guides
Intended Documentation
Connector Setup Guides (Beta)
Per-connector setup guides for all 15 dedicated Intended connectors — PagerDuty, Datadog, Slack, Okta, Entra, AWS, GCP, Salesforce, Vault, SAP, Workday, Jira, ServiceNow, Stripe, and GitHub. Each guide covers the exact credential fields, pinned hosts, Test connection, and least-privilege scopes. Every connector is Beta until validated against your live account.
Connector Setup Guides (Beta)#
Step-by-step setup for each of Intended's 15 dedicated connectors. Every guide is grounded in the real adapter code (packages/execution-engine/src/adapters/*.ts) and the connector manifest (packages/connector-catalog/src/index.ts), so the credential fields, pinned hosts, and Test-connection probes are the ones the runtime actually uses.
Each connector:
- Verifies the Authority Decision Token first (Ed25519 +
kidpinning + tenant/adapter/target binding + expiry + single-use nonce) before any side-effecting call. - Is host-pinned / SSRF-hardened — HTTPS-only, embedded-credential-free, cloud-metadata/link-local hosts blocked.
- Stores its credential per-tenant, AES-256-GCM-encrypted — secrets are never displayed back.
- Escalates writes under the starter policy — nothing auto-executes.
Every connector here is Beta
The adapter code is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. What is not yet done is live proof against a real, owner-provided credential — so each connector is Beta, never GA. See the Capability Truth Matrix for each row's exact status.
The 15 connectors#
| Connector | Actions | Auth | Pinned host(s) |
|---|---|---|---|
| PagerDuty | trigger / resolve incidents | REST token + Events v2 routing key | api.pagerduty.com, events.pagerduty.com |
| Datadog | create event / mute monitor | DD-API-KEY + DD-APPLICATION-KEY | api.datadoghq.* (by site) |
| Slack | post message / lookup channel | bot token (Bearer xoxb-) | slack.com |
| Okta | suspend / unsuspend / reset factors | API token (SSWS) | *.okta.com / .oktapreview.com / .okta-emea.com |
| Microsoft Entra (Azure AD) | disable / enable / revoke sessions | Graph bearer token | graph.microsoft.com (+ national clouds) |
| AWS | attach IAM policy / stop instance | SigV4 | *.amazonaws.com (IMDS blocked) |
| Google Cloud (GCP) | add IAM binding / stop instance | service-account JWT-bearer OAuth | Google API hosts |
| Salesforce | create / update case | OAuth refresh-token grant | *.salesforce.com |
| HashiCorp Vault | read / rotate secret | X-Vault-Token | self-hosted (SSRF-hardened) |
| SAP S/4HANA Cloud | create PO / post invoice | OAuth client-credentials | SAP-cloud domains |
| Workday | hire worker / approve time off | OAuth refresh-token grant | *.workday.com / *.myworkday.com |
| Jira | create issue (+ comment) | Basic (email:apiToken) | HTTPS (no vendor pin) |
| ServiceNow | incident create/update/read, change create | Basic (username:password) | HTTPS (no vendor pin) |
| Stripe | create refund / create invoice | Bearer secret key | api.stripe.com |
| GitHub | dispatch workflow / create PR | GitHub App install flow | api.github.com |
How to connect (general flow)#
- In the Console, open Connectors → Connect a system and pick the connector.
- Follow that connector's guide to obtain the exact credentials from the provider (least-privilege).
- Paste the fields into the Configure auth step. (GitHub is the exception — it uses the GitHub App install flow, with no credential fields.)
- Finish the wizard, then click Test connection on the connector card to run the live probe.
Next steps#
- Enterprise-System Connectors (Beta) — the shared reference page
- Connector SDK — build your own fail-closed adapter
- Capability Truth Matrix — the single source of truth for connector status