One place that holds the credentials.
A connection is an authenticated, tested, environment-scoped link to an external system. It is created once, owned by someone, and watched continuously.
- crm-sampleREST · OAuth 2.0 · 2m agoHealthy
- postgres-prodDirect · TLS · 11s agoHealthy
- erp-sampleOData · OAuth 2.0 · 34m agoWarning
- legacy-sftpSFTP · key · 3h agoAuth required
How it works
Mechanisms, not promises.
01
Tested before it can be saved
A connection cannot be saved until a test succeeds. A failed test shows the request that was made, the raw error and a remediation hint — never “something went wrong”.
02
Credentials by reference
Secrets live in a dedicated store and are referenced by handle. They are write-only in the interface after creation, never returned by the API, and never written to a log.
03
Rotation with an overlap window
Rotating a credential keeps the previous one valid for a stated window, so a rotation never causes a failed run. The old credential’s expiry is shown on the connection.
04
Schema cache and drift detection
The object and field list is cached with types. When the cached schema differs from live, the connection raises a drift warning — and if a mapped field has disappeared, the flow errors before its next run rather than after it.
05
Scoped to an environment
A connection belongs to sandbox or to production, never both. Promoting a flow to production requires re-binding every connection reference.
States
Every state has a glyph, a label and a meaning.
Colour is the third cue, never the only one.
- Healthy
Last test succeeded and recent runs have not reported connection errors.
- Warning
Degraded latency, a partial scope, or a schema drift has been detected.
- Auth required
The credential has expired or been revoked upstream. Runs are paused rather than retried blindly.
- Disconnected
The system is unreachable. Runs fail fast and the error is attributed to the connection, not the flow.
- Disabled
Switched off deliberately. Flows that reference it will not execute.
In the API
The same thing, from a terminal.
# test a connection before saving itcurl -X POST \ https://api.zentrixquark.com/v1/connections/con_4b21/test \ -H "Authorization: Bearer zx_sk_sandbox_…" # → 200{ "status": "healthy", "latency_ms": 118, "scopes": ["read:contacts", "read:accounts"], "schema_fetched_at": "2026-09-26T13:40:02Z"}Example request and response. The API is documented ahead of implementation.
- Auth methods
- OAuth 2.0, API key, basic auth, key-pair, and direct database credentials over TLS.
- Ownership
- Every connection has a named owner, so an expiring credential has someone to notify.
- Activity
- Flows using the connection, recent runs, and the audit entries for every change made to it.
- Egress
- Workers egress through stable addresses that can be allowlisted on the customer side.