Set up a Mattermost connector

C1 provides identity governance for Mattermost. Integrate your Mattermost instance with C1 for unified visibility and governance over user access.

C1 provides identity governance for Mattermost. Integrate your Mattermost instance with C1 for unified visibility and governance over user access.

Capabilities

Resource	Sync	Provision
Users
Teams

Gather Mattermost credentials

The connector token must belong to an account with the System Admin (manage_system) permission. Without it, Mattermost returns only open teams from the team list and reports a partial picture of teams, memberships, and roles. The connector’s validation step fails and reports the missing permission when the token is not a System Admin.

1. Sign in to Mattermost with a System Admin account, or use a bot account that has the System Admin role.

2. Create a Personal Access Token (under Profile > Security > Personal Access Tokens) or a bot account token (under System Console > Integrations > Bot Accounts). Personal Access Tokens may need to be enabled in the System Console first.

3. Copy the token value and note your Mattermost server URL (for example https://mattermost.example.com).

Configuration fields

Field	Required	Description
base-url	Yes	Your Mattermost server URL. REST calls are made against /api/v4 under this host.
api-token	Yes	A Mattermost Personal Access Token or bot token with the System Admin (manage_system) permission.

Synced resource types

• Users: Mattermost user accounts from /api/v4/users. Deactivated accounts are synced as disabled.
• Teams: Mattermost teams from /api/v4/teams, modeled as groups.
• Team memberships and roles: membership and elevated team-role assignments (such as team admin) from /api/v4/teams/{team_id}/members.

Special notes

• Provisioning is not supported in the current build; the connector performs read calls only.
• The connector authenticates with a static bearer token (Personal Access Token or bot token).
• Channels are not synced in the current build. The access boundary modeled here is team membership.
• Account-level system roles (such as system admin) are recorded on the user profile rather than as separate access grants.

Configure the Mattermost connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Mattermost and click Add.

3. Choose how to set up the new Mattermost connector.

4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the Mattermost credentials:

   • Server URL: Your Mattermost server URL, such as https://mattermost.example.com.
   • API Token: A System Admin Personal Access Token or bot token.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Mattermost connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the Mattermost connector in your own environment.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Mattermost connector, set the owner, and click Next.

4. In the Settings area, click Edit, then click Rotate to generate a new Client ID and Client Secret. Store these values securely for your deployment.

5. Configure C1 credentials and Mattermost credentials as environment variables:

   BATON_CLIENT_ID=<C1 client ID>
   BATON_CLIENT_SECRET=<C1 client secret>
   BATON_HOST_ID=baton-mattermost
   BATON_BASE_URL=<Your Mattermost server URL>
   BATON_API_TOKEN=<System Admin Personal Access Token or bot token>
   
6. Deploy the connector using your standard self-hosted connector process.

Done. Your Mattermost connector is now pulling access data into C1.