> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-terraform-v2-owner-resources.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Sigma Computing connector

> C1 provides identity governance and just-in-time provisioning for Sigma Computing. Integrate Sigma Computing with C1 to review and provision access.

## Capabilities

| Resource      | Sync                                                          | Provision                                                     |
| :------------ | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Teams         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Account Types | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

**Additional functionality:**

The Sigma Computing connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning).

**Notes:**

* Team Admin access is sync-only. You can review Team Admin access in C1, but Sigma's API does not support granting or revoking it.
* The connector syncs your organization's Sigma account types, including any custom account type you created, and shows each account type name exactly as Sigma stores it. Each account type offers **Assigned** access that your users can request and that C1 can provision.
* A Sigma member holds one account type at a time, so account types are mutually exclusive: granting one replaces the account type the member currently holds. Granting the account type the member already holds changes nothing.
* Sigma has no unassigned state for account types, so C1 cannot revoke a member's current account type. To change a member's access, grant the replacement account type instead. Revoking an account type the member no longer holds succeeds without any change.
* New accounts default to the account type value `view` when **Account Type** is empty. Account type grants do not change that default.
* The account creation form retains **User Kind** and **Send Invitation** for compatibility, but changing these fields has no effect. Sigma's defaults apply, including sending an invitation email to non-embed users.
* Account sync excludes archived and inactive members. Deleting an account archives it, reassigns its documents to the credential owner, and removes it from later syncs.
* Revoke Team Member access before deleting or deactivating an account because Sigma does not allow team membership changes for inactive members.

## Gather Sigma Computing credentials

<Warning>
  Sigma free trials do not support API keys or API actions. The API credentials must be owned by a user with the Admin account type because Sigma restricts the account-type list API to Admin-owned credentials. The credential owner also needs permissions to read and manage members, teams, and team membership.
</Warning>

### Create API client credentials

<Steps>
  <Step>
    Sign in to your Sigma organization.
  </Step>

  <Step>
    Select your user avatar and then select **Administration**.
  </Step>

  <Step>
    In the side panel, select **Developer access**. From the displayed **API base URL**, copy only the host, without `https://` or a path (for example, `aws-api.sigmacomputing.com`).
  </Step>

  <Step>
    Click **Create new** to open the **Create client credentials** dialog.
  </Step>

  <Step>
    For **Select scopes**, select **REST API**.
  </Step>

  <Step>
    Select a credential owner with the Admin account type and permission to read and manage members, teams, and team membership, and then click **Create**.
  </Step>

  <Step>
    Copy and securely store the **Client ID** and **Client Secret**. Sigma does not display the secret again after you close the dialog.
  </Step>
</Steps>

For more information, see [Generate Sigma API client credentials](https://help.sigmacomputing.com/reference/generate-client-credentials).

## Configure the Sigma Computing connector

<Warning>
  To complete this task, you need:

  * The **Connector Administrator** or **Super Administrator** role in C1
  * Your Sigma API base URL, Client ID, and Client Secret
</Warning>

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Apps** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Sigma Computing** and click **Add**.
      </Step>

      <Step>
        Choose where to add the connector: **Create a new app**, or **Add to an existing app** (then select the app).

        If you're creating a new app, choose whether to link it to an application discovered from your identity provider: select **Yes** and pick the IdP application, or **No** to continue with just the connector.
      </Step>

      <Step>
        Set the connector's **Name** and, optionally, a **Description**.
      </Step>

      <Step>
        Click the pencil icon next to **Owners** to choose who can configure and manage this connector.
      </Step>

      <Step>
        Click **Add**. The connector is created and its configuration page opens.
      </Step>

      <Step>
        In the **Settings** area, click **Edit**.
      </Step>

      <Step>
        Enter the required configuration:

        * **Domain** (required): Domain of your Sigma instance (e.g. aws-api.sigmacomputing.com) See: [https://help.sigmacomputing.com/reference/get-started-sigma-api#identify-your-api-request-url](https://help.sigmacomputing.com/reference/get-started-sigma-api#identify-your-api-request-url)
        * **Client ID** (required): Client ID for your Sigma Computing instance
        * **Client Secret** (required): Client Secret for your Sigma Computing instance
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. View the logs to confirm that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Sigma Computing connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to host and run the [Sigma Computing connector](https://github.com/conductorone/baton-sigmacomputing) in your environment.

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1 and uploads data at regular intervals.

    ### Resources

    * [Official download center](https://dist.conductorone.com/ConductorOne/baton-sigmacomputing): Download stable binaries for Windows, Linux, and macOS and access container images.
    * [GitHub repository](https://github.com/conductorone/baton-sigmacomputing): Access the source code, report issues, or contribute.

    ### Step 1: Set up a new Sigma Computing connector

    <Steps>
      <Step>
        In C1, navigate to **Apps** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose where to add the connector: **Create a new app**, or **Add to an existing app** (then select the app).

        If you're creating a new app, choose whether to link it to an application discovered from your identity provider: select **Yes** and pick the IdP application, or **No** to continue with just the connector.
      </Step>

      <Step>
        Set the connector's **Name** and, optionally, a **Description**.
      </Step>

      <Step>
        Click the pencil icon next to **Owners** to choose who can configure and manage this connector.
      </Step>

      <Step>
        Click **Add**. The connector is created and its configuration page opens.
      </Step>

      <Step>
        In the **Settings** area, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new C1 Client ID and Secret. Copy and securely store both values for Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Sigma Computing connector deployment.

    #### Secrets configuration

    ```yaml expandable theme={null}
    # baton-sigmacomputing-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-sigmacomputing-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # Sigma Computing credentials
      BATON_SIGMA_COMPUTING_DOMAIN: <Sigma API domain>
      BATON_SIGMA_COMPUTING_CLIENT_ID: <Sigma client ID>
      BATON_SIGMA_COMPUTING_CLIENT_SECRET: <Sigma client secret>

      # Optional: include to enable account, account type, and Team Member provisioning
      BATON_PROVISIONING: "true"
    ```

    See the connector's README or run `--help` for all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={null}
    # baton-sigmacomputing.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-sigmacomputing
      labels:
        app: baton-sigmacomputing
    spec:
      selector:
        matchLabels:
          app: baton-sigmacomputing
      template:
        metadata:
          labels:
            app: baton-sigmacomputing
            baton: true
            baton-app: sigmacomputing
        spec:
          containers:
          - name: baton-sigmacomputing
            image: public.ecr.aws/conductorone/baton-sigmacomputing:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-sigmacomputing
            envFrom:
            - secretRef:
                name: baton-sigmacomputing-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace for C1 connectors if desired, and apply the secret and deployment configuration files.
      </Step>

      <Step>
        In C1, click **Applications**. On the **Managed apps** tab, open the application with the Sigma Computing connector and confirm that Sigma data appears on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Sigma Computing connector is now pulling access data into C1.
  </Tab>
</Tabs>

<Tip>
  Download the latest Sigma Computing connector binaries and container information from the [official download center](https://dist.conductorone.com/ConductorOne/baton-sigmacomputing).
</Tip>