Connectors
A connector is a configured HTTP endpoint that executes the actual write action on behalf of an agent. Connectors are the bridge between Relynt’s policy decisions and your target systems.
How connectors work
- An agent sends a request to the Relynt gateway
- The policy engine evaluates the request and returns
allow(or an approval is granted) - Relynt forwards the action to the configured connector
- The connector executes the HTTP call against the target system
- The response is hashed and stored in the receipt
Policy allows → Connector executes → Response hashed → Receipt createdGeneric HTTP connector
In v0, Relynt provides a generic HTTP connector that can be configured per organization. This connector makes HTTP requests to any target API.
Configuration
Each organization configures its connector with:
| Field | Description |
|---|---|
base_url | The base URL of the target API |
headers | Default headers to include (e.g., API keys) |
timeout_ms | Request timeout in milliseconds |
Connector credentials (API keys, tokens) are stored encrypted and are never exposed in logs, receipts, or the dashboard. Only the response_hash is recorded.
When connectors execute
Connectors are called only when the decision is allow:
| Scenario | Connector called? |
|---|---|
Policy returns allow | Yes |
Policy returns deny | No |
Policy returns require_approval, approval granted | Yes |
Policy returns require_approval, approval denied | No |
| Policy evaluation error | No |
Response hashing
After the connector executes, Relynt computes a SHA-256 hash of the response body and stores it as response_hash in the receipt. This allows you to verify what the target system returned without storing the full response.
{
"response_hash": "sha256:e5f6g7h8..."
}Security
- No secrets in receipts —
Authorizationheaders and API keys are never stored in receipts or logs - No secrets in responses — connector configuration secrets are redacted from all API responses
- Encrypted storage — connector credentials are encrypted at rest
- Scoped to organization — each organization has its own connector configuration