# Inventory Assets

Retrieves a full snapshot of inventory assets from the Upwind Security catalog, including cloud resources, Kubernetes workloads, and containers across your organization.

**Sync Type: Full Synchronization**

## Prerequisites

Before connecting Monad to Upwind, you need:

1. An active Upwind account with API access enabled
2. Your **Organization ID** — found in the Upwind console under **Organization Settings**. The value has the format `org_<alphanumeric>`.
3. An **OAuth 2.0 API application** with a Client ID and Client Secret. See the Authentication section below for steps to create one.

## Authentication

Upwind uses the **OAuth2 client credentials** grant. Monad exchanges the Client ID and Client Secret for a short-lived access token at `https://auth.upwind.io/oauth/token` before each request. Token refresh is handled automatically.

### Generating API Credentials

1. Log in to the [Upwind console](https://console.upwind.io).
2. Navigate to **Settings** > **Credentials**.
3. Click **Generate Credentials**.
4. Select **API** as the credential type.
5. Define the **Scope**: choose **Global Scope** for full read access, or **Custom** and grant read access to inventory assets.
6. Provide a descriptive name (e.g., `monad-inventory-assets`).
7. Click **Generate New Credentials**.
8. Copy the **Client ID** and **Client Secret** — the secret is shown only once, so store it securely.

### Finding your Organization ID

1. In the Upwind console, open **Organization Settings**.
2. Copy the **Organization ID** value. It begins with `org_` followed by alphanumeric characters.

## Configuration

The following configuration defines the input parameters.

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Region | string | Yes | The Upwind deployment region. Determines which API and authentication endpoints are used. Options: **United States** (`us`), **Europe** (`eu`), **Middle East** (`me`). Defaults to `us`. |
| Organization ID | string | Yes | Your Upwind organization identifier. Found in the Upwind console under Organization Settings. Format: `org_<alphanumeric>`. |
| Cloud Provider | string | Yes | The cloud provider to scope the inventory search to. Upwind requires at least one search condition; this value is sent as a `cloud_provider` filter on the search request (for example, `AWS`, `GCP`, `AZURE`). |
| Cron | string | Yes | Cron expression that controls how often the connector runs a full asset scan (5-field, standard syntax). Example: `0 0 * * *` for daily at midnight. |
| Use Synthetic Data | boolean | No | Generate synthetic data for testing instead of connecting to the real Upwind API. Defaults to `false`. |

### Secrets

| Secret | Type | Required | Description |
| ------ | ---- | -------- | ----------- |
| Client ID | secret | Yes | OAuth2 Client ID from your Upwind API application. Used to obtain access tokens via the client credentials grant. |
| Client Secret | secret | Yes | OAuth2 Client Secret from your Upwind API application. Used alongside the Client ID to obtain access tokens. |

## Setup Walk-through

1. **Create an API application** — follow the Authentication section above to create an OAuth 2.0 application in the Upwind console and copy the Client ID and Client Secret.

2. **Find your Organization ID** — in the Upwind console navigate to **Organization Settings** and copy the `org_<alphanumeric>` identifier.

3. **Create the input in Monad**:
   - Open your Monad workspace and navigate to **Inputs**.
   - Click **Add Input** and select **Upwind — Inventory Assets**.

4. **Fill in the configuration**:
   - Select the **Region** that matches your Upwind deployment (United States, Europe, or Middle East).
   - Paste your **Organization ID** into the *Organization ID* field.
   - Enter the **Cloud Provider** to scope the asset search to (for example, `AWS`, `GCP`, or `AZURE`). Upwind requires at least one search condition, so this filter is mandatory.
   - Enter the **Client ID** and **Client Secret** from your API application.
   - Set the **Cron** schedule to control how often a full asset snapshot is taken (for example, `0 0 * * *` for once daily).

5. **Save and test** — click **Test Connection**. Monad will authenticate with Upwind and make a sample request to the inventory assets search endpoint to confirm the credentials and organization ID are valid.

6. **Activate** — once the connection test passes, enable the input. Monad will perform a full scan of your Upwind asset catalog on each scheduled run.

## Troubleshooting

### Common Issues

1. **Authentication Errors (401 / 403)**
   - Confirm the Client ID and Client Secret are correct and have not been revoked.
   - Verify the API application exists and is active in the Upwind console.
   - Ensure no extra whitespace was included when copying the credentials.
   - Regenerate credentials in the Upwind console if you suspect they have been compromised.

2. **Organization Not Found or Permission Denied**
   - Verify the Organization ID starts with `org_` and matches the value shown in Upwind **Organization Settings**.
   - Confirm the API application has read access for the target organization.

3. **Empty Results**
   - Confirm that the selected **Cloud Provider** matches assets that exist in your Upwind organization — only assets matching this filter are returned. To pull assets from a different cloud, create a separate input for that provider.
   - Confirm that inventory assets exist in your Upwind organization.
   - Check the pipeline logs for any parse errors returned from the Upwind API.

4. **Invalid Region**
   - Ensure the selected region matches the Upwind deployment your organization uses. Using the wrong region will result in connection failures because API and token endpoints differ per region.

5. **Invalid Cron Expression**
   - Ensure the cron expression uses standard 5-field syntax. Refer to [Cron Expression Syntax](https://crontab.guru/) for guidance.

## Related Articles

- [Upwind Documentation](https://docs.upwind.io)
- [Upwind API Reference](https://docs.upwind.io/restapi/v1/introduction)