Register an
approved integration.

1. Define a fixed destination

Add the provider hostname to the integration’s code-owned allow-list. User input must never control the base URL, path, redirect target, or credentials.

2. Declare operations

List each supported method and fixed path. Assign its required panel permission and a Zod response schema. Keep the operation surface small and purpose-specific.

3. Keep credentials server-only

Use a named environment variable referenced by the integration definition. Never return the secret, log it, or expose it to a Client Component.

4. Use the approved caller

The server registry validates HTTPS and the approved host, rejects redirects, applies bounded timeouts and response sizes, checks content type, and validates the result before returning data.

5. Add operational controls

For production scale, add distributed rate limits, secret-manager rotation, tracing with redaction, provider health checks, and integration-specific tests.

No third-party integration is currently registered. Do not configure fictional endpoints as working services.