Update Workato connector docs: environment roles and data centers

baton/workato.mdx

@@ -1,30 +1,37 @@
 ---
 title: Set up a Workato connector
 og:title: Set up a Workato connector - C1 docs
 og:description: Integrate your Workato instance with C1 to run user access reviews, enable just-in-time access requests, and easily provision and deprovision access.
 description: C1 provides identity governance and just-in-time provisioning for Workato. Integrate your Workato instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.
 sidebarTitle: Workato
 ---
 
 ## Capabilities
 
-| Resource     | Sync | Provision |
+| Resource           | Sync | Provision |
 | :--- | :--- | :--- |
-| Accounts     | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           |       
-| Privileges   | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           | 
-| Roles        | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>        | 
-| Folders      | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           | 
-| Projects     | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           | 
+| Accounts           | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           |       
+| Privileges         | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           | 
+| Roles              | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>        | 
+| Environment Roles  | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>        | 
+| Folders            | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           | 
+| Projects           | <Icon icon="square-check" iconType="solid"  color="#c937ae"/>   |           | 
+
+<Note>
+**Environment Roles** are only available in workspaces that use the RBAC v2 model. If your workspace uses the legacy role model, environment roles do not apply.
+
+Workato enforces one environment role per collaborator per environment. Granting a new environment role automatically replaces the collaborator's existing role in that environment. Direct revocation of an environment role is not supported — to change a collaborator's role, grant the replacement role instead.
+</Note>
 
 ## Gather Workato credentials 
 
 Each setup method requires you to pass in credentials generated in Workato. Gather these credentials before you move on. 
 
 ### Create a client role
 
 <Steps>
 <Step>
  In Workato, navigate to **Workspace admin** > **API clients** > **Client roles** > **Add client role**. 
 </Step>
 <Step>
 Give the new client role a name, such as "C1 integration role". 
@@ -32,16 +39,23 @@
 <Step>
 Select the following endpoints: 
 
-    | Area         | Section              | Action                      | API Endpoint                       |
+    | Area         | Section              | Action                        | API Endpoint                       |
     | :--- | :--- | :--- | :--- |
-    | **Projects** | Projects & Folders   | List projects               | `GET /api/projects`                |
-    |              | Projects & Folders   | List folders                | `GET /api/folders`                 |
-    | **Admin**    | Collaborators        | Get collaborators           | `GET /api/members`                 |
-    |              | Collaborators        | Get collaborator            | `GET /api/members/:id`             |
-    |              | Collaborators        | Update collaborators' roles* | `PUT /api/members/:id`             |
-    |              | Collaborators        | Get collaborator privileges | `GET /api/members/:id/privileges`  |
-    |              | Collaborator roles   | List non-system roles       | `GET /api/roles`                   |
-    *If you don't want to use C1 to provision role assignments, you can skip **Update collaborator’s roles**.
+    | **Projects** | Projects & Folders   | List projects                 | `GET /api/projects`                |
+    |              | Projects & Folders   | List folders                  | `GET /api/folders`                 |
+    | **Admin**    | Collaborators        | Get collaborators             | `GET /api/members`                 |
+    |              | Collaborators        | Get collaborator              | `GET /api/members/:id`             |
+    |              | Collaborators        | Update collaborators’ roles*  | `PUT /api/members/:id`             |
+    |              | Collaborators        | Get collaborator privileges   | `GET /api/members/:id/privileges`  |
+    |              | Collaborator roles   | List non-system roles         | `GET /api/roles`                   |
+    |              | Environment roles    | List environment roles†       | `GET /api/environment_roles`       |
+    |              | Environment roles    | Get environment role†‡        | `GET /api/environment_roles/:id`   |
+
+    *If you don’t want to use C1 to provision role assignments, you can skip **Update collaborator’s roles** and **Get environment role**.
+
+    †**List environment roles** and **Get environment role** are only available in workspaces that use the RBAC v2 model (environment roles). If your workspace uses the legacy role model, these permissions do not appear in the UI and you can skip them.
+
+    ‡**Get environment role** is required only if you want C1 to provision environment role assignments.
 </Step>
 <Step>
 Save the new role.  
@@ -79,23 +93,25 @@
 
 ### Look up your data center location
 
 You'll also need to specify the location of your Workato data center. Workato displays your data center in the base URL of the API endpoint: 
 
 * US Data Center: https://www.workato.com/api/
 * EU Data Center: https://app.eu.workato.com/api/
 * JP Data Center: https://app.jp.workato.com/api/
 * SG Data Center: https://app.sg.workato.com/api/
 * AU Data Center: https://app.au.workato.com/api/
+* IL Data Center: https://app.il.workato.com/api/
+* Sandbox: https://app.trial.workato.com/api/
 
 **Done.** Next, move on to the connector configuration instructions. 
 
 ## Configure the Workato connector
 
 <Warning>
 To complete this task, you'll need:
 
 - The **Connector Administrator** or **Super Administrator** role in C1
 - Access to the set of Workato credentials generated by following the instructions above
 </Warning>
 
 <Tabs>
@@ -111,9 +127,9 @@
 Search for **Workato** and click **Add**. 
 </Step>
 <Step>
 Choose how to set up the new Workato connector: 
 
    * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    * Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -134,10 +150,10 @@
 Enter the API token in the **API key** field. 
 </Step>
 <Step>
-In the **Data center** field, enter one of `us`, `eu`, `jp`, `sg`, or `au` to identify the location of your Workato data center. The default is `us`. 
+In the **Data center** field, enter one of `us`, `eu`, `jp`, `sg`, `au`, `il`, or `sandbox` to identify the location of your Workato data center. The default is `us`. 
 </Step>
 <Step>
 In the **Environment** field, enter one of `dev`, `test`, or `prod` to identify your Workato environment. The default is `dev`. 
 </Step>
 <Step>
 **Optional.** If desired, check the box to **Disable custom roles sync**. 
@@ -150,11 +166,11 @@
 </Step>
 </Steps>
 
 **Done.** Your Workato connector is now pulling access data into C1.
 </Tab>
 <Tab title="Self-hosted">
 
 **Follow these instructions to use the Workato connector, hosted and run in your own environment.**
 
 When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
 
@@ -164,7 +180,7 @@
 
 * [GitHub repository](https://github.com/conductorone/baton-workato): Access the source code, report issues, or contribute to the project.
 
 ### Step 1: Configure the Workato connector
 
 <Steps>
 <Step>
@@ -174,9 +190,9 @@
 Search for **Baton** and click **Add**.
 </Step>
 <Step>
 Choose how to set up the new Workato connector: 
 
    * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    * Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -202,7 +218,7 @@
 
 ### Step 2: Create Kubernetes configuration files
 
 Create two Kubernetes manifest files for your Workato connector deployment:
 
 #### Secrets configuration
 
@@ -220,7 +236,7 @@
 
   # Workato credentials
   BATON_WORKATO_API_KEY: <Workato API key>
-  BATON_WORKATO_DATA_CENTER: <Your Workato data center (one of us, eu, jp, sg, or au). Default is us.>
+  BATON_WORKATO_DATA_CENTER: <Your Workato data center (one of us, eu, jp, sg, au, il, or sandbox). Default is us.>
   BATON_WORKATO_ENV: <Your Workato environment (one of dev, test, or prod). Default is 'dev'>
 
   # Optional: include if you don't want to sync custom Workato roles
@@ -269,14 +285,14 @@
 
 <Steps>
 <Step>
 Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files. 
 </Step>
 <Step>
 Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Workato connector to. Workato data should be found on the **Entitlements** and **Accounts** tabs.
 </Step>
 </Steps>
 
 **Done.** Your Workato connector is now pulling access data into C1.
 
 </Tab>
 </Tabs>