# Vulnerabilities

Collects vulnerability data from the runZero platform.

**Sync Type: Incremental**

## Requirements

Before connecting Monad to runZero, you need credentials from the runZero console. runZero supports two authentication methods: an Export API token or OAuth 2.0 client credentials.

### Option 1 — Export API Token

- Log in to the [runZero console](https://console.runzero.com) and navigate to **Account** > **API tokens**.
- Click **Create export token** (or use an existing Export Token or Account API Token).
- Copy the generated token. You will need it when configuring the Monad connector.

### Option 2 — OAuth 2.0 Client Credentials

- Log in to the [runZero console](https://console.runzero.com) and navigate to **Account** > **API clients**.
- Click **Create API client** and give it a descriptive name (e.g. `Monad Integration`).
- Assign at least the **Export** scope so the client can read vulnerability data.
- Copy the **Client ID** and **Client Secret**. You will need both when configuring the Monad connector.

### Organization ID

You also need the UUID of the runZero organization whose vulnerability data you want to collect.

- In the runZero console, navigate to **Organizations**.
- Click the target organization and copy the UUID from the URL or organization detail page.

## Configuration

The following configuration defines the input parameters.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Organization ID | string | Yes | The UUID of the runZero organization to collect data from. |
| Authentication Method | one of | Yes | Authentication method to use for accessing the runZero API. Choose between **API Token** and **OAuth 2**. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

#### Authentication Method: API Token

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| API Token | secret string | Yes | The runZero API token (e.g. an Export Token or Account API Token). |

#### Authentication Method: OAuth 2

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| Client ID | secret string | Yes | The OAuth 2.0 client ID for the runZero API. |
| Client Secret | secret string | Yes | The OAuth 2.0 client secret for the runZero API. |

## Setup Walk-through

1. Obtain your runZero credentials using one of the methods described in the [Requirements](#requirements) section above.
2. In the Monad UI, navigate to **Inputs** and click **Add Input**.
3. Search for and select **runZero Vulnerabilities**.
4. Enter the **Organization ID** (the UUID of the runZero organization).
5. Under **Authentication Method**, select either **API Token** or **OAuth 2**:
   - **API Token**: paste your Export Token or Account API Token into the **API Token** field.
   - **OAuth 2**: enter the **Client ID** and **Client Secret** from your runZero API client.
6. Click **Test Connection** to verify Monad can reach the runZero API with the provided credentials.
7. Click **Save** to activate the input. Monad will begin the initial full sync and switch to incremental syncs on subsequent runs.

## Related Articles

- [runZero API Documentation](https://www.runzero.com/docs/leveraging-the-api/)
- [runZero Export Tokens](https://help.runzero.com/docs/leveraging-the-api/#authentication)
- [runZero Organizations](https://www.runzero.com/docs/organizations/)

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.