Connector catalogue
“Typical” names a protocol/product family, not a promise that every edition exposes a supported
API. Customer/proprietary/regulator interfaces remain unverified until current documentation and
test access are supplied.
| System/category | Typical protocol/product | Data/direction | Auth/trigger/latency | Failure/reconciliation | PII/deployment | MVP |
|---|---|---|---|---|---|---|
| web/mobile | REST, TS client, native bridge | notice/consent both ways | OAuth/public signed context; real time | idempotency/offline sync | minimal refs; public edge | TS API/client |
| tag manager/API gateway | GTM-like, Kong/Apigee-class | policy events/config out | signed config; near real time | version pin and rollback | avoid raw request bodies | generic webhook |
| workforce/customer IAM | OIDC/SAML/SCIM, CIAM | users/groups/identity result | OIDC/SCIM; event/batch | deprovision drift report | identity metadata | OIDC; SCIM later |
| CRM/CDP/marketing | Salesforce-class, REST/bulk | preference/suppression/tasks | OAuth; event/batch | cursor and destination proof | high identity exposure | generic task/webhook |
| contact centre/IVR | SIP/CTI/vendor API, recording refs | assisted intake/messages | service OAuth; real time | call reference/manual fallback | recordings stay source | task adapter |
| SMS/email/WhatsApp | DLT/provider APIs | notification out/delivery in | API key/OAuth; real time | provider retry and delivery status | minimal message; no sensitive detail | one provider adapter later |
| core banking | proprietary/API/file | subject lookup, task/result | mTLS/service account; batch | agent, ITSM and manifest | high PII; bank boundary | adapter contract only |
| LOS/LMS/cards/payments | REST/SOAP/MQ/file | purpose, request, delete/suppress | mTLS/OAuth; event/batch | per-record acknowledgement | high PII; regulated | generic task |
| KYC/AML/fraud/bureau | proprietary/regulator contracts | verification/result/case | mTLS; synchronous/batch | no automatic destructive retry | very high sensitivity | interface unverified |
| Account Aggregator | ecosystem APIs/artefacts | consent/instruction/data route | ecosystem security; real time | ecosystem-specific reconciliation | do not conflate DPDP | later adapter |
| insurance admin/claims/TPA | proprietary/SOAP/REST/file | case/task/record refs | mTLS/service account | agent/manual proof | health/financial | contract only |
| HIS/EHR/LIMS/PACS/pharmacy | FHIR/HL7/DICOM/vendor APIs | lookup/correct/export task | local auth; batch/on demand | provenance-preserving task | health stays local | FHIR adapter later |
| ABHA/ABDM | published participant interfaces | consent/exchange references | programme auth | ecosystem receipts/errors | health data plane | unverified until role/docs |
| SAP/ERP/dealer | OData/BAPI/IDoc/API | employee/vendor/customer tasks | service account; batch | change document/reconcile | enterprise PII | generic ITSM |
| HRIS/payroll/attendance | REST/SFTP/vendor | subject/tasks/results | OAuth/file key; batch | manifest/manual exception | employee/biometric | CSV/task |
| industrial IoT/CCTV/access | MQTT/OPC UA/vendor VMS | metadata/retention task | device/service cert | site agent/manual | avoid footage/control plane | inventory only |
| PostgreSQL/MySQL | metadata/SQL adapter | schema in; tasks local | read-only DB/mTLS; batch | cursor/checkpoint | raw values local | PostgreSQL metadata |
| Oracle/SQL Server | metadata catalog/JDBC | schema in; tasks local | read-only DB; batch | checkpoint/agent | raw values local | later |
| MongoDB | metadata/sample-disabled | collections/fields in | scoped user; batch | cursor/retry | local agent | later |
| Elasticsearch/OpenSearch | index mapping/API | mappings/tasks | scoped token; batch | PIT/cursor | indexes may duplicate PII | later |
| Kafka/queues | Kafka/AMQP | events both ways | mTLS/SASL; streaming | offset, DLQ, replay | minimise payload | event SDK later |
| S3-compatible/files | S3 API/SFTP/SMB | metadata/manifest/tasks | workload identity/key | inventory cursor/manifest | object content stays local | later |
| warehouses/lakes | Snowflake/BigQuery/Redshift-class | catalog/lineage | OAuth/service identity | query budget/cursor | metadata only | later |
| AWS/Azure/GCP | resource graph, KMS, logs | inventory/evidence | workload identity; scheduled | drift snapshot | region/support metadata | later |
| Indian cloud/data centre | API where documented | inventory/evidence | customer-specific | agent/manual | sovereign constraints | contract only |
| Kubernetes/on-prem | K8s API/Helm | deployment/evidence | service account/mTLS | GitOps/health | customer boundary | required |
| ServiceNow/Jira | REST/webhook | fulfilment tasks/results | OAuth; near real time | external ID/reconcile | minimised description | one adapter |
| SIEM/SOAR | syslog/CEF/webhook/API | incident signal in/action out | mTLS/token; real time | dedupe/correlation | redact events | webhook intake |
| DLP/eDiscovery/GRC | vendor API/file | findings/holds/evidence | OAuth; batch | manifest and human review | sensitive findings | later |
| KMS/HSM/secrets | KMIP/cloud KMS/Vault | keys/secret refs | workload identity | fail closed/rotation | no secret to app logs | required |
Priority rationale
Section titled “Priority rationale”The MVP chooses PostgreSQL metadata plus generic webhook/ITSM because together they test local discovery and distributed fulfilment without betting on one proprietary core. Java adapter SDK follows early for Indian enterprise stacks; FHIR, SAP and a regulated-finance connector are developed with design partners and current interface documentation.
PII budgets
Section titled “PII budgets”Every connector has an approved field budget:
- control plane: tenant, subject ref, system/task ID, state, count, digest, timing, error class;
- customer agent transient: only fields needed to locate/act;
- evidence object: bounded/redacted artefact if necessary, encrypted and expiring;
- logs/metrics: no raw identifiers, tokens, payloads or attachments.