Platform / Integrations & Endpoints
Declare the system, store the secret once, test it, bind it to a workflow as a capability.
Integrations is the organization’s catalog of external systems. Each is a declaration — kind, base URL, auth mode, the name of a secret, a scope, the actions it allows — and the secret itself is stored once under that name, never in Firestore, never in the browser, never in a block.
Auth modes are bearer, API key, OAuth client credentials and AWS SigV4, which signs AWS JSON APIs directly. Test connection runs server-side over https. “Use in a workflow” binds the integration to a pipeline as a capability, which is the only way a run can reach it: an undeclared call does not happen.
Reachout — who gets told when a gate holds, a run fails or a post lands — belongs beside these endpoints. It is still a preview: the rules-and-delivery-log screen on its page is the shape of the product on synthetic events, not a console module you can switch on today.
The engineer who holds the API keys and the operator who has to say which systems a workflow may touch.
Platform. Production connectors start on Start; the catalog is visible on Free.
What an integration is.
http, webhook, knowledge or notification; the base URL every action hangs off.
None, bearer, API key, OAuth client credentials, or AWS SigV4 for service.region.amazonaws.com APIs.
Named calls with method, path and content type — an action may also start a workflow.
Where the credential lives.
Stored once as a SecureString under a name your organization owns; another organization using the same name gets a conflict, not an overwrite.
Keys, certificates and keystores an app needs at runtime are stored at Administration → Vault and placed on hosted instances as file secrets.
Storing or clearing a secret writes an audit row with the name only; the value is never logged.
The outbound notice, designed and shown on synthetic events; not a console module yet.
Held gates, failures, completions, thresholds.
A human-readable note and a structured payload from the same event.
Delivered or queued, so “did anyone hear?” is a status, not a guess. A notice is never the commit.
Stored once under a name only your organization may use; the value is never logged or shown again.
A server-side test over https with the real credential, before any workflow depends on it.
A workflow reaches the system through a capability on the pipeline; the block never holds the credential.
Base URL and auth: bearer, API key, OAuth, or AWS SigV4.
Paste the value once. The console keeps a name, a fingerprint and a time; the value goes to the runtime’s secret store.
HEAD then GET, eight-second timeout, https only, with the credential sent the way the system expects.
Bind it to a pipeline as a capability. Scope it to sandbox, UAT or production.
| The usual way | Here |
|---|---|
| The API key is pasted into the node that calls the system | The key is stored once under a name; the block names the capability and the runtime resolves the secret |
| You find out the credential is wrong when the workflow fails in production | Test connection runs server-side with the real credential before anything depends on it |
| An agent can be talked into calling a new URL | A call to anything not declared on the pipeline does not happen |
Here. Reachout is the outbound-notice design that sits beside these endpoints; it is a preview, and its card above says so.
That is the Vault, under Administration: stored once and placed on your hosted instance as a file secret. Integrations is for systems workflows call.
The catalog is visible on Free; production connectors start on Platform Start.
Platform Start is the self-serve canvas. A first pipeline we stand up with you is delivery, priced apart from the subscription.