All access is read-only. The app requests only read scopes, and Openlayer
never changes anything in your monday.com account.
How it works
Once connected, Openlayer syncs from monday.com every hour by default:- Discovers agents. Every AI agent in the account is listed under Agents. Agents removed in monday.com stay listed as removed rather than disappearing.
- Reads each agent’s configuration. The model, tools, jobs and their triggers, and the boards and docs the agent can access. These come from monday.com’s preview API. When an agent’s configuration is not readable, the agent stays listed and Coverage says so.
- Keeps an audit history. Agent lifecycle events from monday.com’s audit log, such as created, activated, ownership transferred, and board access granted. The first sync reads the last 30 days, and you can backfill up to 90 days.
- Governs the agents you enable. Enabling an agent gives it a
monday.com · <agent>project, or maps it to an existing one. From then on, each finished run of the agent becomes a trace in that project.
Prerequisites
- A monday.com account with AI agents, and a monday.com user who can create apps in the monday.com Developer Center.
- An Openlayer workspace where you are an admin. Connecting, changing settings, enabling and disabling agents, and disconnecting are admin-only. Members can view the connection, the agents, and their audit history.
Openlayer reads monday.com as the user who authorizes the app, so it sees the
agents and configurations that user can see. Authorize with a user who can see
every agent you want to govern.
Setup guide
Step 1: Create a monday.com app
In Openlayer, go to Settings → Integrations and open monday.com in the Agent builders section. The Connect form shows the Redirect URL and Required scopes for your app. Keep it open; you copy both from there.
1
Create the app
Open the monday.com Developer Center and choose Create app.
2
Add the scopes
Go to Build › OAuth & permissions. On the Scopes tab, tick the six
scopes Openlayer lists, then choose Save Scopes:
me:read,
account:read, users:read, workspaces:read, boards:read, and
teams:read.3
Turn on the New OAuth flow
Turn the New OAuth flow toggle on and save. Openlayer uses this flow’s
expiring, rotating tokens and does not support monday.com’s older OAuth
flow. See monday.com’s guide to the new OAuth
flow.
4
Register the redirect URL
On the Redirect URLs tab, paste the Redirect URL shown in Openlayer
and save.
5
Copy the credentials
Under General settings › App Credentials, copy the Client ID and the
Client Secret (Show, then Copy).
Step 2: Connect
Back in Openlayer, paste the Client ID and Client secret into the form and click Connect. A popup opens monday.com’s consent page. Sign in as the user Openlayer should read monday.com as, and authorize the app. If your browser blocks the popup, the notification has an Open popup button. When monday.com sends you back, the integration shows as connected and the first sync starts. Agents appear on the Agents tab once it finishes. Openlayer encrypts the client secret and the tokens at rest and never returns them. To use a different app later, or to authorize this one again, click Replace credentials under Settings. The current connection keeps working until the new authorization completes.Step 3: Check coverage
Open the General tab. Overview shows the connection’s status, the monday.com account, the client ID, the last sync, how far the audit history has been read, and the last error. Coverage reports what this connection can read from monday.com. Click Check access to check it again.
Step 4: Review the settings
Under Settings on the same tab:- Periodic sync reads agents, audit events, and runs from monday.com. Turn it off to pause syncing without disconnecting, or click Sync now to queue a sync immediately.
- Sync frequency ranges from Every 5 minutes to Every day. The default is Every hour. monday.com limits how many API calls an app can make per day, so a very frequent sync on a busy account can use up the day’s allowance. See monday.com’s rate limits.
- Read agent configurations (on by default) reads each agent’s model, tools, and data access. Run telemetry also depends on it: with it off, no runs sync.
- Auto-enable new agents (off by default) creates a project for each agent discovered from now on. It never enables agents that already existed when you turned it on, or agents an admin disabled.
- Store job instructions (off by default) keeps the text of each job’s instructions. A fingerprint (a SHA-256 hash and the length) is always kept, so you can tell when instructions change without storing them. Turning the setting off deletes the stored text.
- Store run content (on by default) keeps run inputs, outputs, tool inputs, the agent’s reasoning, and item and board names. Turning it off applies to runs synced from then on. See What lands in Openlayer.
- Backfill audit history re-reads monday.com audit events from a date you choose, within the last 90 days. Without a date, it re-reads all 90 days. Events already stored are not duplicated.
Agents and projects
The Agents tab lists every agent with its status, model, data access, and when a sync last saw it. Search by name, or filter by Enabled, Not enabled, or Removed. An agent whose configuration monday.com does not return shows Configuration not visible.
- Create new project — Openlayer creates a
monday.com · <agent>project and pipeline for the agent. The project joins the governance frameworks that match it. - Map to existing project — choose a project and pipeline. The pipeline must use Openlayer’s default storage. Pipelines on a BigQuery or Snowflake backend cannot receive runs.
- Disable stops governing the agent. Its project, pipeline, and existing data are kept.
- Re-enabling a disabled agent reuses its project and pipeline if both still exist, so it does not create a second project.
Audit history
Audit history in an agent’s menu lists that agent’s monday.com audit events, newest first and grouped by day. Each event shows what happened, a one-line summary, how long ago it happened, and who did it. Hover the summary, or its info icon, to see the event code, the exact time, the actor’s display name, and every stored field.
- Agent created, updated, and deleted
- Agent activated and deactivated
- Agent ownership transferred
- Agent board access granted, removed, and changed
- AI agent app installed, uninstalled, and updated
- AI settings changed
monday.com’s audit log does not record edits to an agent’s configuration, such
as its instructions or tools. The Agents tab always shows the current
configuration.
What lands in Openlayer
Each finished run of an enabled agent becomes one trace in the agent’s pipeline. When you enable an agent, the next sync reads its runs from the last 30 days. Later syncs read only new runs. A run that is still in progress is written once it finishes.
A few behaviors are not obvious from the trace:
- Chat runs have no input. monday.com does not expose the messages users send an agent in chat, so a chat run has the run and its model usage, but no input and no steps.
- Cost is estimated. monday.com reports AI credits, not money. Openlayer estimates cost from
model list prices, and your workspace’s price overrides apply. A run that used several models
gets one combined token count from monday.com, so Openlayer prices it at the costliest of those
models, as an upper bound. The run’s AI credits are kept in
monday_ai_credits. - Runs on the same item share a session. Every run on one item lands in the same session, so you can follow the agent’s work on that item. Other runs are each their own session.
- Users are monday.com users. The user ID is the monday.com ID of the user who triggered the
run. Their display name is in
monday_actor_name. - With Store run content off, a run keeps its timings, token counts, AI credits, and step and
tool names. Its input becomes a label such as
monday.com assigned run, and it has no output, tool arguments, reasoning,monday_outputs, or item and board names.
Evaluating the ingested data
Once runs are flowing, evaluate monday.com agents the same way you evaluate application traffic:- Create tests on run outputs, latency, token usage, and cost
- Detect PII in what agents write
- Use governance frameworks to evidence AI controls with each agent’s configuration, audit history, and real runs