Skip to content

guides

Intended Documentation

Connector Setup Guides (Beta)

Per-connector setup guides for every dedicated Intended connector — PagerDuty, Datadog, Slack, Okta, Microsoft Entra, AWS, GCP, Salesforce, Vault, SAP, Workday, Jira, ServiceNow, Stripe, and GitHub. Each guide covers the provider-side credential steps, the exact console fields, the pinned hosts, and the test-connection flow.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

Connector Setup Guides (Beta)#

Every dedicated Intended connector has its own setup guide. Each guide is verified against the adapter code and the connector capability manifest, and covers:

  1. Provider-side steps — how to create each credential the adapter actually requires.
  2. Pinned hosts — exactly which provider hosts the adapter is allowed to reach (SSRF-hardened, HTTPS-only).
  3. Console fields — the exact fields the connect dialog asks for, with the same labels.
  4. Test connection — what the live probe calls, and how to re-run it later.
  5. Least-privilege scoping — the narrowest provider credential that still works.

Every connector here is Beta, not GA

The adapter code is real and covered by hermetic (mocked-HTTP) tests that pass in CI. What is not yet done is live proof against a real, owner-provided credential — so each connector is Beta. Do not represent any of these as generally available or certified. See the Capability Truth Matrix for each row's exact status.

How connecting works#

Every connector shares the same console flow (Console → Connectors → Connect):

  1. Pick the system from the catalog. The tiles are driven by the backend capability manifests — only real, service-specific connectors are offered.
  2. Step 1 — review. The wizard shows the connector's description and the provider-side scopes it expects.
  3. Step 2 — credentials. Enter the fields listed in the connector's guide. Credentials are write-only: stored AES-256-GCM-encrypted, never displayed back.
  4. Step 3 — activate. The console persists the encrypted secret and runs a live reachability probe against the provider. A failed probe surfaces the provider's real error verbatim.

After connecting, expand the connector's row in the table to Test connection (re-runs the same probe), Update credentials (rotate, write-only), or Disconnect (hard-purges the encrypted secret).

Every write action a connector performs is gated behind an Authority Decision Token first — the adapter verifies the token (Ed25519, tenant/adapter/target binding, expiry, single-use nonce) before any side-effecting call.

Guides by system#

Incident & observability#

  • PagerDuty — trigger and resolve incidents (Events API v2 + REST probe)
  • Datadog — post events and mute monitors (v1 REST)
  • ServiceNow — create/update/read incidents, create changes (Table API)

Collaboration & tracking#

  • Slack — post messages, look up channels (Web API)
  • Jira — create issues and comments (REST API v3)
  • GitHub — dispatch Actions workflows, create pull requests (GitHub App)

Identity#

Cloud infrastructure#

  • AWS — attach IAM policies, stop EC2 instances (SigV4)
  • Google Cloud (GCP) — add IAM bindings, stop Compute instances (service-account OAuth)
  • HashiCorp Vault — read and rotate KV v2 secrets

Business systems#

  • Salesforce — create and update cases (REST, refresh-token OAuth)
  • SAP S/4HANA Cloud — create purchase orders, post supplier invoices (OData v2)
  • Workday — hire workers, approve time off (REST, refresh-token OAuth)
  • Stripe — create invoices and refunds

Not built yet (Planned)#

These are named in blueprints but have no adapter code: Oracle, NetSuite, Epic, CrowdStrike, Splunk, Snyk, ZAP, Veracode. Any page that lists them must label them Planned.

Next steps#

Connector Setup Guides (Beta) | Intended