API connections · Ledgerly
Outbound connections this app makes — third-party APIs and in-container services. Secrets live in the encrypted vault and never reach the browser.
| Connection | Endpoint | Auth | Status | |
|---|---|---|---|---|
| Stripe | api.stripe.com | ApiKey | Connected | |
| SendGrid | api.sendgrid.com | ApiKey | Connected | |
| HubSpot | api.hubapi.com | OAuth2 | Needs re-auth | |
| Container: doc-parser | 10.32.0.14:8443 (in-VPC) | mTLS | Healthy |
Terminology — four distinct things
API clients
External systems calling into BuildWithHQ. Keys, scopes, rotation. (Its own page.)
API connections
BuildWithHQ calling out to third-party APIs. Credentials in the encrypted vault; this page.
Container services
Custom code inside the customer's isolated appliance VMs, reached via declared endpoints + egress policy.
Actions
JSON-defined orchestration that may call any of the above through the schema-driven gateway.
The outbound direction: services your product reaches out to — third-party APIs and add-on services running alongside it. Stored secrets show only as “configured”; the values themselves never travel back to the browser.
Behind this page/apps/:saasAppId/api-connections · CanManageIntegrations
Retrieve
sp_Builder_ListIntegrations over ExternalIntegrations (name, base endpoint, AuthType, status, secret-configured flag — EncryptedSecret omitted). Container services resolve from ApplianceVersionEndpoints + egress policy.Save
Add/edit →sp_Builder_UpsertIntegration (secret encrypted at rest). Request tester, retry/timeout policy, circuit-breaker state, and full OAuth flows are roadmap — no schema yet; do not fake them.Success
- Directionality is explicit: this page is outbound only.
- Vault-backed secrets, redacted test results.
- Container calls obey the appliance egress allowlist.
CLI handoff
Implement this scaffold from the structured contract, then remove hard-coded preview rows. The source of truth is CLI Handoff and admin-cli-manifest.json.
Server-inject identity and scope values; never trust browser-supplied account, app, tenant, user, entitlement, price, or permission identifiers. Preserve the loading, empty, forbidden, failed, retrying, and completed states shown by the preview.