Connectors
Systeme verbinden, mit DSGVO-Kontrollen
Wofür sie gedacht ist
Connect other systems to the instance and let people connect their own accounts, with the controls that support GDPR compliance built in. Nothing leaves or enters without a recorded legal basis and a field allowlist; personal data goes out as keyed pseudonyms unless you decide otherwise, the sensitive classes stay withheld, every flow is logged without its payload, and withdrawing consent disconnects the service and purges its credentials. A processing register for Article 30 is generated from the connections. It provides technical controls; it is not legal advice or a certification, and the catalogue says for every service how much of it is implemented.
Was das Paket leistet und was nicht
Connect external systems and let people connect their own accounts, with the controls that support GDPR compliance built in.
Modelle
connector_provider
A service or protocol a connection can use, from the catalogue shipped with obop
Lesegruppe: connectors.user. Schreibgruppe: connectors.admin.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
name | text | none | nein | connectors.user | im Klartext | Name of the provider |
category | select (generic, messaging, payments, developer, calendar_contacts, automation) | none | nein | connectors.user | im Klartext | Kind of service |
maturity | select (working, generic_adapter, definition_only) | none | nein | connectors.user | im Klartext | How much of it exists: working, generic adapter or definition only |
engine | select (webhook_out, webhook_in, rest_pull, csv_export, none) | none | nein | connectors.user | im Klartext | The generic engine that runs it |
auth_kind | select (api_key, bearer_token, basic, oauth2, webhook_in, webhook_out, none) | none | nein | connectors.user | im Klartext | How the connection authenticates |
direction | select (inbound, outbound, both) | none | nein | connectors.user | im Klartext | Whether data flows in, out or both ways |
max_classes | text | none | nein | connectors.user | im Klartext | Data classes the provider may receive at most, comma separated |
purpose | longtext | none | nein | connectors.user | im Klartext | What the provider is used for |
description | longtext | none | nein | connectors.user | im Klartext | How it works and what is tested |
legal_name | text | none | nein | connectors.user | im Klartext | Legal name of the recipient (sub-processor information) |
country | text | none | nein | connectors.user | im Klartext | Country of the recipient |
dpa_url | text | none | nein | connectors.user | im Klartext | Where the provider publishes its data processing agreement |
eu_adequate | select (yes, no, verify) | none | nein | connectors.user | im Klartext | Whether transfers rest on EU or adequate-country processing: yes, no or verify with the provider |
verify_note | longtext | none | nein | connectors.user | im Klartext | What to confirm with the provider before relying on these facts |
allowed_hosts | text | none | nein | connectors.user | im Klartext | Hosts the provider connects to, comma separated; empty means the connection names its own |
config_fields | longtext | none | nein | connectors.user | im Klartext | Settings and credentials the provider needs, as a JSON list |
setup | longtext | none | nein | connectors.user | im Klartext | Setup instructions |
webhook_scheme | select (standard, github, stripe) | none | nein | connectors.user | im Klartext | Signature scheme of inbound webhooks |
oauth_scopes | text | none | nein | connectors.user | im Klartext | OAuth scopes requested, for OAuth providers |
enabled | bool | none | nein | connectors.user | im Klartext | An administrator enabled the provider |
users_may_use | bool | none | nein | connectors.user | im Klartext | People may connect their own accounts with it |
dpa_recorded | bool | none | nein | connectors.user | im Klartext | The agreement with the provider is recorded |
legal_basis | select (consent, contract, legitimate_interest, legal_obligation) | none | nein | connectors.user | im Klartext | Legal basis the administrator set for this provider |
legal_basis_text | longtext | none | nein | connectors.user | im Klartext | Text shown to people when they are asked for consent |
provider_policy
What an administrator decided about one provider: enabled, for whom, legal basis, agreement and OAuth client
Lesegruppe: connectors.admin. Schreibgruppe: connectors.admin.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
provider | text | none | nein | connectors.admin | im Klartext | Id of the provider this policy is for |
enabled | bool | none | nein | connectors.admin | im Klartext | The provider may be connected at all |
users_may_use | bool | none | nein | connectors.admin | im Klartext | People with connectors.user may connect their own accounts |
allowed_group | text | none | nein | connectors.admin | im Klartext | Permission group that may use it; empty means connectors.user |
legal_basis | select (consent, contract, legitimate_interest, legal_obligation) | none | nein | connectors.admin | im Klartext | Legal basis recorded for connections of this provider |
legal_basis_text | longtext | none | nein | connectors.admin | im Klartext | Text shown to people when they are asked for consent |
dpa_recorded | bool | none | nein | connectors.admin | im Klartext | A data processing agreement with the provider is in place |
dpa_reference | text | none | nein | connectors.admin | im Klartext | Where the agreement is kept or its reference |
default_policy | longtext | none | nein | connectors.admin | im Klartext | Policy JSON that new connections of this provider start with |
oauth_client_id | text | internal | nein | connectors.admin | im Klartext | OAuth client id you registered with the provider |
oauth_client_secret | longtext | secret | nein | connectors.admin | zurückgehalten | OAuth client secret; write-only, stored encrypted |
connection
A link to one external system, with its credentials, field allowlist, policy and state
Lesegruppe: connectors.user. Schreibgruppe: connectors.user.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
name | text | none | nein | connectors.user | im Klartext | A name that tells you what the connection is for |
provider | text | none | nein | connectors.user | im Klartext | Id of the provider from the catalogue |
owner_scope | select (instance, user) | none | nein | connectors.user | im Klartext | Whether the connection belongs to the instance or to one person |
owner_user | text | internal | ja | connectors.user | maskiert | The person who owns the connection |
owner_groups | text | none | nein | connectors.admin | im Klartext | Permission groups the owner held when the connection was last changed |
state | select (draft, connected, paused, error, revoked) | none | nein | connectors.user | im Klartext | Where the connection is: draft, connected, paused, error or revoked |
config | longtext | none | nein | connectors.user | im Klartext | Non-secret settings as a JSON object |
credentials | longtext | secret | nein | connectors.user | zurückgehalten | Credentials as a JSON object; write-only, stored encrypted, never returned |
credentials_hint | text | none | nein | connectors.user | im Klartext | Whether credentials are set, with at most the last four characters |
oauth_tokens | longtext | secret | nein | connectors.user | zurückgehalten | OAuth tokens; write-only, stored encrypted, never returned |
field_allowlist | longtext | none | nein | connectors.user | im Klartext | Fields that may leave or be accepted, as a JSON object of model to field names; empty means nothing |
policy | longtext | none | nein | connectors.user | im Klartext | Treatment overrides by class or field and impact-assessment acknowledgements, as JSON |
rate_limit_per_hour | number | none | nein | connectors.user | im Klartext | Most flows per hour |
volume_cap_per_day | number | none | nein | connectors.user | im Klartext | Most records per day |
retention_days | number | none | nein | connectors.user | im Klartext | Days flow logs and runs are kept |
created_at | text | none | nein | connectors.user | im Klartext | When the connection was created |
last_sync_at | text | none | nein | connectors.user | im Klartext | When the connection last ran |
last_error | text | none | nein | connectors.user | im Klartext | Summary of the last failure, without payloads |
result | longtext | none | nein | connectors.user | im Klartext | Output of the last command (test, sync, authorisation link); never stored |
consent
The legal basis recorded for a connection: who, why, which data classes, and whether it was withdrawn
Lesegruppe: connectors.user. Schreibgruppe: connectors.user.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
connection | ref → connection | none | nein | connectors.user | im Klartext | The connection this basis is for |
owner_user | text | internal | ja | connectors.user | maskiert | Owner of the connection |
state | select (active, withdrawn, superseded) | none | nein | connectors.user | im Klartext | active, withdrawn, or superseded by a newer record |
subject_kind | select (user, party, instance) | none | nein | connectors.user | im Klartext | Whose basis it is: a user, a party or the instance |
subject | text | internal | ja | connectors.user | maskiert | Id of the party when the subject is a party |
given_by | text | internal | ja | connectors.user | maskiert | Who recorded it |
purpose | longtext | none | nein | connectors.user | im Klartext | The purpose the data is processed for |
legal_basis | select (consent, contract, legitimate_interest, legal_obligation) | none | nein | connectors.user | im Klartext | consent, contract, legitimate interest or legal obligation |
note | longtext | none | nein | connectors.user | im Klartext | Explanation; for legitimate interest the balancing test |
classes | text | none | nein | connectors.user | im Klartext | Data classes that may flow under this record, computed from the connection |
fields_summary | longtext | none | nein | connectors.user | im Klartext | Models and fields that may flow, computed from the connection |
recorded_at | text | none | nein | connectors.user | im Klartext | When it was recorded |
withdrawn_at | text | none | nein | connectors.user | im Klartext | When it was withdrawn, if it was |
withdrawn_by | text | internal | ja | connectors.user | maskiert | Who withdrew it |
sync_run
One run of a connection: when, how many records, and how it ended; never the data
Lesegruppe: connectors.user. Schreibgruppe: connectors.admin.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
connection | ref → connection | none | nein | connectors.user | im Klartext | The connection that ran |
owner_user | text | internal | ja | connectors.user | maskiert | Owner of the connection |
direction | select (inbound, outbound) | none | nein | connectors.user | im Klartext | Whether data went out or came in |
kind | select (manual, event, pull, webhook, test) | none | nein | connectors.user | im Klartext | What started it |
started_at | text | none | nein | connectors.user | im Klartext | When it started |
finished_at | text | none | nein | connectors.user | im Klartext | When it ended |
status | select (running, succeeded, partial, failed, retrying, dead_letter) | none | nein | connectors.user | im Klartext | How it ended |
records | number | none | nein | connectors.user | im Klartext | Records sent or accepted |
rejected | number | none | nein | connectors.user | im Klartext | Records refused |
proposed | number | none | nein | connectors.user | im Klartext | Changes held for approval |
error_summary | text | none | nein | connectors.user | im Klartext | Why it failed, without payloads |
data_flow_log
Append-only record of every flow: when, what, how many, which fields, how treated, and a hash of the payload; never the payload
Lesegruppe: connectors.user. Schreibgruppe: connectors.admin.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
connection | ref → connection | none | nein | connectors.user | im Klartext | The connection the flow belongs to |
owner_user | text | internal | ja | connectors.user | maskiert | Owner of the connection |
at | text | none | nein | connectors.user | im Klartext | When it happened |
direction | select (outbound, inbound) | none | nein | connectors.user | im Klartext | Whether data went out or came in |
model | text | none | nein | connectors.user | im Klartext | The model the records belong to |
record_count | number | none | nein | connectors.user | im Klartext | How many records |
fields_sent | text | none | nein | connectors.user | im Klartext | Fields that left or were accepted, comma separated |
fields_denied | text | none | nein | connectors.user | im Klartext | Fields the policy withheld, comma separated |
masking_mode | text | none | nein | connectors.user | im Klartext | Treatments applied, for example pseudonymise=2;allow=1 |
payload_hash | text | none | nein | connectors.user | im Klartext | SHA-256 of the payload after treatment |
outcome | select (released, received, refused, rejected, erased) | none | nein | connectors.user | im Klartext | released, received, refused, rejected or erased |
reason | text | none | nein | connectors.user | im Klartext | Why a flow was refused or a record rejected |
processing_register
The record of processing activities (GDPR Article 30) generated from the connections; exportable as CSV
Lesegruppe: connectors.admin. Schreibgruppe: connectors.admin.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
connection | ref → connection | none | nein | connectors.admin | im Klartext | The connection this row describes |
name | text | none | nein | connectors.admin | im Klartext | Name of the connection |
state | text | none | nein | connectors.admin | im Klartext | State of the connection |
owner_scope | text | none | nein | connectors.admin | im Klartext | Instance or user |
owner_user | text | internal | ja | connectors.admin | maskiert | Owner of the connection |
provider | text | none | nein | connectors.admin | im Klartext | Provider id |
recipient | longtext | none | nein | connectors.admin | im Klartext | Who receives the data (legal name) |
recipient_country | text | none | nein | connectors.admin | im Klartext | Where the recipient is |
purpose | longtext | none | nein | connectors.admin | im Klartext | Purpose of the processing |
legal_basis | text | none | nein | connectors.admin | im Klartext | Recorded legal basis |
consent_recorded_at | text | none | nein | connectors.admin | im Klartext | When the basis was recorded |
data_subjects | longtext | none | nein | connectors.admin | im Klartext | Categories of data subjects |
personal_data_categories | longtext | none | nein | connectors.admin | im Klartext | Categories of personal data, with class and treatment |
transfer_basis | longtext | none | nein | connectors.admin | im Klartext | Basis for transfers to third countries |
agreement_recorded | text | none | nein | connectors.admin | im Klartext | Whether the agreement with the recipient is recorded |
retention_days | text | none | nein | connectors.admin | im Klartext | Retention of logs, in days |
safeguards | longtext | none | nein | connectors.admin | im Klartext | Technical and organisational measures |
csv | longtext | none | nein | connectors.admin | im Klartext | The register as CSV; filled by the export command, never stored |
egress_policy
Instance-wide switches for data flows: the master switch, EU-only providers, the agreement requirement and the host allow-list
Lesegruppe: connectors.admin. Schreibgruppe: connectors.admin.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
flows_enabled | bool | none | nein | connectors.admin | im Klartext | Master switch: when off nothing leaves and nothing is accepted |
eu_only | bool | none | nein | connectors.admin | im Klartext | Personal data only goes to providers with an EU or adequacy basis |
require_dpa | bool | none | nein | connectors.admin | im Klartext | Personal data, even pseudonymised, only goes to providers whose agreement is recorded |
host_allowlist | text | none | nein | connectors.admin | im Klartext | Hosts connections may reach, comma separated; empty means no extra restriction |
default_retention_days | number | none | nein | connectors.admin | im Klartext | Retention for logs of connections that no longer exist |
result | longtext | none | nein | connectors.admin | im Klartext | Output of the last command (checklist, purge); never stored |
privacy_preview
What a sample outbound record looks like after the policy: the exact payload and the treatment of each field
Lesegruppe: connectors.user. Schreibgruppe: connectors.user.
| Feld | Art | Datenklasse | Personenbezogene Daten | Gruppe | Agenten sehen | Beschreibung |
|---|---|---|---|---|---|---|
provider | text | none | nein | connectors.user | im Klartext | Provider the preview is for |
connection | text | none | nein | connectors.user | im Klartext | An existing connection to preview, instead of a provider |
target_model | text | none | nein | connectors.user | im Klartext | The model to preview |
record_id | text | none | nein | connectors.user | im Klartext | A record to use as the sample; empty means the first one |
field_allowlist | longtext | none | nein | connectors.user | im Klartext | Fields to include, as a JSON object of model to field names |
policy | longtext | none | nein | connectors.user | im Klartext | Policy JSON to preview |
payload | longtext | none | nein | connectors.user | im Klartext | The payload after treatment, as JSON; never stored |
treatments | longtext | none | nein | connectors.user | im Klartext | Each field with its class and treatment, as JSON; never stored |
Workflows
connection
| Aktion | Bewegt | Wer sie ausführen darf | Freigabe |
|---|---|---|---|
connection.connect | state: draft → connected | connectors.user | ja |
connection.pause | state: connected → paused | connectors.user | ja |
connection.resume | state: paused → connected | connectors.user | ja |
connection.retry | state: error → connected | connectors.user | ja |
connection.revoke | state: * → revoked | connectors.user | ja |
connection.test | - | connectors.user | nein |
connection.sync | - | connectors.user | ja |
connection.oauth_start | - | connectors.user | nein |
consent
| Aktion | Bewegt | Wer sie ausführen darf | Freigabe |
|---|---|---|---|
consent.withdraw | state: active → withdrawn | connectors.user | ja |
processing_register
| Aktion | Bewegt | Wer sie ausführen darf | Freigabe |
|---|---|---|---|
processing_register.export_csv | - | connectors.admin | nein |
egress_policy
| Aktion | Bewegt | Wer sie ausführen darf | Freigabe |
|---|---|---|---|
egress_policy.checklist | - | connectors.admin | nein |
egress_policy.purge | - | connectors.admin | ja |
privacy_preview
| Aktion | Bewegt | Wer sie ausführen darf | Freigabe |
|---|---|---|---|
privacy_preview.render | - | connectors.user | nein |
Berechtigungsgruppen
Von dieser App verwendete Gruppen:
connectors.adminconnectors.user
Freigabeschritte
Schritte, die ein Agent nur vorschlagen kann:
connection.connectconnection.pauseconnection.resumeconnection.retryconnection.revokeconnection.syncconsent.withdrawegress_policy.purge
Was Agenten tun können und was nicht
Ein Agent kann Datensätze dieser App lesen, durchsuchen, anlegen und aktualisieren sowie Aktionen ausführen, die keine Freigabe brauchen, und zwar innerhalb der Berechtigungsgruppen seines Tokens.
Diese Schritte kann er nur vorschlagen, und eine Person muss sie freigeben: connection.connect, connection.pause, connection.resume, connection.retry, connection.revoke, connection.sync, consent.withdraw, egress_policy.purge, connector_provider.delete, provider_policy.delete, connection.delete, consent.delete, sync_run.delete, data_flow_log.delete, processing_register.delete, egress_policy.delete, privacy_preview.delete.
Personenbezogene Daten werden als Platzhalter maskiert: connection.owner_user, consent.owner_user, consent.subject, consent.given_by, consent.withdrawn_by, sync_run.owner_user, data_flow_log.owner_user, processing_register.owner_user.
Diese Felder werden Agenten vollständig vorenthalten: provider_policy.oauth_client_secret, connection.credentials, connection.oauth_tokens.
Abhängigkeiten
Keine.
Installation
Integriert. Sie ist in jeder Instanz verfügbar und kann nicht entfernt werden.
Selbst bauen
Der Modulleitfaden zeigt, wie Apps wie diese geschrieben werden