Connectors

Under Integrations → Connectors, you build and manage governed REST connectors. A connector is authored as a draft, optionally dry-run against the live provider, then published as an immutable version — editing a published connector creates a new draft, and the live version stays unchanged until you publish again:

Info

Enterprise licence required. Integrations is gated on an active enterprise licence. Without one the section does not appear in the admin sidebar, regardless of the signed-in user’s role.

Connectors

Name, Organization, Status (e.g. Published), Version, and when it was last updated. Check Show archived to include retired connectors.

Connectors run server-side, under the outbound allowlist and stored credentials — there is no browser-side HTTP call. Click New connector, or the pencil icon on an existing one, to open the guided builder.

Empty list — No connectors yet / Create a connector to call an external REST API under platform governance.

New connectors open in a step-by-step wizard (Connect → Operation, one tab per operation) with a Readiness checklist tracking five conditions before the connector can be trusted to run: Organization selected, Host on allowlist, Credential configured, Operation key set, Sample fetched.

Connect step — readiness checklist

Organization, Credential, and Operation key resolve as soon as the fields are filled. Host on allowlist only turns green after a successful Test connection — typing an allowlisted URL is not enough by itself.

• Connect step — name and organization (fixed after the first save; create a new connector to use a different identity), a description, and the Base URL. The host must already be on the allowlist; localhost and private/loopback addresses are blocked at runtime (ip_not_allowed) even if the URL saves. Click Test connection — this is what actually flips Host on allowlist to green; the field itself doesn’t validate on typing or blur. The Authentication fields (Type, Credential, Placement, Scheme, Credential header name) sit on the same step: pick a Credential already stored under Credentials, shown masked (e.g. coinmarket (••••••••a599)), or use Add credential in the picker when none exist for that organization yet. Scheme matters: bearer sends Authorization: Bearer <value>; many third-party APIs (e.g. a custom API-key header) need raw with an explicit Credential header name instead — a bearer scheme against a provider expecting a raw header typically comes back as a provider_error / 401 with a message like “API key missing” even though the credential itself is valid.
• Operation step — define the Internal operation name, HTTP Method, and Path template, then use Fetch sample to call the live endpoint with the current draft and preview the raw response — no save required. A successful fetch is what flips Sample fetched to green and populates Pick from sample shortcuts for the response mapping below. Request mapping covers path/query/header mappings and an optional request-body expression; Response mapping sets the Root selector (e.g. $.data or $.data[*]), Cardinality, and Response fields — click Generate from sample to derive fields automatically from the last fetched sample instead of adding them one by one.

Click Switch to advanced editor to see every operation on one flat page instead of stepping through the wizard — the same fields, no step navigation:

Advanced editor — response mapping and test

Add Field builds the output shape field by field. Test response mapping calls the live API with the saved draft and previews the mapped rows — it does not publish.

Test response mapping (labelled Save & run test the first time, Run test afterward) saves the current draft, calls the live API, and previews the mapped rows using the response fields you’ve defined — without affecting the published version. Every one of these calls — dry-run fetch, test, and later live execution — is recorded on Connector Audit, distinguished by a Dry run tag.

• Connector Execution — the platform-wide and per-organization switches that gate whether this connector can actually execute.
• Allowlist — where a connector’s Base URL host must be registered.
• Credentials — where the Authentication credential comes from.
• Connectors (architecture) — the security model, the security hardening history, and how connector data sits alongside PostgREST-backed views.