Discover
List /integration/{provider}/operations and
inspect one operation before building the client.
Integrations guide
Put a provider operation behind Daptin.
Install an OpenAPI v2 or v3 definition, select its authentication model, discover the generated operations, and expose only the calls your product needs.
- OpenAPI 2 + 3
- Provider routes
- Shared or user auth
Create the provider definition.
Create an integration record with a unique name,
lowercase openapiv2 or
openapiv3 language, JSON or YAML format, the
specification, authentication type, and enable state.
Integration management remains administrator-only.
Execute
POST inputs under input to
/integration/{provider}/{operationId}.
Select authentication
Pass oauth_token_id or
credential_id at the top level, not inside
provider input.
Export
Inspect the provider-scoped OpenAPI output at
/integration/{provider}/openapi.yaml.
Verify provider and user credentials.
- Disabled integrations and unknown operation IDs fail.
- Provider input is mapped to the expected path, query, header, and body fields.
- Shared credentials remain server-held and inaccessible to ordinary clients.
- Per-user execution selects only the signed-in user's connected OAuth token.
- REST, GraphQL-over-HTTP, unary gRPC, or short-lived WebSocket behavior is tested for the chosen operation.
- Timeouts, non-2xx responses, malformed provider data, and credential expiry produce useful failures.
- External effects are not described as part of a Daptin database transaction.
Repeat the matrix for each transport the product uses. REST, GraphQL over HTTP, unary gRPC, and short-lived WebSocket request/response operations share the integration concept, but they do not share identical timeout or error behavior.
Credential ownership
Check which identity reaches the provider.
- Call a shared-credential operation as an allowed and denied Daptin user.
- Connect two user credentials and confirm each caller reaches only their own provider account.
- Inspect provider-scoped discovery without returning stored secret material.
- Exercise expired credentials, provider rejection, timeout, and malformed responses.
- Constrain imported operations to providers and destinations the deployment intends to trust.