Connectors How connectors work

How connectors work

A connector is how Oxelone reads a platform's API for AI posture: its users, settings and records. A connection is one configured connector in your workspace, with its own name, credential, rules and sync period. You can have many connections of one connector.

Connectors exist for GitHub, Microsoft 365, Google Workspace, OpenAI and Anthropic. Coverage matrix shows what each connection can reach.

Who can do it

You want to	Role that can	Permission
Open the catalogue and read a connector	Owner, Admin, Analyst, Policy author, Fleet operator, Compliance reader	`connections:read` (View connections)
Connect, change or remove a connection	Owner, Admin, Fleet operator	`connections:manage` (Manage connections)

Without connections:manage the API answers: "changing a connection requires connections:manage in this workspace".

The catalogue

Go to Collection › Connectors. The page is titled Connectors: "Platforms Oxelone can read for AI posture."

Each tile shows the connector's name, vendor and one line about it, then counts such as "N record kinds · N actions · N rules".
The tile's one button is Connect. When the workspace already has connections, the N connected count beside it opens the connector's Connections tab.
Show narrows the grid to All, Connected or Available. The search box reads "Search by name, vendor or product".
Connectors that are not built yet sit under Coming soon, marked SOON. They are inert.

Select a tile to open its sheet. It has three tabs:

Tab	What it shows
Overview	What it reads (its record kinds), What it can do (its actions) and What it checks (its rules, counted by severity).
Rules	Every rule the connector ships, in two packs: Posture checks and Inspections.
Connections	This workspace's connections of the connector, with their state and last sync.

A record kind that is switched off until you opt in carries the Off by default badge and one line saying what switching it on stores.

Posture checks and inspections

A posture check reads settings or metadata and decides. Example: GitHub's "Member without two-factor authentication".
An inspection fetches content and asks an engine. GitHub's "Secret in a repository file" is one. The bytes are dropped after the call.

Both open an issue when they match. Some also carry a connector action you can turn on in a policy. See Policies.

Connect a platform

Go to Collection › Connectors and choose Connect on the platform's tile.
Sign in. Give the connection a Name. The ghost text reads "e.g. GitHub production" with the connector's own name. A connector with more than one mode also asks for Modes; choose at least one. Then pick a way to sign in (see below). Oxelone makes a real call with the credential before you can go on.
Check. Oxelone reads each kind of record and each action once with this credential and marks it Readable or Not readable. The step shows "Signed in to" and the name the vendor gave and the size of the estate, such as the number of repositories and members. Check again runs it again.
Rules. Switch Posture checks and Inspections on or off. Switch on any Off by default record kind you want. Choose Sync every: 15 min, 1 h, 6 h or 1 d, as the connector offers.
Choose Create connection.

Open Connectors

Sign-in methods

The sheet lists the methods a connector offers under Sign-in methods. A method that needs a registration only a global admin can make is not ready until they make it.

Method	What it is
Oxelone's registration	An app registered once for the platform. You authorise it in the vendor's own screen.
Domain-wide delegation	Oxelone's service account, which you authorise in your own admin console. Google Workspace only.
Your own token	A token you paste. It is a password field.
Your own key file	A JSON file you upload from a registration or service account you own.

A token with the wrong start is refused beside the field: "A sk-ant-admin token, please." (the prefix is the connector's own).

Readable and Not readable

Readable means this credential reaches the record kind or action. Not readable comes with its reason on the row. Rules over a record kind that is not readable are hidden on the Rules step, and the step says "N rules are hidden — this credential cannot read what they watch." A pack with nothing it can run is switched off with "This credential cannot read what these rules watch."

The reason is always one of these sentences:

"Not readable — the credential lacks the permission permission."
"Not readable — the organisation's plan does not include this (plan)."
"Not readable — no credential in the slot slot."
"Not readable — the vendor answered reason when probed."

When it goes wrong

What you see	What it means
The connector catalogue could not be read.	The catalogue page could not load.
This connection could not be created.	Create connection failed. The reason follows.
This connection could not be checked.	The check step failed.
Name the super administrator first.	Google Workspace only. Sign in stays off until you name the person.
Needs a name.	Continue stays off until the name is filled in.
Needs at least one mode.	A connector with several modes needs one chosen.
Run the check first.	Continue from Check stays off until a check has run.
This credential reaches nothing yet.	Every record kind came back Not readable.
This organisation is too large for a 15-minute period.	The period is withheld for this connection (the number is the period you picked).
the vendor refused this credential (code). Check that it has the permissions this connector asks for, and that it has not expired.	The vendor rejected the credential.
the vendor is rate-limiting this account. Try again in a few minutes.	The vendor is throttling.
A global admin has not registered this platform with Oxelone, so the Oxelone app cannot be installed. Connect with your own registration or token instead.	No registration exists. Use your own credential.
A global admin has disabled Oxelone's registration for this platform. Connect with your own registration or token instead.	The registration was switched off.

After you connect

The connection has its own page under Inventory › Connections, with Sync now, Pause and Resume. A connection is Connecting, Live, Paused, Failing or Revoked. A platform install you did not finish offers Finish connecting. See Connections.

With the API

Not available with an API key. Connectors are not part of the public API.

A development deployment can also offer a Mock choice under Organisation on the Sign in step: "A simulated organisation. Available on development deployments only." Only a global admin can create one.