Integrations and APIs
- 100 %
- inside your org
- 0
- outbound data by default
- 71
- controls self-assessed out of 255 catalogued
- 10 min
- to install
The French text governs. This page is the English version of Intégrations FR.
7 capabilities, and one rule governing them all: what goes out is read-only, and what comes in writes only into the product's own objects. No integration gives a third party a write path into your org.
- 7
- capabilities in this family
- 1
- active on installation day, on the Discovery offer
- Discovery
- entry tier of the family
What this family measures
The REST API is open from the Discovery offer: it returns status and findings. Its detailed sub-path — the target and the message of a finding — is closed by default, because the target may carry a user identifier and the message prose naming it. It is the one gate whose default deliberately changes the shape of the response: the detail is not deleted, it is opted into. And even when open, the query still runs with the caller's own rights.
SIEM export (Splunk, Microsoft Sentinel) and ITSM integration (ServiceNow, Jira) are included in any paid plan and go to your destination, with your credentials. Agentforce actions expose the posture to your agents read-only: query, never change. Finally, the only write the product accepts is a PATCH on one of its own incidents, so a ticketing tool can close the loop.
The 7 capabilities, one by one
| Capability | Minimum offer | At install |
|---|---|---|
REST APIREST_API · read-only; the caller sees only what its own permissions already allow | Discovery | Open |
Finding details in the REST APIREST_Findings_Detail · closed by default: the response carries neither target nor message | Discovery | Closed |
REST write on incidents (PATCH)Incident_Rest_Write · the only write the product accepts is on ITS OWN incidents, never on your org | Any paid plan | Closed |
SIEM exportSiem_Export · outbound flow to a destination you choose, with your credentials | Any paid plan | Closed |
ITSM integrationItsm_Integration · outbound flow to a destination you choose, with your credentials | Any paid plan | Closed |
Automatic ITSM ticketsItsm_Auto_Create · automatic ITSM ticket creation, closed at install and under a consent DISTINCT from the integration’s: at most ten tickets per hourly pass, a circuit breaker, and no new destination — your own ITSM’s | Any paid plan | Closed |
Agentforce actionsAgentforce_Actions · READ actions exposed to your agents: query the posture, never change it | Any paid plan | Closed |
Source: read from the package code at the moment this page is built — FeatureGate.FEATURE_TIER for the offer, FeatureGate.CODE_DEFAULTS for the state at install, and for the label the full resolution of FeatureToggleAdminController: the enablement guide’s catalogue first, the GateLabels custom labels next, and failing that the technical name as is. The editor’s labels — the whole column, not just that fallback — ship in English: master language en_US, and the package carries no translation file: these are the exact strings your administrator reads in the feature editor, and the site build fails if any of these lists moves without the others. “Closed” does not mean absent: the capability is shipped, it is waiting for a human to open it inside the org — and a capability whose implementation nothing in the package can reach appears on none of these pages: the build drops it instead of selling it.
What this family does not do
- No integration writes into your org. The only PATCH accepted is on a finding's incident inside the product.
- No inbound webhook commands a scan or changes a setting: configuration is decided inside the org, by a human.
- The credentials are yours. We store no token towards your systems; every flow goes through a named credential that you install.
- Nothing leaves by default. The three outbound integrations are closed at delivery.
The other families
Is this family in your offer? The grid says so line by line.
See the pricing grid Back to the seven families