Baton RPA connector runs inside C1 and drives a browser hosted on AWS Bedrock AgentCore, so there is no Chromium or other infrastructure for you to run.
>
> **Step 1**
>
> In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
>
> **Step 2**
>
> Search for **Baton RPA** and click **Add**.
>
> **Step 3**
>
> Choose how to set up the new connector:
>
> * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
> * Add the connector to a managed app (select from the list of existing managed apps)
> * Create a new managed app
>
> **Step 4**
>
> Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
>
> If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
>
> **Step 5**
>
> Click **Next**.
>
> **Step 6**
>
> Upload your playbook YAML file to the connector's configuration.
>
> **Step 7**
>
> Fill in the credentials the playbook references, such as the service account's username and password. C1 stores them encrypted and supplies them to the playbook at sync time.
>
> **Step 8**
>
> Click **Save**.
>
> **Step 9**
>
> The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
>
> **Done.** Your Baton RPA connector is now pulling access data into C1.

> [tab] Self-hosted
>
> Follow these instructions to use the [Baton RPA](https://github.com/conductorone/baton-rpa) connector, hosted and run in your own environment.
>
> When running in service mode, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
>
> ### Step 1: Set up a new connector in C1
>
> **Step 1**
>
> In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
>
> **Step 2**
>
> Search for **Baton** and click **Add**.
>
> **Step 3**
>
> Choose how to set up the new connector:
>
> * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
> * Add the connector to a managed app (select from the list of existing managed apps)
> * Create a new managed app
>
> **Step 4**
>
> Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.
>
> If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
>
> **Step 5**
>
> Click **Next**.
>
> **Step 6**
>
> Upload your playbook YAML file to the connector's configuration.
>
> **Step 7**
>
> Fill in the credentials the playbook references, such as the service account's username and password.
>
> ### Step 2: Write the playbook
>
> **Step 1**
>
> Write a YAML playbook for the target application and make it available to the connector — mounted from a config map, baked into your image, or written to disk by your deployment.
>
> **Step 2**
>
> Validate the playbook before deploying it:
>
> ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}}
> baton-rpa --config-path playbook.yaml
> baton resources -f sync.c1z
> baton grants -f sync.c1z
> ```
>
> ### Step 3: Configure the connector
>
> **Step 1**
>
> Enter the required configuration:
>
> * **config-path** (required): Path to the Baton RPA YAML playbook configuration file. Environment variable: `BATON_CONFIG_PATH`.
> * **enable-agent-core**: Run the playbook against the AWS Bedrock AgentCore remote browser instead of launching Chromium locally. Environment variable: `BATON_ENABLE_AGENT_CORE`.
>
> Any variables the playbook references are supplied as additional `BATON_`-prefixed environment variables.
>
> ### Step 4: Create Kubernetes configuration files
>
> Create two Kubernetes manifest files for your Baton RPA connector deployment:
>
> #### Secrets configuration
>
> ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
> # baton-rpa-secrets.yaml
> apiVersion: v1
> kind: Secret
> metadata:
>   name: baton-rpa-secrets
> type: Opaque
> stringData:
>   # C1 credentials
>   BATON_CLIENT_ID: <C1 client ID>
>   BATON_CLIENT_SECRET: <C1 client secret>
>
>   # Playbook location
>   BATON_CONFIG_PATH: /etc/baton-rpa/playbook.yaml
>
>   # Credentials referenced by the playbook
>   BATON_APP_USERNAME: <Service account username>
>   BATON_APP_PASSWORD: <Service account password>
> ```
>
> See the connector's README or run `--help` to see all available configuration flags and environment variables.
>
> #### Deployment configuration
>
> ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
> # baton-rpa.yaml
> apiVersion: apps/v1
> kind: Deployment
> metadata:
>   name: baton-rpa
>   labels:
>     app: baton-rpa
> spec:
>   selector:
>     matchLabels:
>       app: baton-rpa
>   template:
>     metadata:
>       labels:
>         app: baton-rpa
>         baton: true
>         baton-app: rpa
>     spec:
>       containers:
>       - name: baton-rpa
>         image: public.ecr.aws/conductorone/baton-rpa:latest
>         imagePullPolicy: IfNotPresent
>         env:
>         - name: BATON_HOST_ID
>           value: baton-rpa
>         envFrom:
>         - secretRef:
>             name: baton-rpa-secrets
> ```
>
> > [!WARNING]
> >
> > Browser automation is resource-hungry. Size the pod for Chromium — at least 2 GB of memory — and expect syncs to take minutes rather than seconds. To run without a local Chromium, set `BATON_ENABLE_AGENT_CORE=true` and provide AWS credentials in the standard credential chain; the connector then drives a browser hosted on AWS Bedrock AgentCore.
>
> ### Step 5: Deploy the connector
>
> **Step 1**
>
> Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
>
> **Step 2**
>
> Check that the connector data uploaded correctly. In C1, click **Applications**. On the **Managed apps** tab, locate and click the name of the application you added the Baton RPA connector to. The application's data should be found on the **Entitlements** and **Accounts** tabs.
>
> **Done.** Your Baton RPA connector is now pulling access data into C1.