API integration & customer onboarding
Import a provider's spec, build the call sequence, run it against their real sandbox, and keep the evidence. Every customer sits in their own isolated database schema.
OpenAPI, a Postman collection, an Insomnia export, or plain markdown. The format is detected rather than declared, and you review the diff before anything is written.
Chain calls into a flow. Each step pulls values out of earlier responses, and decides for itself whether a failure stops the run or is skipped past.
Requests execute server-side against the real provider and are logged as they happen. A 4xx or 5xx opens an issue without anyone filing it.
Requests, responses, timings and correlation IDs are recorded as they happen — and any one of them can be opened to see exactly what went out and what came back.
Steps run in order, and each one can pull {{variables}} out of
any earlier response. When a step fails you decide whether the run stops
or carries on without it — per step, not per flow.
Autonomy is off until a tenant admin turns it on, and what gets turned on is specific: which operation classes, which providers, what rate and budget, which hours. Anything outside that, it asks. Pause takes effect at the next call, not the next deploy.
How it holds
Conventions get forgotten. These are structural.
Every tenant — including each reseller's own customers — is provisioned
into a dedicated Postgres schema. Isolation sits at the schema boundary,
so a forgotten WHERE clause cannot spill one customer into
another. Routes resolve their database handle through a helper that throws
rather than quietly falling back to the shared schema.
Schematenant_<slug>
All autonomous execution funnels through a single gate. That isn't a convention people have to remember — a guard walks the require graph at build time and fails if any path from autonomous code reaches the executor without passing through it. Authority lives in each tenant's own schema too, so no admin can widen another tenant's limits.
GateassertAutonomyAllowed()
The browser never talks to a provider. It posts an intent, and the server
builds the request, decrypts and injects the right credentials, follows
redirects under SSRF checks, and returns what actually came back. Token
endpoints are the interesting exception — inject a stale bearer into
/oauth/token and the provider rejects it, so those receive
nothing.
RoutePOST /api/execute
Scale
Tests are mutation-checked rather than trusted: a tool flips one token at a time in the source and reports anything the suite failed to notice. It exists because a vacuous test — one that passes whatever the code does — reviews exactly like a good one.