> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Rippling setup ConfigView reads your Rippling company through Rippling's REST API, using an **API token** that a Rippling admin creates. You don't need a Rippling partner app or the App Shop. You will end up with **1 secret** in ConfigView (`RIPPLING_API_TOKEN`) when setup is complete. > **Scope of this integration today.** ConfigView reads everyone who works or has worked at the company, with their status, start and end dates, title, department, manager and work email. It also reads Rippling login accounts, Rippling groups and who is in them, the accounts Rippling creates, suspends and deletes in your other apps (Slack, Google Workspace, GitHub and so on), devices managed through Rippling IT, the software Rippling pushes to them, and the Rippling Activity Log. ConfigView only reads. It never changes anything in Rippling. > > **ConfigView never collects pay, bank details, tax ids, Social Security numbers, date of birth, home address, phone numbers, gender, race or ethnicity**, even when the token's scopes would allow it. *** ## Before you start: plan and permissions * **API access.** Every endpoint ConfigView reads needs Rippling's **API Tier 1** entitlement. If **Tools → Developer → API Tokens** isn't in your Rippling account, ask your Rippling account manager to turn on API access. * **Activity Log.** The Activity Log needs a separate entitlement, **Activity Log Platform API**. Without it, ConfigView skips the Activity Log and collects everything else. The health check lists which API entitlements your company has. * **Devices and software.** These only have data if you use **Rippling IT** device management. Without it, those two tables stay empty. * **Who creates the token.** A token can only see what its creator can see in Rippling, so it should be created by a **Full Admin**: someone whose permission profile covers all employees, apps and devices and who is also an Activity Log admin. A narrower admin's token returns fewer people, and fields they can't see come back blank. *** ## Step 1: Open the Rippling page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/rippling` Rippling shows the token once, when you create it, so paste it straight into ConfigView instead of keeping it in a notes file. *** ## Step 2: Create an API token in Rippling 1. Sign in to Rippling as the admin who will own the token (see above) 2. Go to **Tools → Developer → API Tokens** ([app.rippling.com/api-tokens](https://app.rippling.com/api-tokens/tokens)). You can also search for "API Tokens" 3. Click **Create API token**. Name it `ConfigView` and keep the newest **API version** 4. Under scopes, select **only these read scopes**: | Scope | What ConfigView reads with it | | - | - | | `companies.read` | Your company's name, to confirm the token works | | `workers.read` | Employees and leavers: status, start and end dates, title, manager, work email | | `users.read` | Rippling login accounts and names | | `departments.read` | Department names | | `teams.read` | Team names | | `supergroups.read` | Rippling groups and their members | | `app-users.read` | Accounts Rippling manages in your other apps | | `devices.read` | Rippling IT devices (skip it if you don't use Rippling IT) | | `software-deployments.read` | Software Rippling IT pushes to devices (skip it if you don't use Rippling IT) | | `activity-log.read` | The Activity Log | | `activity-log.sensitive-data.read` | Optional. Adds the IP address and city/country to Activity Log sign-ins. Without it, the "sign-ins from a new country" question has nothing to compare | Don't add any `.read-write` scope, or any payroll, compensation, time, leave or recruiting scope. ConfigView doesn't use them. 5. Create the token and copy it. It's shown once 6. Switch to the ConfigView tab, paste it into `RIPPLING_API_TOKEN` under **Credentials**, and click the save icon Rippling emails the token owner, API Token admins and Super/Full Admins whenever a token is created. That's expected. ### Keeping the token alive * **Rippling revokes a token that hasn't been used for 30 days.** ConfigView's daily collection keeps it in use. If you pause every Rippling collector for a month, the token stops working and you'll need a new one. * **Rippling revokes a token when its owner is terminated, and you can't transfer ownership.** If the admin who created it leaves, create a new token from another admin and paste it in. The health check reports a revoked token as a 401. * Only the token's owner can change its scopes. *** ## Step 3: Connect and verify 1. Back on `https://{companyname}.configview.com/admin/integrations/rippling`, confirm the credential shows as saved 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **Company** | The Rippling company the token belongs to: its name, legal name and trading name, and how many legal entities it has. | | **Workers** | Everyone who works or has worked at the company: employment status, start and end dates, title, department, manager and work email. No pay, date of birth, address or government id. | | **User Accounts** | Rippling login accounts: username, work email, and whether the account can still sign in. | | **Departments** | Departments and the department each one sits under. | | **Teams** | Teams defined in Rippling and the team each one belongs to. | | **Groups** | Rippling groups used to decide who gets which app, policy and permission. | | **Group Members** | Who is in each visible Rippling group. Runs after **Groups**. | | **App Accounts** | Every account Rippling has created, matched, suspended or deleted in a connected app, with its provisioning state. | | **Devices** | Laptops, desktops, phones and tablets managed by Rippling IT: serial, model, OS, owner, MDM enrollment, disk encryption and last check-in. | | **Software Deployments** | Software Rippling IT pushes to company devices and who it targets. | | **Activity Log** | Sign-ins, admin changes, app provisioning and device actions, with who did it, what it touched, the outcome, and the IP and country. | 3. Click **Verify now**. The health check confirms the token, names the company, reads one worker, and then tries each other kind of data. Data your plan or the token's scopes don't cover is marked **skipped**, not failed. It also lists which API entitlements your company has and any fields Rippling is hiding from this token. If a check fails: * **Auth fails with 401.** The token is wrong or Rippling has revoked it (the owner left, or it went unused for 30 days). Create a new one. * **A check is skipped with 403.** The token doesn't have that scope, or its owner's permission profile doesn't cover that data. The owner can add the scope under **⋮ → Edit** on the token. * **Activity Log is skipped with 403.** Your company doesn't have the Activity Log Platform API entitlement, or the token's owner isn't a Full Admin or Activity Log admin. *** ## Data Tables Once the scripts run, these tables are created in your database. Each includes a `run_at` column. Every table except the Activity Log keeps only the newest run. `raw_json` holds the record as Rippling returned it, without expanded people records. For workers and user accounts it's always empty, because Rippling puts personal data in those records. | Table | Source | Key Columns | | - | - | - | | `rippling_companies` | `GET /companies/` | company\_id, name, legal\_name, doing\_business\_as\_name, parent\_legal\_entity\_id, legal\_entity\_count | | `rippling_workers` | `GET /workers/?expand=user,department` | worker\_id, user\_id, full\_name, work\_email, username, user\_active, status, title, is\_manager, manager\_id, department\_id, department\_name, team\_ids, employment\_type\_id, legal\_entity\_id, country, location\_type, work\_location\_id, start\_date, end\_date, original\_start\_date | | `rippling_users` | `GET /users/` | user\_id, display\_name, full\_name, username, work\_email, active, timezone, locale | | `rippling_departments` | `GET /departments/` | department\_id, name, parent\_id, reference\_code, hierarchy\_ids | | `rippling_teams` | `GET /teams/` | team\_id, name, parent\_id | | `rippling_supergroups` | `GET /supergroups/` | group\_id, name, display\_name, description, group\_type, sub\_group\_type, app\_owner\_id, parent\_id, read\_only, is\_invisible, include\_terminated, allow\_non\_employees, can\_override\_role\_states, priority | | `rippling_supergroup_members` | `GET /supergroups/{id}/members/` | group\_id, group\_name, member\_id, worker\_id, full\_name, work\_email | | `rippling_app_users` | `GET /app-users/` | app\_user\_id, app\_handle, app\_display\_name, worker\_id, spoke\_user\_identifier, external\_email, external\_username, match\_state, push\_state | | `rippling_devices` | `GET /devices/` | device\_id, worker\_id, serial\_number, model, platform, os\_name, os\_version, enrollment\_status, lifecycle\_state, mdm\_provider, is\_managed, is\_encrypted, last\_checkin\_at, last\_mdm\_sync\_at, pending\_action\_count | | `rippling_software_deployments` | `GET /software-deployments/?expand=software` | deployment\_id, software\_id, software\_name, software\_display\_name, software\_category, software\_scope, available\_platforms, target\_type, group\_id, device\_group\_id | | `rippling_activity_log` | `GET /activity-log/` | event\_id, occurred\_at, recorded\_at, event\_type, outcome, actor\_type, actor\_worker\_id, source\_app\_handle, target\_types, target\_ids, target\_worker\_ids, reason\_code, reason\_message, ip\_address, city, region, country, device, browser, operating\_system | *** ## Things worth knowing **The Activity Log is kept beyond Rippling's 90 days.** Rippling keeps 90 days of Activity Log. ConfigView reads it from where the last run stopped and never deletes rows, so your history keeps growing from the day you connect. The first run backfills the 90 days Rippling still has. **Workers and user accounts are different things.** A worker is the employment record (status, dates, manager). A user is the Rippling login behind it. A leaver's worker shows `TERMINATED`, and their user account should show `active = 0`. When it doesn't, they can still sign in to Rippling. **`push_state` says what Rippling did in each app.** `CREATE_CONFIRMED` means the account exists. `SUSPEND_CONFIRMED` and `DELETE_CONFIRMED` mean Rippling removed access. Anything ending in `_FAILED` means Rippling tried and the app refused. That's how a leaver keeps access without anyone noticing. `match_state = NOT_MATCHED` is an account Rippling found in the app but can't tie to a person, so it will never offboard it. **Admin roles aren't available.** Rippling's API doesn't expose permission profiles or who is an admin, so ConfigView can't list Rippling admins. Rippling groups are collected with their type, and Activity Log events record admin actions. **Rippling shows up in Okta too.** If Rippling provisions into Okta, Okta's System Log already records Rippling as the actor on user creates and deactivations. The Rippling integration shows the same flow from Rippling's side, for every app it provisions, not just Okta. **Blank fields usually mean the token can't see them.** Rippling returns `null` for fields hidden from the token's owner. The collector logs those field names on every run, and the health check reports them for workers. **Rate limits.** Rippling allows 600 requests per 10 seconds per token for each endpoint. ConfigView stays far below that. ## What isn't collected * Compensation, pay, payroll, bank accounts, tax and benefits data * Date of birth, gender, race, ethnicity, citizenship, Social Security / SIN / IRD numbers * Personal email, home address, phone numbers and photos * Termination reason and type * Custom fields, documents, time and leave, recruiting * Exact Activity Log location (latitude and longitude). City and country are kept * API token values of any kind This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.