Connecting Your Systems with Integrations

The Integrations Hub is where a tenant administrator connects GrndCtrl to the systems your team already uses, and controls exactly what each extension is allowed to do. This article covers connecting a source and approving access.

Developer-admin access required for most of this page. The Connected integrations and Audit tabs require the developer-admin role. The Composite tables tab is open to any tenant admin. If you are a tenant admin without the developer-admin role, Composite tables is the only tab you will see.

Before you begin. The Integrations Hub is admin-only, and it — plus any integration you connect — has to be enabled with your group granted access, after which you may need to sign out and back in. If the Hub is missing from your navigation, or you see "Access Denied," start with Getting Access to Apps and Extensions.

What the Integrations Hub Is

Open Integrations Hub from the admin navigation. Its subtitle sums it up: "Connected integration extensions and tenant-defined composite tables."

An integration is an extension that connects GrndCtrl to an outside system and publishes source tables your other extensions can use. Each integration's display name comes from the integration itself — for example Google Sheets or Microsoft Graph. As new integrations are installed, they appear here the same way.

GrndCtrl Services. The platform's own built-in services appear as a pinned GrndCtrl Services entry at the top of the list. That's where platform features, such as directory sync and photos, request access.

The Three Tabs

Tab	What it's for
Connected integrations	Installed integrations, their credentials, and which extensions may use them. Developer-admin only.
Audit	A read-only record of what's allowed, plus the daily conformance findings, with revoke controls. Developer-admin only.
Composite tables	Tenant-defined joins and aggregations over your sources. Any tenant admin — covered in its own article.

Connecting a Source (Credentials)

Select an integration from the left rail. Its page opens on a row of tabs — Credentials, Synced data, Key columns, Consumers, and Settings. Start with Credentials. This is how the integration authenticates to the outside system, and what you see depends on the integration:

• Publisher-supplied (for example, Google Sheets). The credential is provisioned automatically, and the tab reads "there is nothing to create or edit here." You'll see the credential listed with the scopes it uses, and you connect your own account through it. Needing separate credentials is a conversation with the publisher, not a setting.
• Tenant-connected. Other integrations let you add your own credential: click Add credential, name it (for example primary), fill in the connection fields it asks for, save, then click Verify to confirm the connection and record its real scopes.

Lower on the same tab, Operations this integration serves lists what the integration can do and which credential each operation uses. The default, "Not set — resolved automatically," only resolves when exactly one of your credentials fits the operation. If two or more could, it cannot choose and the calls fail — "automatic resolution cannot choose between them and calls will fail. Pick one." Who may call those operations is approved separately, on the Consumers tab below.

A credential grants nothing on its own. It is just a connection. Nothing runs until you approve who may use it on the Consumers tab.

Synced Data and Key Columns

Between Credentials and Consumers sit two read-only tabs that help you before you build anything on an integration.

Synced data shows "what this integration is returning right now, so you can see the shape before you build a composite on it." Search the rows and toggle Compact / Full text. It's how you sanity-check the actual data first.

Key columns are "columns you can join and group by in composite tables. Each one is indexed, so there is a fixed number available per worksheet." Pick a worksheet and set up the keys you'll later join or group on. The tab tracks how many are set up — for example, "2 of 8."

Approving What an Extension Can Do (Consumers)

Open the integration's Consumers tab, titled "Extensions using this integration." A consumer — another extension, or a platform service — first declares that it wants to use this integration in its own manifest; it then appears here for your approval. Until one does, the tab reads "Nothing has declared it uses [this integration] yet." When a consumer appears, this is where you approve, one by one, what it may do. Nothing it requests runs until you approve it here.

Each capability the integration offers is an operation with a direction:

• read — Reads data out of the source.
• write — Writes data back to a target.
• action — Performs an action, for example sending something.

1. Find the consumer's card and click Approve on the specific operation it needs.
2. For read access you can choose "Only the operations approved below" or the blanket "All read operations — including ones added later." Write and action operations are always approved individually, never by the blanket.
3. Optionally set the Credential that serves this consumer. The default is "Not set — resolved automatically," which resolves only when exactly one credential fits; if several could, pick one explicitly or the call fails.
4. If an operation takes parameters, set its Resource patterns to scope exactly what it can touch (for example /users/*/calendar/*). The hint reads: "* = one segment · ** = any remainder · empty = reads nothing."

Approve the least you can. Start with only the operations an extension truly needs and the narrowest credential. You can always add more later.

The Audit Tab: Findings, Sync Health, and Alerts

The Audit tab is the tenant's operational record. Approvals aren't managed here — they live on each integration's page — and the only action on this tab takes access away. It is a left rail (audit findings, then all-integrations sync history, then one entry per integration) with a Run the audit now button and a Refresh, and it covers four things:

• Audit findings — What the daily credential-conformance audit found: traffic that resolved a credential outside the instance model. It runs daily, or on demand, and a finding clears once its traffic ages out of the window.
• Sync history — Every sync across every integration, with a health strip. This is your main "did it run?" view, and the one place to spot an integration that quietly stopped syncing.
• What went wrong — Refused calls and failed rows, kept until you deal with them, unlike the history, which ages out.
• Alerting — Who gets emailed when a sync fails, a Teams webhook, and per-integration mute. Worth setting up so failures don't pass silently.

Looking for "Approved services"? Platform features such as directory sync and Teams notifications are approved on the Connected integrations tab under the pinned GrndCtrl Services entry — not on the Audit tab. The switch for where your directory and profile photos come from lives in Administration → Brix Access.

Related Articles

• Composite Tables: Combining Your Data — Join and roll up your synced sources into governed tables
• Getting Access to Apps and Extensions — Start here if the Hub is missing or you see "Access Denied"
• Administration — Users, groups, extensions, and Brix Access

---

Questions? Contact our support team at [e-mail]