Skip to main content
Two families cover external systems: integration is setup (connect, confirm, disconnect), and broker is execution (operate an already-connected provider). They are deliberately separate. See Integrations and Connections for the model and Broker for the semantics. Add --json to any command for machine output.

Integrations (setup)

Broker (operate)

The broker is gated (off by default in production) and fail-closed. driftless broker setup prints guidance only.

Reading and materializing

records reads a cache; document reads live; index writes Driftless-owned connector documents (never the provider); import writes Collection Records. Normal context retrieve never queries a provider. A record deleted at the provider tombstones its connector document on the next index run (it stops being citable); a disconnect soft-deletes all of the provider’s documents.

Gates and grants

A broker call can be refused by any of three gates: the master flag, the external-lane rollout, and per-principal grants. For a CLI call authenticated with your own key you are an internal caller (governed by identity and scopes, not grants); a faceless OAuth/MCP caller additionally needs rollout on and a matching grant. Managing grants is owner/admin only, via the API or dashboard.

Flags, files, and JSON

  • @file is accepted by broker invoke --input.
  • --json works on every command.
  • broker invoke on a write effect requires an idempotency_key to be safely replayable; writes are never auto-retried.