Enterprise-System Connectors (Beta)#

Intended ships real, token-gated adapters for eleven enterprise systems. Each one:

• Verifies the Authority Decision Token first. It extends BaseAdapter from @intended/connector-sdk, which validates the token (Ed25519 + kid pinning + tenant / adapter / target binding + expiry + single-use nonce) before any side-effecting call. If a check fails, the action never runs.
• Is host-pinned / SSRF-hardened. Requests go only to the provider's canonical hosts, over HTTPS, with embedded credentials and metadata/link-local hosts rejected. A stored baseUrl is validated against the pinned host or fails closed.
• Stores its credential per-tenant, AES-256-GCM-encrypted. Intended never puts a connector secret in a request URL.
• Escalates writes under the starter policy. Nothing auto-executes: a write goes through evaluateAuthority and ESCALATEs for approval.

Required credential fields, by connector#

Store these as the connector secret for the tenant. Field names are the exact keys the adapter parses.

PagerDuty#

• Auth: REST API token — Authorization: Token token=<apiToken>; Events v2 uses the routing key.
• Fields: apiToken (required), routingKey (required to trigger/resolve incidents), fromEmail (optional, for REST actions needing a From header).
• Hosts (pinned): api.pagerduty.com, events.pagerduty.com.
• Actions: pagerduty.incident.trigger, pagerduty.incident.resolve.

Datadog#

• Auth: DD-API-KEY + DD-APPLICATION-KEY headers.
• Fields: apiKey (required), applicationKey (required), site (optional region selector, e.g. eu, us3; defaults to US1).
• Hosts (pinned by site): api.datadoghq.com, api.datadoghq.eu, api.ddog-gov.com, and other regional hosts.
• Actions: datadog.event.create, datadog.monitor.mute.

Slack#

• Auth: bot token — Authorization: Bearer xoxb-….
• Fields: apiToken (required, the xoxb- bot token).
• Host (pinned): slack.com.
• Actions: slack.message.post, slack.channel.lookup.

Okta#

• Auth: Okta API token — Authorization: SSWS <apiToken>.
• Fields: baseUrl (required, your Okta org, e.g. https://your-org.okta.com), apiToken (required).
• Host validation: must be an *.okta.com / *.oktapreview.com / *.okta-emea.com host.
• Actions: okta.user.suspend, okta.user.unsuspend.

Microsoft Entra (Azure AD)#

• Auth: Microsoft Graph — Authorization: Bearer <accessToken>.
• Fields: accessToken (required), baseUrl (optional; defaults to graph.microsoft.com, national-cloud Graph hosts accepted).
• Actions: entra.user.disable, entra.user.enable. ("Azure AD" is now Microsoft Entra ID — same adapter.)

HashiCorp Vault#

• Auth: X-Vault-Token (KV v2 API). Self-hosted, so no vendor host-pin — SSRF hardening requires HTTPS, forbids embedded credentials, and blocks metadata/link-local hosts.
• Fields: baseUrl (required), vaultToken (required), mount (optional, defaults to secret), namespace (optional).
• Actions: vault.secret.read, vault.secret.rotate.

Salesforce#

• Auth: OAuth 2.0 refresh-token grant. Both the token endpoint host and the resolved instance host must be a *.salesforce.com host, or it fails closed.
• Fields: instanceUrl (required), clientId (required), clientSecret (required), refreshToken (required), loginUrl (optional, e.g. a My Domain login host).
• Actions: salesforce.case.create, salesforce.case.update.

Google Cloud (GCP)#

• Auth: service-account JWT-bearer OAuth (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer), then Authorization: Bearer to pinned Google API hosts.
• Fields: client_email (required), private_key (required), project_id (required), scope (optional), token_uri (optional).
• Hosts (pinned): the Google token host, cloudresourcemanager.googleapis.com (IAM), and the Compute host.
• Actions: gcp.binding.add, gcp.instance.stop.

Workday#

• Auth: OAuth 2.0 refresh-token grant at the tenant token endpoint (/ccx/oauth2/{tenant}/token), then Bearer to the tenant REST API (/ccx/api/v1/{tenant}/…).
• Fields: host (required, e.g. impl-services1.wd12.myworkday.com), tenant (required), clientId (required), clientSecret (required), refreshToken (required).
• Host validation: *.workday.com / *.myworkday.com.
• Actions: workday.worker.hire, workday.timeoff.approve.

SAP S/4HANA Cloud#

• Auth: OAuth 2.0 client-credentials grant (tokenUrl → Bearer to the pinned baseUrl).
• Fields: baseUrl (required), tokenUrl (required), clientId (required), clientSecret (required).
• Actions: sap.purchaseorder.create, sap.invoice.post.

AWS#

• Auth: SigV4 (hand-rolled signer; no AWS SDK on the hot path).
• Fields: accessKeyId (required), secretAccessKey (required), sessionToken (optional), region (required).
• Actions: aws.policy.attach, aws.instance.stop.

What "Beta" means here — and how it graduates#

A connector graduates from Beta to a stronger status only when it has been validated end-to-end against a real, owner-provided credential for that provider — not before. Until then the honest label is Beta, on every surface. Track the status of each in the Capability Truth Matrix; when a connector's row flips to Implemented, its site label follows automatically.

Not built yet (Planned)#

These are named in blueprints but have no adapter code: Oracle, NetSuite, Epic, CrowdStrike, Splunk, Snyk, ZAP, Veracode. Any page that lists them must label them Planned.

Next steps#

• Connector SDK — build your own fail-closed adapter
• Capability Truth Matrix — the single source of truth for connector status