Skip to main content
This page is a map, not a replacement for the guides it links to. For the files a new connector needs, see docs/connectors/BUILDING_A_CONNECTOR.md in the repository.
A naming trap worth avoiding first: this codebase has two different things called “connector.” @parmana/connector-sdk is a generic library with reference mocks (SapConnector, OracleConnector, etc.) that never talk to a real system. The connectors the default server actually registers and runs in production, HubSpot, GitHub, Paytm and Slack, follow a different, simpler pattern documented in the Connector Development Guide. Any other HTTPS endpoint can be connected with no code at all, as an external connector: see Connect any external system. This page covers both real paths.

​
The four pieces

They’re deliberately decoupled. That’s why “got APPROVED” and “the action actually happened” are two separate, independently verifiable claims (see Connect an Agent, Step 8).
  1. Write the policy first, see Write Your First Policy. Everything else needs the exact capability string and signalsSchema up front.
  2. Onboard a caller and test authorization with no connector yet, see Connect an Agent. A 503 CONNECTOR_NOT_REGISTERED at this stage is expected: the policy approved, and nothing was executed.
  3. Connect the target system: register your endpoint as an external connector (Connect any external system), or build a built in connector (Connector Development Guide).
  4. Add a SignalStateVerifier only if a caller lying about a signal is a real risk for this capability that a policy rule alone can’t catch. Built in connectors only.

​
What breaks if you skip a piece

Every row here is a real failure mode this codebase has actually hit and diagnosed, several the same night integrating a real refund agent partner.

​
Next

Write Your First Policy

Author the policy that decides APPROVE/REJECT for your capability.

Connect an Agent

Onboard a caller with a scoped API key and test authorization end to end.

Connector Development Guide

Implement and register the connector that performs the real action.

Credential Isolation

How a connector receives a credential it never fetches itself.