Integrations

Workspaces reach external systems through two separate resources. Connections move documents in and out. Providers are the inference services the platform calls during detection. They are distinct resources with their own endpoints — an LLM is not a connection.

Connections

object_store and file_service — move documents in and out of a workspace

Providers

openai, anthropic, ollama — back AI-driven detection

Connections

A connection holds a provider, its credentials, and — for object stores — a sync schedule. Its connectionType is its capability category:

Type	Providers	How it transfers
`object_store`	`s3`, `azure`, `gcs`	Enumerable; syncs on a timer or on demand
`file_service`	`google_drive`, `dropbox`, `one_drive`, `box`	OAuth-backed; transfers on demand

Creating an Object-Store Connection

POST /workspaces/{workspaceId}/connections

The body carries a displayName, a typed config, and optionally isActive and a sync schedule. The provider tag inside the config selects the variant, and thereby which credential shape is required.

const connection = await client.connections.createConnection(workspaceId, {
  displayName: "Archive bucket",
  config: {
    provider: "s3",
    credentials: { /* S3 credentials */ },
    rootPath: "contracts/",
  },
});

Field	Required	Description
`provider`	Yes	`s3`, `azure`, or `gcs`
`credentials`	Yes	Provider credentials; the shape follows the `provider` tag
`rootPath`	No	Prefix within the bucket or container; keys resolve relative to it

Credentials are encrypted at rest and never returned in API responses. A connection response carries only metadata — provider, connectionType, isActive, lastSyncedAt, and the sync schedule when one is configured.

Connecting a Cloud File Service

File services are OAuth-backed, so there are no credentials to supply. Start the flow, send the user to the returned authorizeUrl, and the connection is created when the provider redirects back:

POST /workspaces/{workspaceId}/connections/oauth/{provider}/start

const { authorizeUrl } = await client.connections.startFileServiceOAuth(
  workspaceId,
  "google_drive",
  { displayName: "Team Drive" },
);

Navigate the browser to authorizeUrl as a full-page redirect, not a fetch — the provider’s consent screen cannot be loaded cross-origin.

An OAuth provider is offered only when its app is configured on the server. Ask the deployment which connectors it can create rather than probing:

const connectors = await client.capabilities.listConnectors();

Verifying a Connection

Check reachability before relying on a connection:

POST /workspaces/{workspaceId}/connections/{connectionId}/verify

The response contains reachable and, on failure, an error.

Verify after any credential rotation. A connection that stops being reachable will surface as failed syncs rather than an obvious error.

Syncing Documents

How a connection transfers depends on its type.

Object Stores

An object store is enumerable, so it syncs the whole listing — on a schedule or on demand:

POST /workspaces/{workspaceId}/connections/{connectionId}/sync
GET  /workspaces/{workspaceId}/connections/{connectionId}/syncs
GET  /workspaces/{workspaceId}/syncs

Field	Description
`syncMode`	Required. `import` pulls into the workspace; `export` pushes out
`scheduleCron`	Cron expression for scheduled imports; omit for manual-only
`deletionPolicy`	`ignore` (default) or `delete` when a source object disappears

await client.connections.updateConnection(workspaceId, connectionId, {
  sync: {
    syncMode: "import",
    scheduleCron: "0 * * * *",
    deletionPolicy: "ignore",
  },
});

deletionPolicy: "delete" soft-deletes the imported document and removes its stored object when the source object is gone. The default ignore keeps imports strictly additive, so a transient listing error or a misconfigured rootPath can never remove documents.

A sync schedule is accepted only for schedulable providers — object stores. It is rejected for a file service, which transfers on demand.

File Services

A file service is not enumerated on a timer. Import is picker-driven: the user picks files in the provider’s own picker, and you pass the selection through. Export writes each redacted output as a new provider file, never overwriting the source.

POST /workspaces/{workspaceId}/connections/{connectionId}/import
POST /workspaces/{workspaceId}/connections/{connectionId}/export
POST /workspaces/{workspaceId}/connections/{connectionId}/picker-token

const sync = await client.connections.importFiles(workspaceId, connectionId, {
  files: [{ id: "<provider file id>", name: "contract.pdf" }],
});

await client.connections.exportFiles(workspaceId, connectionId, {
  fileIds: [outputDocumentId],
});

Already-imported files are skipped; an export always writes a fresh copy. Both return the created sync — poll it for completion. For a browser picker that needs a provider token, getPickerToken mints a short-lived one from the connection’s stored credentials; the refresh token is never returned.

Sync Status

A sync record reports status, triggerType, recordsSynced, attempt, startedAt, and errorMessage on failure.

Status	Meaning
`pending`	Queued
`running`	In progress
`completed`	Finished successfully
`failed`	Failed — see `errorMessage`
`cancelled`	Cancelled by a user

triggerType is scheduled when the connection’s own schedule started it, or on_demand for everything else — a user, the SDK, or an external automation. Cancel a running sync with:

POST /workspaces/{workspaceId}/connections/{connectionId}/syncs/{syncId}/cancel

Providers

Inference providers are a separate resource. A provider is an LLM or NER service the platform calls; its providerType is llm or ner.

GET    /workspaces/{workspaceId}/providers
POST   /workspaces/{workspaceId}/providers
PATCH  /workspaces/{workspaceId}/providers/{providerId}
DELETE /workspaces/{workspaceId}/providers/{providerId}
POST   /workspaces/{workspaceId}/providers/{providerId}/verify

const provider = await client.providers.createProvider(workspaceId, {
  displayName: "Detection model",
  config: {
    provider: "anthropic",
    apiKey: "...",
    defaultModel: "claude-sonnet-4-5",
  },
});

const provider = await client.providers.createProvider(workspaceId, {
  displayName: "Detection model",
  config: {
    provider: "openai",
    apiKey: "...",
    baseUrl: "https://gateway.example.com/v1",
  },
});

const provider = await client.providers.createProvider(workspaceId, {
  displayName: "Local inference",
  config: {
    provider: "ollama",
    baseUrl: "http://localhost:11434",
    defaultModel: "llama3",
  },
});

Field	Required	Description
`provider`	Yes	`openai`, `anthropic`, or `ollama`
`apiKey`	Yes, except `ollama`	Provider API key
`baseUrl`	Required for `ollama`	Base URL of the server; optional elsewhere to reach a compatible endpoint or proxy
`defaultModel`	No	Model used when a request does not specify one

ollama carries no secret — it is addressed by a caller-supplied baseUrl, which is the self-hosted option. openai and anthropic accept an optional baseUrl for gateways and compatible endpoints.

Like connections, a provider’s config is encrypted at rest and never returned. Verify reachability the same way, with verifyProvider.

Webhooks

GET    /workspaces/{workspaceId}/webhooks
POST   /workspaces/{workspaceId}/webhooks
POST   /workspaces/{workspaceId}/webhooks/{webhookId}/test
DELETE /workspaces/{workspaceId}/webhooks/{webhookId}

A webhook names the events it should receive — among them document.created, connection.sync.completed, connection.sync.failed, provider.updated, review.opened, and review.verified. Creating one returns its signing secret once; use the test endpoint to confirm delivery before depending on it.

Managing Connections

GET    /workspaces/{workspaceId}/connections
GET    /workspaces/{workspaceId}/connections/{connectionId}
PATCH  /workspaces/{workspaceId}/connections/{connectionId}
DELETE /workspaces/{workspaceId}/connections/{connectionId}

Connection and provider lists accept a provider filter, and workspace-wide syncs also accept status. Set isActive: false to pause a connection or a provider without deleting it — scheduled syncs stop, and the configuration is retained.

Next Steps

API Reference

Connection, provider, and sync endpoints

TypeScript SDK

connections, providers, syncs, and webhooks

Overview

Features

Cloud

On-Premise

Integrations

Connections

Providers

Connections

Creating an Object-Store Connection

Connecting a Cloud File Service

Verifying a Connection

Syncing Documents

Object Stores

File Services

Sync Status

Providers

Webhooks

Managing Connections

Next Steps

API Reference

TypeScript SDK

Connections

Providers

​Connections

​Creating an Object-Store Connection

​Connecting a Cloud File Service

​Verifying a Connection

​Syncing Documents

​Object Stores

​File Services

​Sync Status

​Providers

​Webhooks

​Managing Connections

​Next Steps

API Reference

TypeScript SDK

Connections

Creating an Object-Store Connection

Connecting a Cloud File Service

Verifying a Connection

Syncing Documents

Object Stores

File Services

Sync Status

Providers

Webhooks

Managing Connections

Next Steps