Connectors
Connecter des systèmes, avec contrôles RGPD
À quoi elle sert
Connect other systems to the instance and let people connect their own accounts, with the controls that support GDPR compliance built in. Nothing leaves or enters without a recorded legal basis and a field allowlist; personal data goes out as keyed pseudonyms unless you decide otherwise, the sensitive classes stay withheld, every flow is logged without its payload, and withdrawing consent disconnects the service and purges its credentials. A processing register for Article 30 is generated from the connections. It provides technical controls; it is not legal advice or a certification, and the catalogue says for every service how much of it is implemented.
Ce que fait et ne fait pas le paquet
Connect external systems and let people connect their own accounts, with the controls that support GDPR compliance built in.
Modèles
connector_provider
A service or protocol a connection can use, from the catalogue shipped with obop
Groupe de lecture: connectors.user. Groupe d'écriture: connectors.admin.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
name | text | none | non | connectors.user | en clair | Name of the provider |
category | select (generic, messaging, payments, developer, calendar_contacts, automation) | none | non | connectors.user | en clair | Kind of service |
maturity | select (working, generic_adapter, definition_only) | none | non | connectors.user | en clair | How much of it exists: working, generic adapter or definition only |
engine | select (webhook_out, webhook_in, rest_pull, csv_export, none) | none | non | connectors.user | en clair | The generic engine that runs it |
auth_kind | select (api_key, bearer_token, basic, oauth2, webhook_in, webhook_out, none) | none | non | connectors.user | en clair | How the connection authenticates |
direction | select (inbound, outbound, both) | none | non | connectors.user | en clair | Whether data flows in, out or both ways |
max_classes | text | none | non | connectors.user | en clair | Data classes the provider may receive at most, comma separated |
purpose | longtext | none | non | connectors.user | en clair | What the provider is used for |
description | longtext | none | non | connectors.user | en clair | How it works and what is tested |
legal_name | text | none | non | connectors.user | en clair | Legal name of the recipient (sub-processor information) |
country | text | none | non | connectors.user | en clair | Country of the recipient |
dpa_url | text | none | non | connectors.user | en clair | Where the provider publishes its data processing agreement |
eu_adequate | select (yes, no, verify) | none | non | connectors.user | en clair | Whether transfers rest on EU or adequate-country processing: yes, no or verify with the provider |
verify_note | longtext | none | non | connectors.user | en clair | What to confirm with the provider before relying on these facts |
allowed_hosts | text | none | non | connectors.user | en clair | Hosts the provider connects to, comma separated; empty means the connection names its own |
config_fields | longtext | none | non | connectors.user | en clair | Settings and credentials the provider needs, as a JSON list |
setup | longtext | none | non | connectors.user | en clair | Setup instructions |
webhook_scheme | select (standard, github, stripe) | none | non | connectors.user | en clair | Signature scheme of inbound webhooks |
oauth_scopes | text | none | non | connectors.user | en clair | OAuth scopes requested, for OAuth providers |
enabled | bool | none | non | connectors.user | en clair | An administrator enabled the provider |
users_may_use | bool | none | non | connectors.user | en clair | People may connect their own accounts with it |
dpa_recorded | bool | none | non | connectors.user | en clair | The agreement with the provider is recorded |
legal_basis | select (consent, contract, legitimate_interest, legal_obligation) | none | non | connectors.user | en clair | Legal basis the administrator set for this provider |
legal_basis_text | longtext | none | non | connectors.user | en clair | Text shown to people when they are asked for consent |
provider_policy
What an administrator decided about one provider: enabled, for whom, legal basis, agreement and OAuth client
Groupe de lecture: connectors.admin. Groupe d'écriture: connectors.admin.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
provider | text | none | non | connectors.admin | en clair | Id of the provider this policy is for |
enabled | bool | none | non | connectors.admin | en clair | The provider may be connected at all |
users_may_use | bool | none | non | connectors.admin | en clair | People with connectors.user may connect their own accounts |
allowed_group | text | none | non | connectors.admin | en clair | Permission group that may use it; empty means connectors.user |
legal_basis | select (consent, contract, legitimate_interest, legal_obligation) | none | non | connectors.admin | en clair | Legal basis recorded for connections of this provider |
legal_basis_text | longtext | none | non | connectors.admin | en clair | Text shown to people when they are asked for consent |
dpa_recorded | bool | none | non | connectors.admin | en clair | A data processing agreement with the provider is in place |
dpa_reference | text | none | non | connectors.admin | en clair | Where the agreement is kept or its reference |
default_policy | longtext | none | non | connectors.admin | en clair | Policy JSON that new connections of this provider start with |
oauth_client_id | text | internal | non | connectors.admin | en clair | OAuth client id you registered with the provider |
oauth_client_secret | longtext | secret | non | connectors.admin | non communiqué | OAuth client secret; write-only, stored encrypted |
connection
A link to one external system, with its credentials, field allowlist, policy and state
Groupe de lecture: connectors.user. Groupe d'écriture: connectors.user.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
name | text | none | non | connectors.user | en clair | A name that tells you what the connection is for |
provider | text | none | non | connectors.user | en clair | Id of the provider from the catalogue |
owner_scope | select (instance, user) | none | non | connectors.user | en clair | Whether the connection belongs to the instance or to one person |
owner_user | text | internal | oui | connectors.user | masqué | The person who owns the connection |
owner_groups | text | none | non | connectors.admin | en clair | Permission groups the owner held when the connection was last changed |
state | select (draft, connected, paused, error, revoked) | none | non | connectors.user | en clair | Where the connection is: draft, connected, paused, error or revoked |
config | longtext | none | non | connectors.user | en clair | Non-secret settings as a JSON object |
credentials | longtext | secret | non | connectors.user | non communiqué | Credentials as a JSON object; write-only, stored encrypted, never returned |
credentials_hint | text | none | non | connectors.user | en clair | Whether credentials are set, with at most the last four characters |
oauth_tokens | longtext | secret | non | connectors.user | non communiqué | OAuth tokens; write-only, stored encrypted, never returned |
field_allowlist | longtext | none | non | connectors.user | en clair | Fields that may leave or be accepted, as a JSON object of model to field names; empty means nothing |
policy | longtext | none | non | connectors.user | en clair | Treatment overrides by class or field and impact-assessment acknowledgements, as JSON |
rate_limit_per_hour | number | none | non | connectors.user | en clair | Most flows per hour |
volume_cap_per_day | number | none | non | connectors.user | en clair | Most records per day |
retention_days | number | none | non | connectors.user | en clair | Days flow logs and runs are kept |
created_at | text | none | non | connectors.user | en clair | When the connection was created |
last_sync_at | text | none | non | connectors.user | en clair | When the connection last ran |
last_error | text | none | non | connectors.user | en clair | Summary of the last failure, without payloads |
result | longtext | none | non | connectors.user | en clair | Output of the last command (test, sync, authorisation link); never stored |
consent
The legal basis recorded for a connection: who, why, which data classes, and whether it was withdrawn
Groupe de lecture: connectors.user. Groupe d'écriture: connectors.user.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
connection | ref → connection | none | non | connectors.user | en clair | The connection this basis is for |
owner_user | text | internal | oui | connectors.user | masqué | Owner of the connection |
state | select (active, withdrawn, superseded) | none | non | connectors.user | en clair | active, withdrawn, or superseded by a newer record |
subject_kind | select (user, party, instance) | none | non | connectors.user | en clair | Whose basis it is: a user, a party or the instance |
subject | text | internal | oui | connectors.user | masqué | Id of the party when the subject is a party |
given_by | text | internal | oui | connectors.user | masqué | Who recorded it |
purpose | longtext | none | non | connectors.user | en clair | The purpose the data is processed for |
legal_basis | select (consent, contract, legitimate_interest, legal_obligation) | none | non | connectors.user | en clair | consent, contract, legitimate interest or legal obligation |
note | longtext | none | non | connectors.user | en clair | Explanation; for legitimate interest the balancing test |
classes | text | none | non | connectors.user | en clair | Data classes that may flow under this record, computed from the connection |
fields_summary | longtext | none | non | connectors.user | en clair | Models and fields that may flow, computed from the connection |
recorded_at | text | none | non | connectors.user | en clair | When it was recorded |
withdrawn_at | text | none | non | connectors.user | en clair | When it was withdrawn, if it was |
withdrawn_by | text | internal | oui | connectors.user | masqué | Who withdrew it |
sync_run
One run of a connection: when, how many records, and how it ended; never the data
Groupe de lecture: connectors.user. Groupe d'écriture: connectors.admin.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
connection | ref → connection | none | non | connectors.user | en clair | The connection that ran |
owner_user | text | internal | oui | connectors.user | masqué | Owner of the connection |
direction | select (inbound, outbound) | none | non | connectors.user | en clair | Whether data went out or came in |
kind | select (manual, event, pull, webhook, test) | none | non | connectors.user | en clair | What started it |
started_at | text | none | non | connectors.user | en clair | When it started |
finished_at | text | none | non | connectors.user | en clair | When it ended |
status | select (running, succeeded, partial, failed, retrying, dead_letter) | none | non | connectors.user | en clair | How it ended |
records | number | none | non | connectors.user | en clair | Records sent or accepted |
rejected | number | none | non | connectors.user | en clair | Records refused |
proposed | number | none | non | connectors.user | en clair | Changes held for approval |
error_summary | text | none | non | connectors.user | en clair | Why it failed, without payloads |
data_flow_log
Append-only record of every flow: when, what, how many, which fields, how treated, and a hash of the payload; never the payload
Groupe de lecture: connectors.user. Groupe d'écriture: connectors.admin.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
connection | ref → connection | none | non | connectors.user | en clair | The connection the flow belongs to |
owner_user | text | internal | oui | connectors.user | masqué | Owner of the connection |
at | text | none | non | connectors.user | en clair | When it happened |
direction | select (outbound, inbound) | none | non | connectors.user | en clair | Whether data went out or came in |
model | text | none | non | connectors.user | en clair | The model the records belong to |
record_count | number | none | non | connectors.user | en clair | How many records |
fields_sent | text | none | non | connectors.user | en clair | Fields that left or were accepted, comma separated |
fields_denied | text | none | non | connectors.user | en clair | Fields the policy withheld, comma separated |
masking_mode | text | none | non | connectors.user | en clair | Treatments applied, for example pseudonymise=2;allow=1 |
payload_hash | text | none | non | connectors.user | en clair | SHA-256 of the payload after treatment |
outcome | select (released, received, refused, rejected, erased) | none | non | connectors.user | en clair | released, received, refused, rejected or erased |
reason | text | none | non | connectors.user | en clair | Why a flow was refused or a record rejected |
processing_register
The record of processing activities (GDPR Article 30) generated from the connections; exportable as CSV
Groupe de lecture: connectors.admin. Groupe d'écriture: connectors.admin.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
connection | ref → connection | none | non | connectors.admin | en clair | The connection this row describes |
name | text | none | non | connectors.admin | en clair | Name of the connection |
state | text | none | non | connectors.admin | en clair | State of the connection |
owner_scope | text | none | non | connectors.admin | en clair | Instance or user |
owner_user | text | internal | oui | connectors.admin | masqué | Owner of the connection |
provider | text | none | non | connectors.admin | en clair | Provider id |
recipient | longtext | none | non | connectors.admin | en clair | Who receives the data (legal name) |
recipient_country | text | none | non | connectors.admin | en clair | Where the recipient is |
purpose | longtext | none | non | connectors.admin | en clair | Purpose of the processing |
legal_basis | text | none | non | connectors.admin | en clair | Recorded legal basis |
consent_recorded_at | text | none | non | connectors.admin | en clair | When the basis was recorded |
data_subjects | longtext | none | non | connectors.admin | en clair | Categories of data subjects |
personal_data_categories | longtext | none | non | connectors.admin | en clair | Categories of personal data, with class and treatment |
transfer_basis | longtext | none | non | connectors.admin | en clair | Basis for transfers to third countries |
agreement_recorded | text | none | non | connectors.admin | en clair | Whether the agreement with the recipient is recorded |
retention_days | text | none | non | connectors.admin | en clair | Retention of logs, in days |
safeguards | longtext | none | non | connectors.admin | en clair | Technical and organisational measures |
csv | longtext | none | non | connectors.admin | en clair | The register as CSV; filled by the export command, never stored |
egress_policy
Instance-wide switches for data flows: the master switch, EU-only providers, the agreement requirement and the host allow-list
Groupe de lecture: connectors.admin. Groupe d'écriture: connectors.admin.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
flows_enabled | bool | none | non | connectors.admin | en clair | Master switch: when off nothing leaves and nothing is accepted |
eu_only | bool | none | non | connectors.admin | en clair | Personal data only goes to providers with an EU or adequacy basis |
require_dpa | bool | none | non | connectors.admin | en clair | Personal data, even pseudonymised, only goes to providers whose agreement is recorded |
host_allowlist | text | none | non | connectors.admin | en clair | Hosts connections may reach, comma separated; empty means no extra restriction |
default_retention_days | number | none | non | connectors.admin | en clair | Retention for logs of connections that no longer exist |
result | longtext | none | non | connectors.admin | en clair | Output of the last command (checklist, purge); never stored |
privacy_preview
What a sample outbound record looks like after the policy: the exact payload and the treatment of each field
Groupe de lecture: connectors.user. Groupe d'écriture: connectors.user.
| Champ | Type | Classe de données | Données personnelles | Groupe | Vu par les agents | Description |
|---|---|---|---|---|---|---|
provider | text | none | non | connectors.user | en clair | Provider the preview is for |
connection | text | none | non | connectors.user | en clair | An existing connection to preview, instead of a provider |
target_model | text | none | non | connectors.user | en clair | The model to preview |
record_id | text | none | non | connectors.user | en clair | A record to use as the sample; empty means the first one |
field_allowlist | longtext | none | non | connectors.user | en clair | Fields to include, as a JSON object of model to field names |
policy | longtext | none | non | connectors.user | en clair | Policy JSON to preview |
payload | longtext | none | non | connectors.user | en clair | The payload after treatment, as JSON; never stored |
treatments | longtext | none | non | connectors.user | en clair | Each field with its class and treatment, as JSON; never stored |
Flux de travail
connection
| Action | Transition | Qui peut l'exécuter | Approbation |
|---|---|---|---|
connection.connect | state: draft → connected | connectors.user | oui |
connection.pause | state: connected → paused | connectors.user | oui |
connection.resume | state: paused → connected | connectors.user | oui |
connection.retry | state: error → connected | connectors.user | oui |
connection.revoke | state: * → revoked | connectors.user | oui |
connection.test | - | connectors.user | non |
connection.sync | - | connectors.user | oui |
connection.oauth_start | - | connectors.user | non |
consent
| Action | Transition | Qui peut l'exécuter | Approbation |
|---|---|---|---|
consent.withdraw | state: active → withdrawn | connectors.user | oui |
processing_register
| Action | Transition | Qui peut l'exécuter | Approbation |
|---|---|---|---|
processing_register.export_csv | - | connectors.admin | non |
egress_policy
| Action | Transition | Qui peut l'exécuter | Approbation |
|---|---|---|---|
egress_policy.checklist | - | connectors.admin | non |
egress_policy.purge | - | connectors.admin | oui |
privacy_preview
| Action | Transition | Qui peut l'exécuter | Approbation |
|---|---|---|---|
privacy_preview.render | - | connectors.user | non |
Groupes de permissions
Groupes utilisés par cette application :
connectors.adminconnectors.user
Étapes d'approbation
Étapes qu'un agent ne peut que proposer :
connection.connectconnection.pauseconnection.resumeconnection.retryconnection.revokeconnection.syncconsent.withdrawegress_policy.purge
Ce que les agents peuvent et ne peuvent pas faire
Un agent peut lire, rechercher, créer et modifier les enregistrements de cette application, et exécuter les actions qui ne requièrent pas d'approbation, dans les limites des groupes de permissions de son jeton.
Il ne peut que proposer ces étapes, qu'une personne doit approuver : connection.connect, connection.pause, connection.resume, connection.retry, connection.revoke, connection.sync, consent.withdraw, egress_policy.purge, connector_provider.delete, provider_policy.delete, connection.delete, consent.delete, sync_run.delete, data_flow_log.delete, processing_register.delete, egress_policy.delete, privacy_preview.delete.
Les données personnelles sont masquées sous forme de jetons de substitution : connection.owner_user, consent.owner_user, consent.subject, consent.given_by, consent.withdrawn_by, sync_run.owner_user, data_flow_log.owner_user, processing_register.owner_user.
Ces champs ne sont pas communiqués aux agents : provider_policy.oauth_client_secret, connection.credentials, connection.oauth_tokens.
Dépendances
Aucune.
Installation
Intégrée. Elle est disponible dans chaque instance et ne peut pas être supprimée.
Créer la vôtre
Le guide des modules montre comment sont écrites les applications de ce type