Skip to content

Integration Platform — Workflows

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P6)

The June-2026 page described vendor onboarding, token refresh and webhook flows for vendor-specific services; it is archived under catalogs 2026-06. The flows below belong to connections, connectors and the ingress.

Connection lifecycle

sequenceDiagram
    participant A as Workspace admin
    participant C as IntegrationService
    participant S as SecretBrokerService
    participant V as Vendor
    A->>C: RegisterConnection (provider, endpoint policy, credential kind, Key Vault reference)
    A->>C: VerifyConnection
    C->>S: resolve reference into a short-lived credential
    C->>V: read-only probe
    C->>C: Verified, then Active
    A->>C: SetGrant (project, agent, tool, source, MCP server)
    loop every 10 minutes
        C->>V: health probe
    end
    A->>C: RotateCredential (new reference), re-verify
    A->>C: RevokeConnection
    C-)C: ConnectionStateChanged → dependents stop
Hold "Alt" / "Option" to enable pan & zoom

Using a connection

A knowledge source sync, an external tool call, a consumed MCP server handshake or an outbound delivery calls Resolve with its scope and subject; the service checks the grant and the endpoint policy and returns a broker ticket; the caller exchanges the ticket at the Secret Broker for a credential that expires with the use. Receipts record the connection id and credential kind, never a value.

Connector certification

Draft → Certified → Active → Deprecated: an Asset maintainer registers a descriptor (capabilities, adapter version, retry and rate-limit profile, webhook scheme, configuration form); the conformance suite runs capability calls against a sandbox connection and stores evidence; activation follows. A changed adapter version re-runs certification; every capability exposed to agents is also a tool descriptor with a side-effect class.

Subscriptions and inbound deliveries

  1. A subscription names an Active connector and connection, the event types and a target (workflow trigger, knowledge sync, fleet signal); it receives a GW-06 ingress identity.
  2. The vendor posts to the ingress; WebhookGatewayService verifies the signature under the connector's scheme and the replay window, captures the payload by hash and emits InboundDeliveryVerified or rejects with an outcome.
  3. ConnectorRegistryService deduplicates on the key within the window, records the delivery and dispatches to the target; the target acknowledges; failures retry per profile and end Failed with a receipt; an Operator may replay from the stored payload.

Outbound deliveries

An external-class tool call reaches Deliver with its policy decision and approval; the connector adapter sends through the brokered credential under the rate-limit profile; retries follow the profile within the calling tool's budget; the receipt returns to the executor, which settles the invocation as Observed, Failed or Uncertain.

Off-boarding

Project closing (XL-13) revokes the project's grants; a revoked connection stops every dependent source, tool, server and subscription immediately and the audit trail records it.