# Configuration Findings

Streams configuration findings from Upwind, providing visibility into misconfigurations and compliance violations across your cloud infrastructure.

**Sync Type: Incremental**

## Prerequisites

Before connecting Monad to Upwind, you need:

1. **An active Upwind account** with access to the target organization.
2. **Your Upwind Organization ID** — found in the Upwind console under **Organization Settings**. The ID has the format `org_<alphanumeric>`.
3. **An OAuth2 API application** with a Client ID and Client Secret — see the Authentication section below for setup steps.

## Authentication

Upwind uses the **OAuth2 client credentials** grant. Monad exchanges the Client ID and Client Secret for a short-lived access token at `https://auth.upwind.io/oauth/token` before each request. Token refresh is handled automatically.

### Generating API Credentials

1. Log in to the [Upwind console](https://console.upwind.io).
2. Navigate to **Settings** > **Credentials**.
3. Click **Generate Credentials**.
4. Select **API** as the credential type.
5. Define the **Scope**: choose **Global Scope** for full read access, or **Custom** and grant read access to configuration findings.
6. Provide a descriptive name (e.g., `monad-configuration-findings`).
7. Click **Generate New Credentials**.
8. Copy the **Client ID** and **Client Secret** — the secret is shown only once, so store it securely.

### Finding your Organization ID

1. In the Upwind console, open **Organization Settings**.
2. Copy the **Organization ID** value. It begins with `org_` followed by alphanumeric characters.

## Configuration

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Region | string | Yes | The Upwind deployment region. Determines which API and authentication endpoints are used. Options: `United States`, `Europe`, `Middle East`. Defaults to `United States`. |
| Organization ID | string | Yes | Your Upwind organization identifier. Found in the Upwind console under Organization Settings. Format: `org_<alphanumeric>`. |
| Severity Filter | array | No | Restrict returned findings to the specified severity levels. Accepted values: `critical`, `high`, `medium`, `low`. Leave empty to receive findings of all severities. |
| Status Filter | array | No | Restrict returned findings to the specified statuses. Accepted values: `pass`, `fail`. Leave empty to receive findings of all statuses. |
| Backfill Start Time | string | No | The date and time (RFC3339) to start fetching configuration findings from on the first run. If not specified, only findings that appear after the input is created will be ingested. |
| Use Synthetic Data | boolean | No | Generate synthetic demo data instead of connecting to the real data source. Useful for testing pipelines before go-live. |

### Secrets

| Secret | Type | Required | Description |
| ------ | ---- | -------- | ----------- |
| Client ID | string | Yes | OAuth2 Client ID from your Upwind API application. Used to obtain access tokens via the client credentials grant. |
| Client Secret | string | Yes | OAuth2 Client Secret from your Upwind API application. Used alongside the Client ID to obtain access tokens. |

## Setup Walk-through

1. In the Upwind console, create an API application and copy the **Client ID** and **Client Secret** (see Prerequisites and Authentication above).

2. Note your **Organization ID** from **Organization Settings** in the Upwind console.

3. In Monad, navigate to **Inputs** and click **Add Input**.

4. Search for **Upwind** and select **Configuration Findings**.

5. Select your **Region** (United States, Europe, or Middle East) to match your Upwind deployment.

6. Enter your **Organization ID** (e.g., `org_xxxxxxxx`).

7. Enter the **Client ID** and **Client Secret** from step 1.

8. Optionally, configure **Severity Filter** and/or **Status Filter** to narrow the findings returned. Leave both empty to receive all findings.

9. Optionally, set **Backfill Start Time** to ingest historical findings from a specific date.

10. Click **Save** and verify that the input status transitions to **Running**.

## Troubleshooting

### Common Issues

**Authentication failures (401 Unauthorized)**
- Confirm the Client ID and Client Secret are copied correctly with no extra whitespace.
- Check that the API application has not been disabled or deleted in the Upwind console.
- Verify the application has permission to read configuration findings for the target organization.

**Organization not found or access denied (403 Forbidden)**
- Verify the Organization ID starts with `org_` and matches an organization the API application has access to.
- Ensure the correct Region is selected — using the wrong region results in the API call reaching the wrong endpoint.

**No findings returned**
- Confirm that configuration findings exist for the target organization in the Upwind console.
- If you set a Backfill Start Time, ensure it is not in the future.
- Check that your Severity Filter and Status Filter are not excluding all results.

**Invalid Organization ID format**
- The Organization ID must start with `org_`. For example: `org_abc123`. Check Organization Settings in the Upwind console for the exact value.

## Related Articles

- [Upwind Documentation](https://docs.upwind.io)
- [Upwind API Reference](https://docs.upwind.io/restapi/v1/introduction)