Connectors

Connectors hold environment-specific access to a source or destination. Tasks refer only to typed slots, while jobs and runs bind those slots to stored connector records.

Create a connector

Open Connectors and select New Connector:

1. choose a connector type;
2. give it a recognizable name;
3. complete the type-specific fields;
4. test the connection;
5. save.

The form is driven by the connector's runtime schema. Secret fields are stored through the configured secret provider and are not returned as plaintext after save.

Connector categories

Common built-in categories include:

• local CSV and YAML files;
• SQLite;
• PostgreSQL, MySQL, MSSQL, and MongoDB;
• Azure Blob Storage and S3-compatible object storage;
• Dynamics 365, Jira, and Freshdesk;
• Truto unified and proxy APIs;
• deployment-catalog SaaS connectors.

The exact set is build-specific. See Connectors reference for current config and method schemas.

Test connections

Test Connection runs checks implemented by that connector. A simple connector may only initialize and close. An API or database connector may perform several named authentication or discovery checks.

A successful test confirms the configured probe at that moment. It does not guarantee that:

• every resource is authorized;
• the executor has the same network route as the control plane;
• a write operation is allowed;
• a long migration will remain within rate limits.

Run one bounded task from the real executor before production use.

File connectors in Docker

Use absolute container paths:

CSV/YAML directory: /app/data/<folder>
SQLite path:        /app/dbs/<database>.db

The same path must be mounted into the control plane and executor. The control plane handles UI upload and introspection; the executor handles task execution.

CSV, YAML, S3, and Azure Blob connectors expose upload actions when their capabilities permit it. Uploads are constrained by the server-wide size limit and connector-specific path and extension rules.

Azure Key Vault fields

When Azure Key Vault is configured, supported secret fields can be supplied in two ways:

• enter a value and let Envoy write it to the vault;
• select an existing vault secret by name.

The selector lists names, not values. A stored ${secret://azure_key_vault/<name>} reference is resolved by the server.

Connected accounts

Catalog-backed connector types can provide a Connected account workflow:

1. save the connector;
2. start Connect account;
3. open or share the generated connection link;
4. complete the provider authorization;
5. return to Envoy and verify the account binding.

Some integrations use a shared OAuth app; others may require an environment-specific OAuth app when the deployment catalog declares that mode. The available tabs reflect the connector type and catalog, so do not expect an OAuth-app tab for every integration.

See Catalog connectors and connected accounts for the catalog and account lifecycle.

Truto connector

One Truto connector represents an API environment, not one connected account. Tasks pass integrated_account_id per call. The UI provides connected-account pickers where the argument or explorer schema requests them.

See Truto connector for unified, proxy, and custom method requirements.

Editing and deletion

Editing a connector with new secret values creates a new stored secret and removes the old provider value where possible. Leaving secret fields untouched preserves the existing value.

Deleting a connector is destructive and may be blocked when jobs or other records use it. Prefer to update bindings before removal.

Security checklist

• Use least-privilege service accounts.
• Restrict source credentials to reads when writes are unnecessary.
• Use TLS verification in production.
• Keep file paths inside approved mounts.
• Test from the executor network.
• Never paste connector credentials into task YAML, dashboard YAML, logs, or AI prompts.