Service Provider Configuration of Cloud Applications for API-Based Data Protection

Asana for API-DP

1. Navigate to the Asana developer console and log in.
2. Click Create new app.
   
   
    
3. Enter the details as shown in the following image, and then click Create app.
   
   
    
4. From the left menu bar, navigate to the OAuth tab, and then click Add redirect URL.
   
   
    
5. Add the redirect URL in the format shown below, and then click Add.
   
   Redirect URL: https://<cluster-FQDN>/v1/asana/auth-callback
   
   
6. In the left menu bar, click Manage distribution. The following screen displays.
   
   
    
7. Select Any workspace as the distribution method, and then click Save changes.
8. In the left menu bar, click Basic. The following screen displays.
   
   
9. Store the Client ID and the Client Secret for later use.

   Note: For details about configuring and using the saved credentials, refer to the Asana block in the API-DP Helm values.yaml file.

Box API-DP

1. Log in to box.com with an admin account.
2. Check for the Admin console and Dev Console buttons at the bottom of the left menu bar. If both are not present, as shown below, then the Box account type is not supported for creating applications.
   
   
    
3. Click Dev Console.
4. Create the OAuth application:
   1. On the My Platform Apps screen, click Create Platform App.
      
      
       
   2. In the Create Platform App screen, select Custom App.
      
      
       
   3. Enter the details in step 1 of the Create a Custom App window, and then click Next.
      
      f
       
   4. In step 2, select User Authentication (OAuth 2.0) as the Authentication method, and then click Create App.
      
      
      
      The app is created and is ready for use.
5. Click the Configuration tab on the OAuth 2 App screen.
6. Copy the Client ID and Client Secret and store them for later use.
7. Enter the OAuth 2.0 Redirect URL below:
   • Redirect URL—https://<cluster-FQDN>/v1/box/auth-callback
     
     
8. Click Add.
9. Add scopes and permissions to the application as shown in the following screenshot, and then click Save Changes at the top right corner of the screen.
   
   
   
   OAuth 2.0 is now ready.
    
10. Create the JWT app:
    1. Click My Platform Apps in the left menu bar.
       
       
        
    2. Select the Create Platform App option.
    3. Select Custom App, and then enter the details as shown in step 1 below.
       
       
        
    4. In step 2, select Server Authentication (with JWT), and then click Create App.
       
       
       
       The JWT App is created.
        
11. Click the Configuration tab on the JWT App screen.
    
    
     
12. Copy the client ID and store it for later use.
13. Select the scope, and then select the access options as shown in following screenshots.
    
    
    
    
     
14. To generate a JWT key JSON file, click Generate a Public/Private Keypair button in the Add and Manage Public Keys section. A file is then downloaded. Save this file securely. 
    
    
    

    Note: For details about configuring and using the saved credentials from steps 6 and 14, refer to the Box block in the API-DP Helm values.yaml file.

15. Click the Save changes button in the top right corner. 
16. Click My Platform Apps in the left menu bar.
17. Create the Box Custom Skill app:
    1. Select the Create Platform App option.
    2. Select Box Custom Skill.
       
       
    3. Enter the required details, as shown below. 
       
       
    4. Click Create App. The Box Skill is created. 
        
18. Click the Configuration tab, copy the client ID, and provide the Invocation URL:
    • Invocation URL—https://<cluster-FQDN>/v1/box/webhook
      
      
19. Click the Save Changes button in the top right corner.
20. Authorize the OAuth and JWT applications, and set up Skill:
    1. Navigate to the Admin Console from the left menu bar in your account home screen (see Step 2).
    2. Click Integrations in the left menu bar.
    3. Select the Platform Apps Manager tab, click Server Authentication Apps, and then click Add Platform App in the upper right corner.
    4. Enter the JWT app client ID and the Box custom Skill app client ID, and then authorize. 
    5. Select the User Authentication Apps tab, and then click Add Platform App.
    6. Enter the OAuth app client ID, and then authorize.
       
       
        
21. Navigate from app.box.com/master/platform-apps/userauth to app.box.com/master/skills.
22. Click the + Add Skill button.
    
    
     
23. Enter the Box Skill client ID. Click Next.
24. Select All content in your company, and then click Next.
    
    
     
25. Click Enable in the the upper right corner.

Cisco Webex API-DP

1. Sign into Webex Developer and navigate to https://developer.webex.com/my-apps/new/integration.
   
   
    
2. Fill out Name, Icon, Description, Redirect URL and scopes. 
    

   Field	Description
   Integration name	Enter the name of the integration as it will appear in Webex.
   Icon	Upload your own icon or select a Webex default icon. Icons must be exactly 512 x 512px in JPEG or PNG format.
   App Hub Description	Enter information about the application, up to 1024 characters.
   Redirect URI(s)	Enter one or more URIs that a user will be redirected to when completing an OAuth grant flow.

3. Select one or more scopes. You must select at least the following scopes:
   • meeting:admin_participants_read
   • spark-compliance:events_read
   • spark-compliance:messages_read
   • spark-compliance:messages_write
   • spark-compliance:people_read
   • spark-compliance:recordings_read
   • spark-compliance:webhooks_read
   • spark-compliance:webhooks_write
   • spark:all
   • spark:webhooks_read
   • spark:webhooks_write
      
4. Click Add Integration. The following screen displays.
   
   
5. Store the client ID and client secret for later use.

Citrix ShareFile for API-DP

To configure Citrix ShareFile for API-DP, the service provider registers one ShareFile OAuth application. Every customer authorizes that same application against their own ShareFile account.

Perform the actions shown in this section before onboarding the first customer.

The process for enabling access involves two hosts:

• Central secure.sharefile.com—The host to which the authorize call is sent.
• Customer's own <subdomain>.<apicp> host—The host to which the token exchange and all subsequent API calls are sent.

ShareFile returns the subdomain and apicp (API Control Plane) as query parameters on the callback, so that the customer never enters their domain. apicp is the domain suffix for the customer's ShareFile data center (for example, sharefile.com). Since ShareFile operates multiple data centers and the value can differ per tenant, the connector stores whatever ShareFile returns rather than hardcoding it. The connector uses that returned lower-case subdomain as the app-tenant id.

The redirect URI must be enter corrected because it is registered with ShareFile and must match what the connector sends.

To configure a new instance for Citrix ShareFile:

1. Register the ShareFile OAuth app—Register the application from the provider's Citrix/ShareFile developer account. The connector uses the authorization code flow: it sends response_type=code to secure.sharefile.com/oauth/authorize and exchanges the result with grant_type=authorization_code, then renews with  grant_type=refresh_token.
   
   Confirm the current developer-portal URL and application-approval process with Citrix before registering — this doc does not pin them down, and they have changed in the past.
   
   The connector requires the following:
   1. An app name your customers will recognize on the consent screen — they see it when approving access, so use the provider's own product name.
      
      
       
   2. Set the redirect URI to the connector's auth-callback endpoint: https://<clusterHostname>/v1/citrixfile/auth-callback.
      
      <clusterHostname> is the is global.clusterHostname from the helm/cluster-values/asc-infra/<cluster>.yaml file (for example, cluster.domain.com). The connector builds this URL itself and sends it as redirect_uri on the authorize call. ShareFile rejects the exchange if the registered value differs in any way, by even a trailing slash.
       
   3. Store the client id and client secret securely for later use. Both are needed in Step 3 below, and both are sent on every token exchange and refresh.
      
      
      
      Nothing about scopes is set here, and none are requested; the connector sends no scope parameter at all. What the application is allowed do is determined by the permissions that you grant the app at registration and by the rights of the customer admin who approves it.
       
2. Enable the connector—Enable Citrix Files in two charts, neither of which is enabled by default:
   1. asc-infra—In the helm/cluster-values/asc-infra/<cluster>.yaml file, enter the following under global.services:
      
      global:
        services:
          citrixfile:
            enable: true
      
      The common_app_config.yaml file renders global.services into the configuration that the connector reads at runtime. The OAuth credentials travel via the secret in Step 3.
       
   2. apidp—In the helm/cluster-values/apidp/<cluster>.yaml file, enter the following at the top level:
      
      citrixfile:
        enable: true
      
      This is the Helm dependency condition. The API-DP chart carries condition: citrixfile.enable. If you leave this setting in the default false state, the subchart never renders at all; no deployment will occur, and no saas-citrixfile-oauth secret for Step 3 will be populated.
      
      Also, confirm that global.clusterHostname in the asc-infra values matches the hostname you registered as the redirect URI in Step 1. It feeds base_url in the common_app_config.yaml file, onto which the connector concatenates the callback path. The same value becomes the webhook URL on which ShareFile calls back.
       
3. Set the API key in the secret—The credentials from Step 1 reach the service as a Kubernetes secret, which is by default saas-citrixfile-oauth in the apidp namespace. The backend reads it at runtime and uses it to authorize every tenant and to refresh the token.
    

   Secret Key	Value
   client-id	ShareFile OAuth client ID
   client-secret	ShareFile OAuth client secret

    
   1. Add the base64-encoded client id and client secret to the citrixfile block in the API-DP Helm chart values in the helm/cluster-values/apidp/<cluster>.yaml file, the same top-level block you enabled in Step 2b:
      
      citrixfile:
        enable: true
        auth:
          secretData:
            clientId: "<base64 of the ShareFile client id>"
            clientSecret: "<base64 of the ShareFile client secret>"
      
      The values must be base64-encoded — the chart writes them straight into the secret's data: block, which Kubernetes requires to be base64. A raw key fails to deploy. Encode with:
      
      echo -n '<ShareFile client id>'     | base64
      echo -n '<ShareFile client secret>' | base64
      
      The keys are clientId / clientSecret in values; the chart kebab-cases them (a naming convention that allows a developer to create whitespace between words in code by separating each word with a dash character) to client-id / client-secret in the secret.
      
      The helm/apidp/versa/citrixfile/values.yaml file carries a default key belonging to another account. Do not edit this file. Rather, override the keys in cluster values as shown above, or else the platform authenticates as that other account against your customers' domains.
       
   2. To use a different secret name, set citrixfile.auth.secretName (or point citrixfile.auth.existingSecret at a secret you manage yourself). The deployment passes the result to the pod as AUTH_SECRET_NAME and the backend reads that, falling back to saas-<app>-oauth. This is not required for most deployments.
   3. Rotating the key is an edit to the same values plus a helm upgrade. Existing tenants keep working on their stored access and refresh tokens until the next refresh, which will then fail. You should plan a re-grant for each tenant, or rotate the key during a maintenance window.
       
4. Verify
   1. Confirm the the secret holds the provider's own key and not the shipped default with the following command:
      
      kubectl get secret saas-citrixfile-oauth -n apidp -o jsonpath='{.data.client-id}' | base64 -d
      
      This command should print your ShareFile client ID. If it prints anything else, it means that the chart default is still in place and Step 3 has not taken effect.
       
   2. Onboard one internal test tenant and walk the full grant, as follows:

      # connector is actually running (Step 2.2)
      kubectl get pods -n apidp | grep citrixfile

      # after clicking Grant Access, the authorize URL should carry YOUR client id,
      # the registered redirect URI
      kubectl logs -n apidp deploy/saas-citrixfile | grep "Grant access called" -A2

      # after consent, a successful exchange stores tokens and creates the webhook;
      # this must NOT appear
      kubectl logs -n apidp deploy/saas-citrixfile | grep "Create New Webhook Failed"
      
      On a successful grant, the connector subscribes to File Upload, Update, and Delete events at https://<subdomain>.<apicp>/sf/v3/WebhookSubscriptions, scoped to the customer's whole Account, and stores the returned subscription ID against the tenant. A grant that completes but logs Create New Webhook Failed leaves a tenant that looks healthy while receiving no change events.
      
      Revoking access does not invalidate the tokens. ShareFile exposes no token-revocation endpoint, so revoke deletes the webhook subscription and the local tenant records only—the issued access and refresh tokens stay valid until they expire on ShareFile's own schedule. If a tenant must be cut off immediately, revoke the application's authorization from the ShareFile side.

Confluence for API-DP

forge login

forge create

cd <app_name>

app:
  id: ari:cloud:ecosystem::app/APP-ID  # Paste the ID copied in Step 4
  runtime:
    name: nodejs22.x
 
modules:
  trigger:
    - key: on-page-created
      function: forwardToApiDp
      events:
        - avi:confluence:created:page
    - key: on-page-updated
          function: forwardToApiDp
          events:
            - avi:confluence:updated:page
    - key: on-page-archived
      function: forwardToApiDp
      events:
        - avi:confluence:archived:page
    - key: on-page-unarchived
      function: forwardToApiDp
      events:
        - avi:confluence:unarchived:page
    - key: on-page-trashed
      function: forwardToApiDp
      events:
        - avi:confluence:trashed:page
    - key: on-page-restored
      function: forwardToApiDp
      events:
        - avi:confluence:restored:page
    - key: on-page-deleted
      function: forwardToApiDp
      events:
        - avi:confluence:deleted:page
    - key: on-blog-created
      function: forwardToApiDp
      events:
        - avi:confluence:created:blogpost
    - key: on-blog-updated
      function: forwardToApiDp
      events:
        - avi:confluence:updated:blogpost
    - key: on-blog-trashed
      function: forwardToApiDp
      events:
        - avi:confluence:trashed:blogpost
    - key: on-blog-restored
      function: forwardToApiDp
      events:
        - avi:confluence:restored:blogpost
    - key: on-blog-deleted
      function: forwardToApiDp
      events:
        - avi:confluence:deleted:blogpost
    - key: on-comment-created
      function: forwardToApiDp
      events:
        - avi:confluence:created:comment
    - key: on-comment-updated
      function: forwardToApiDp
      events:
        - avi:confluence:updated:comment
            - key: on-comment-deleted
      function: forwardToApiDp
      events:
        - avi:confluence:deleted:comment
    - key: on-attachment-created
      function: forwardToApiDp
      events:
        - avi:confluence:created:attachment
    - key: on-attachment-updated
      function: forwardToApiDp
      events:
        - avi:confluence:updated:attachment
    - key: on-attachment-archived
      function: forwardToApiDp
      events:
        - avi:confluence:archived:attachment
    - key: on-attachment-unarchived
      function: forwardToApiDp
      events:
        - avi:confluence:unarchived:attachment
    - key: on-attachment-trashed
      function: forwardToApiDp
      events:
        - avi:confluence:trashed:attachment
    - key: on-attachment-restored
      function: forwardToApiDp
      events:
        - avi:confluence:restored:attachment
    - key: on-attachment-deleted
      function: forwardToApiDp
      events:
        - avi:confluence:deleted:attachment
    - key: on-space-created
      function: forwardToApiDp
      events:
        - avi:confluence:created:space:V2
    - key: on-space-updated
      function: forwardToApiDp
      events:
        - avi:confluence:updated:space:V2
    - key: on-space-deleted
      function: forwardToApiDp
      events:
        - avi:confluence:deleted:space:V2
 
  function:
    - key: forwardToApiDp
      handler: index.run
 permissions:
   scopes:
    - write:confluence-space
    - write:confluence-content
    - read:confluence-content.summary
    - read:confluence-space.summary
  external:
    fetch:
      backend:
        - address: https://CLUSTER-HOSTNAME  # Enter your API-DP cluster hostname

const WEBHOOK_PATH = '/v1/confluence/webhook';
 
export async function run(event, context) {
    const apiDpHost = process.env.HOST_URL;
    if (!apiDpHost) {
        console.error('[API-DP] HOST_URL is not set - aborting');
        return;
    }
 
    const cloudId = (context.installContext ?? '').split('/').pop();
    const targetUrl = `${apiDpHost}${WEBHOOK_PATH}`;
 
    const payload = {
        event_type: event.eventType,
        cloud_id: cloudId,
        timestamp: new Date().toISOString(),
        data: event,
    };
 
    try {
    const response = await fetch(targetUrl, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(payload),
    });
    if (!response.ok) {
        console.error(`[API-DP] Delivery failed -> ${targetUrl} | ${response.status}`);
    } else {
        console.log(`[API-DP] Delivered ${event.eventType} event successfully -> ${targetUrl} | ${response.status}`);
    }
    } catch (err) {
        console.error(`[API-DP] Error -> ${targetUrl} | ${err.message}`);
    }}

forge variables set --environment development \
     HOST_URL https://CLUSTER-HOSTNAME
forge variables set --environment production \
     HOST_URL https://CLUSTER-HOSTNAME

forge deploy --environment development
forge install --environment development

forge deploy --environment production

Dropbox API-DP

1. Login to https://www.dropbox.com/developers (use the admin account), and then click App Console.
   
   
   
   
    
2. Click Create app.
   
   
    
3. Enter all details, select the scope and other details as shown below, and then click Create app.
   
   
    
4. Once the app is created, select the Settings subtab, scroll down to the App key and App secret fields. Copy and store them for later use. 

   Note: For details about configuring and using the saved credentials, refer to the Dropbox block in the API-DP Helm values.yaml file.

5. Enter the URLs for OAuth redirect and Webhook shown below:
   • OAuth redirect URL—https://<cluster-FQDN>/v1/dropbox/auth-callback
   • Webhook URL—https://<cluster-FQDN>/v1/dropbox/webhook
     
     
      
6. Select the Permissions subtab, and then select all Individual Scopes and Team Scopes.

Egnyte for API-DP

To configure Egnyte for API-DP, the service provider registers one Egnyte API key and every customer authorizes that same key against their own Egnyte domain. The token exchange happens against the customer's subdomain, not a central Egnyte endpoint—the customer supplies their domain when granting access. The redirect URI must be entered correctly because it is registered with Egnyte and must match what the connector sends.

The following steps must be completed before onboarding the first customer. 

1. Register the Egnyte OAuth application.
   1. From the provider's Egnyte developer account, add the application at https://developers.egnyte.com/my-apps/new-app.
      
      
       
   2. Enter an application name and description.
   3. Choose the authorization code flow. See the Egnyte authentication documentation.
   4. Enter the redirect URI to the connector's auth-callback endpoint: https://<clusterHostname>/v1/egnyte/auth-callback
      
      <clusterHostname> is the global.clusterHostname from the helm/cluster-values/asc-infra/<cluster>.yaml file (for example, cluster.domain.com). The connector builds this URL itself and sends it as redirect_uri on both the authorize and token calls. Egnyte rejects the exchange if the registered value differs in any way, such as by a trailing slash.
      
      
       
   5. Request approval for both the Prod Collaborate and Prod_SnG APIs, then click Save.
      
      
       
   6. Store the client id (API key) and client secret securely for later use. Both are needed in Step 3. The secret is also used when revoking access, not just at the time of authorization.
      
      
      
      Egnyte issues API keys against a sandbox/trial tier first and requires a separate request to promote a key to production rate limits. Confirm the current process and your key's tier on the developer portal before onboarding real customers. A sandbox key works in testing and then throttles under customer load.
       
2. Enable the connector. You must enable Egnyte in two charts, which are disabled by default. 
   1. asc-infra—In the helm/cluster-values/asc-infra/<cluster>.yaml file, under global.services, add the following lines:
      
      global:
        services:
          egnyte:
            enable: true
      
      The common_app_config.yaml file renders global.services into the configuration that the connector reads at runtime. Nothing more needs to be configured—the OAuth credentials travel via the secret in Step 3.
       
   2. apidp—In the helm/cluster-values/apidp/<cluster>.yaml file, top level, add the following lines:
      
      egnyte:
        enable: true
      
      This entry is the Helm dependency condition. The API-DP chart carries the condition egnyte.enable. If this condition is left unchanged (the default setting is enable: false), the subchart never renders at all. In this case, deployment does not occur and no saas-egnyte-oauth secret for Step 3 to have populated.
      
      Also, you must confirm the global.clusterHostname in the asc-infra values matches the hostname you registered as the redirect URI in Step 1. The hostname feeds base_url in the common_app_config.yaml file, onto which the connector concatenates the callback path.
       
3. Set the API key in the secret. The credentials from Step 1 reach the service as a Kubernetes secret, which by default is saas-egnyte-oauth in the apidp namespace. The Kubernetes secret is read at runtime and is used for every tenant's authorization and token refresh.
    

   Secret Key	Value
   client-id	Egnyte API key
   client-secret	Egnyte client secret

    
   1. Add the base64-encoded client id and client secret to the Egnyte block in the API-DP Helm chart values in the helm/cluster-values/apidp/<cluster>.yaml file, the same top-level block you enabled in Step 2b:
      
      egnyte:
        enable: true
        auth:
          secretData:
            clientId: "<base64 of the Egnyte API key>"
            clientSecret: "<base64 of the Egnyte client secret>"
      
      The values must be base64-encoded — the chart writes them straight into the secret's data: block, which Kubernetes requires to be base64. A raw key fails to deploy. Encode with:
      
      echo -n '<Egnyte API key>'       | base64
      echo -n '<Egnyte client secret>' | base64
      
      The keys are clientId / clientSecret in values; the chart kebab-cases them (a naming convention that allows a developer to create whitespace between words in code by separating each word with a dash character) to client-id / client-secret in the secret itself.
      
      The helm/apidp/versa/egnyte/values.yaml file carries a default key belonging to another account. Do not edit this file. Rather, override the keys in cluster values as shown above, or else the platform authenticates as that other account against your customers' domains.
       
   2. To use a different secret name, set egnyte.auth.secretName (or point egnyte.auth.existingSecret at a secret you manage yourself). The deployment passes the result to the pod as AUTH_SECRET_NAME and the backend reads that, falling back to saas-<app>-oauth. This is not required for most deployments.
   3. Rotating the key is an edit to the same values plus a helm upgrade. Existing tenants keep working on their stored access and refresh tokens until the next refresh, which will then fail. You should plan a re-grant for each tenant, or rotate the key during a maintenance window.
       
4. Verify
   1. Confirm the the secret holds the provider's own key and not the shipped default with the following command:
      
      kubectl get secret saas-egnyte-oauth -n apidp -o jsonpath='{.data.client-id}' | base64 -d
      
      This command should print your Egnyte client ID. If it prints anything else, it means that the chart default is still in place and Step 3 has not taken effect.
       
   2. Onboard one internal test tenant and walk the full grant, as follows:

      # connector is actually running (Step 2.2)
      kubectl get pods -n apidp | grep egnyte

      # after clicking Grant Access, the authorize URL should carry YOUR client id, the registered redirect URI, and: # Egnyte.filesystem Egnyte.webhooks Egnyte.permission
      # Egnyte.user Egnyte.group Egnyte.link
      kubectl logs -n apidp deploy/saas-egnyte | grep "Grant access called" -A2

      # after consent, a successful exchange stores tokens and creates the webhook;
      # these two must NOT appear
      kubectl logs -n apidp deploy/saas-egnyte | grep -E "Failure in auth_callback|Webhook Creation Failed"
      
      A grant that completes but logs Webhook Creation Failed leaves a tenant that looks healthy while receiving no change events. The authorization succeeded but the webhook registration against the customer's domain did not—read the Egnyte error in the pod log to see why this happened.

GitHub for API-DP

1. Navigate to https://github.com and log in.
2. Click your profile icon in the top-right corner of the GitHub interface.
   
   
    
3. Select Settings from the drop-down menu.
   
   
    
4. In the left menu, choose Developer Settings.
   
   
    
5. Click GitHub Apps on the Developer Settings section, and then click New GitHub App.
   
   
    
6. Enter the following application details:
    

   Field	Description
   GitHub App name	Enter a unique name for your GitHub App (for example, Versa Networks).
   Homepage URL (Optional)	Add a URL that users can visit for more information (for example, https://versa-networks.com).
   Callback URL	Enter https://<cluster-FQDN>/v1/github/auth-callback.
   Webhook URL	Enter https://<cluster-FQDN>/v1/github/webhook.
   Permissions	Repository permissions: Administration—Read and write Contents—Read and write Webhooks—Read and write Organization permissions: Administration—Read only Events—Read only Members—Read and write Personal access tokens—Read and write Webhooks—Read and write Account permissions: Email addresses—Read only
   Subscribe to events	Member, Push, and Repository.
   Where can this GitHub App be installed?	Enter Any account.

7. Retain the default values for the remaining fields.
8. Click Create GitHub App to create the app.
   
   
    
9. After creating the GitHub App, copy the Client ID and Public link. 
   
   
    
10. Click the “Generate a new client secret” button.
    
    
11. Copy the generated client secret. 
    
    
     
12. Click “Save changes”. 

Gmail for API-DP

1. Navigate to the Google Cloud Console at https://console.cloud.google.com and log in.
2. Locate the project where you want to create the application, and then search for APIs & Services in the search bar and select the project from the results.
   
   
    
3. Select Credentials in the left menu.
   
   
    
4. Click + CREATE CREDENTIALS in the top menu bar, and then choose OAuth client ID from the drop-down list.
   
   
    
5. Click the Application type field, and select Web Application from the drop-down list.
   
   
    
6. In the Name field, enter a name to identify the application.
7. In the Authorized redirect URIs section, click + ADD URI.
   
   
    
8. Enter the URI using the following format, then click Create:
   • https://<cluster-FQDN>/v1/gmail/auth-callback
     
     
      
9. After the credentials are created, a popup window appears with the Client ID and Client Secret. Store these for later use.
   
   
    
10. Click “OK” and navigate to the OAuth consent screen from the left-hand navigation bar.
    
    
11. Navigate to the Branding section and then enter the required application details.
    
    
12. Navigate to the Audience section, set the User Type to External, and then publish the app to production.
    
    
13. Create a service account: 
    1. Repeat Steps 1-3 above to navigate to the Credentials tab, click + CREATE CREDENTIALS in the top menu bar, and then select Service account from the drop-down list.
       
       
    2. Enter the required details, and then click Create and Continue.
    3. Click the newly created service account (It may take up to a minute to appear), and then navigate to the Keys tab.
       
       
    4. Click Add Key > Create new key.
       
       
    5. Select JSON as the key type, and then click Create. Your credentials are downloaded automatically in a JSON file. Store this file securely.
       
       

       Note: For details about configuring and using the saved credentials from Steps 9 and Step 13e, refer to the Gmail block in the API-DP Helm values.yaml file.

Google Drive for API-DP

1. Create a Google Cloud project.
   1. Navigate to the Google Cloud Console: https://console.cloud.google.com/.
   2. Sign in with your Google Account.
   3. Click on the project drop-down (top left, next to Google Cloud). 
   4. Click New Project. 
   5. In the Select a resource screen, enter your project details, and then click Create.
      
      
       
2. To enable billing:
   1. Navigate to the Billing Section at https://console.cloud.google.com/billing.
   2. Select your newly-created project. 
   3. If no billing account exists, click Create Account.
   4. Attach the Billing Account to your project.
3. To enable Google Drive API: 
   1. Navigate to the API Library at https://console.cloud.google.com/apis/library.
   2. Search for Google Drive API. 
   3. Click on Google Drive API and enable it.
      
      
       
4. To create a service account (this allows your application to authenticate without user intervention):
   1. Navigate to Service Accounts at:
      https://console.cloud.google.com/iam-admin/serviceaccounts.
   2. Select your project. 
   3. Click + Create Service Account. 
   4. Enter the details of the account.
   5. Click Create and Continue. 
   6. Grant roles.
   7. Click Continue, and then click Done.
      
      
       
5. Generate a JSON Key for the service account.
   1. In the Service Accounts page, click on your newly-created service account. 
   2. Navigate to the Keys tab. 
   3. Click Add Key > Create new key. 
   4. Select JSON as the key type. 
   5. Click Create.
      
      
       

      Note: Your credentials are downloaded automatically in a JSON file. Store this file securely. It contains sensitive information.

6. Enable domain-wide delegation.
   1. Navigate to the Service Accounts page at https://console.cloud.google.com/iam...erviceaccounts.
   2. Select the service account. 
   3. Click Edit. 
   4. Click the checkbox for Create Google Workspace marketplace-compatible oauth client. 
   5. Enter a name for the OAuth consent screen (if prompted).
   6. Save the changes.
   7. Copy the Client ID shown on the page and store it for later use. 
      
      
       
7. Create OAuth Client for Grant Access flow.
   1. Navigate to Google Cloud Console.
   2. Select your project or create a new one.
   3. Navigate to APIs & Services > Credentials.
   4. Click Create Credentials  > OAuth Client ID.
   5. Set application type. For a web app, select Web application.
   6. Configure Authorized Redirect URIs, for example, https://<cluster-FQDN>/v1/gdrive/auth-callback.
   7. Click Create.
   8. Copy the Client ID and Client Secret and store them for later use. 
      
      
       
8. API Quotas
   1. Navigate to IAM & Admin > Quotas & System Limits > Google Drive API.
   2. The screen displays the default quotas.
      
      
       
   3. To request more quotas, enter a quota value and click SUBMIT REQUEST.
      
      ​​​​​

Jira for API-DP

forge login

forge create

cd <app_name>

app:
  id: ari:cloud:ecosystem::app/APP-ID  # Paste the ID copied in Step 4
  runtime:
    name: nodejs22.x
 
modules:
  trigger:
    - key: on-issue-created
      function: forwardToApiDp
      events:
        - avi:jira:created:issue
    - key: on-issue-updated
      function: forwardToApiDp
      events:
        - avi:jira:updated:issue
    - key: on-issue-deleted
          function: forwardToApiDp
      events:
        - avi:jira:deleted:issue
    - key: on-comment-activity
      function: forwardToApiDp
      events:
        - avi:jira:commented:issue
    - key: on-comment-deleted
      function: forwardToApiDp
      events:
        - avi:jira:deleted:comment
    - key: on-project-created
      function: forwardToApiDp
      events:
        - avi:jira:created:project
    - key: on-project-updated
      function: forwardToApiDp
      events:
        - avi:jira:updated:project
    - key: on-project-deleted
      function: forwardToApiDp
      events:
        - avi:jira:deleted:project
    - key: on-project-soft-deleted
      function: forwardToApiDp
      events:
        - avi:jira:softdeleted:project
    - key: on-project-restored
      function: forwardToApiDp
      events:
        - avi:jira:restored:project
    - key: on-project-archived
      function: forwardToApiDp
      events:
        - avi:jira:archived:project
    - key: on-project-unarchived
      function: forwardToApiDp
      events:
        - avi:jira:unarchived:project
 
  function:
    - key: forwardToApiDp
      handler: index.run
 
permissions:
  scopes:
    - read:jira-work
  external:
    fetch:
      backend:        
        - address: https://CLUSTER-HOSTNAME  # Enter your API-DP cluster hostname

const WEBHOOK_PATH = '/v1/jira/webhook';
 
export async function run(event, context) {    
    const apiDpHost = process.env.HOST_URL;
    if (!apiDpHost) {
        console.error('[API-DP] HOST_URL is not set - aborting');
        return;
    }
 
    const cloudId = (context.installContext ?? '').split('/').pop();
    const targetUrl = `${apiDpHost}${WEBHOOK_PATH}`;
 
    const payload = {
        event_type: event.eventType,
        cloud_id: cloudId,
        timestamp: new Date().toISOString(),
        data: event,
    };
 
    try {
    const response = await fetch(targetUrl, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(payload),
    });
    if (!response.ok) {
        console.error(`[API-DP] Delivery failed -> ${targetUrl} | ${response.status}`);
    } else {
        console.log(`[API-DP] Delivered ${event.eventType} event successfully -> 
${targetUrl} | ${response.status}`);
    }
    } catch (err) {
        console.error(`[API-DP] Error -> ${targetUrl} | ${err.message}`);
    }}

forge variables set --environment development \
     HOST_URL https://CLUSTER-HOSTNAME
forge variables set --environment production \
     HOST_URL https://CLUSTER-HOSTNAME

forge deploy --environment development
forge install --environment development 

forge deploy --environment production

Microsoft OneDrive API-DP

1. Navigate to https://portal.azure.com. 
2. Select App Registrations. 
3. Click New Registration.
   
   
    
4. Enter details as shown below:
   1. Name—Enter a name for the application.
   2. Supported account types—Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
   3. Redirect URL—Select Web as the URL type, and enter the URL in the following format:
      
      https://<cluster-FQDN>/v1/msonedrive/auth-callback
      
      
   4. Click Register to complete the registration. 
5. Record the application (client) ID and store it for later use. 
   
   
    
6. In the left menu bar, select Certificates & secrets.
7. Click + New client secret.
   
   
    
8. Enter a description and expiry time, and then click Add at the bottom of the page.
9. Copy the Value (not the Secret ID) and store it for later use. Note that this value is not accessible once you leave the page.
   
   

   Note: For details on configuring and using the saved credentials from Step 5 and Step 9, refer to the msonedrive block in the API-DP Helm values.yaml file.

10. Assign API permissions in the created application:
    1. In the newly created application's left menu bar, click API Permissions, and then select the + Add a permission option.
    2. Assign all permissions shown in the following table.
        

       Permission	Type	Description
       Application.Read.All	Application	Read all applications
       Application.ReadWrite.All	Application	Read and write all applications
       Directory.Read.All	Application	Read directory data
       Directory.ReadWrite.All	Application	Read and write directory data
       Domain.ReadWrite.All	Application	Read and write domains
       Files.Read.All	Application	Read files in all site collections
       Files.ReadWrite.All	Application	Read and write files in all site collections
       Mail.ReadWrite	Application	Read and write mail in all mailboxes
       MailboxSettings.ReadWrite	Application	Read and write all user mailbox settings
       offline_access	Delegated	Maintain access to data you have given it access to
       Sites.FullControl.All	Application	Have full control of all site collections
       Sites.Manage.All	Application	Create, edit, and delete items and lists in all site collections
       Sites.Read.All	Application	Read items in all site collections
       Sites.ReadWrite.All	Application	Read and write items in all site collections
       User.Read	Delegated	Sign in and read user profile
       User.Read.All	Application	Read all users' full profiles

11. After adding permissions, select Grant admin consent for <org_name>.

Microsoft Outlook API-DP

1. Navigate to https://portal.azure.com. 
2. Select App Registrations. 
3. Click New Registration.
   
   
    
4. Enter details as shown below.
   1. Name—Enter a name for the application.
   2. Supported account types—Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
   3. Redirect URL—Select Web as the URL type, and enter the URL in the following format:
      • https://<cluster-FQDN>/v1/msoutlook/auth-callback
        
        
5. Click Register to complete the registration. 
6. Record the application (client) ID and store it for later use. 
   
   
    
7. In the left menu, select Certificates & secrets.
8. Click + New client secret.
   
   
    
9. Enter a description and expiry time, and then click on Add at the bottom of the page.
10. Record the Value (not the Secret ID) and store it for later use. Note that this value is not accessible once you leave the page.
    
    

    Note: For details on configuring and using the saved credentials from Step 6 and Step 10, refer to the msoutlook block in the API-DP Helm values.yaml file.

11. Assign API permissions in the created application:
    1. In the newly created application's left menu bar, click API Permissions, then select the + Add a permission option.
    2. Assign all required Microsoft Graph permissions by selecting each permission type individually.
        

       Permission	Type	Description
       AuditLog.Read.All	Application	Application Read all audit log data
       Directory.Read.All	Delegated	Read directory data
       Directory.Read.All	Application	Read directory data
       Domain.Read.All	Application	Application Read domains
       Mail.ReadWrite	Application	Application Read and write mail in all mailboxes
       MailboxSettings.Read	Application	Application Read all user mailbox settings
       offline access	Delegated	Maintain access to data you have given it access to
       Organization.Read.All	Application	Application Read organization information
       User.Read.All	Application	Application Read all users' full profiles

12. After adding permissions, select Grant admin consent for <org_name>.

Microsoft SharePoint API-DP

1. Navigate to https://portal.azure.com. 
2. Select App Registrations. 
3. Click New Registration.
   
   
    
4. Enter the details shown below:
   1. Name—Enter a name for the application.
   2. Supported account types—Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
   3. Redirect URL—Select URL type as Web and enter the URL in the following format:
      • https://<cluster-FQDN>/v1/mssharepoint/auth-callback
        
        
5. Click Register to complete the registration. 
6. Record the application (client) ID and store it for later use. 
   
   
    
7. In the left menu, select Certificates & secrets.
8. Click + New client secret.
   
   
    
9. Enter a description and expiry time, and then click on Add at the bottom of the page.
10. Record the Value (not the Secret ID) and store it for later use. Note that this value is not accessible once you leave the page.
    
    

    Note: For details on configuring and using the saved credentials from step 6 and 10, refer to the mssharepoint block in the API-DP Helm values.yaml file.

11. Assign API permissions in the created application:
    1. In the newly created application's left menu bar, click API Permissions, then select the + Add a permission option.
    2. Assign all required Microsoft Graph permissions by selecting each permission type individually.
        

       Permission	Type	Description
       Application.Read.All	Application	Read all applications
       Application.ReadWrite.All	Application	Read and write all applications
       Directory.Read.All	Application	Read directory data
       Directory.ReadWrite.All	Application	Read and write directory data
       Domain.ReadWrite.All	Application	Read and write domains
       Files.Read.All	Application	Read files in all site collections
       Files.ReadWrite.All	Application	Read and write files in all site collections
       Mail.ReadWrite	Application	Read and write mail in all mailboxes
       MailboxSettings.ReadWrite	Application	Read and write all user mailbox settings
       offline_access	Delegated	Maintain access to data you have given it access to
       Sites.FullControl.All	Application	Have full control of all site collections
       Sites.Manage.All	Application	Create, edit, and delete items and lists in all site collections
       Sites.Read.All	Application	Read items in all site collections
       Sites.ReadWrite.All	Application	Read and write items in all site collections
       User.Read	Delegated	Sign in and read user profile
       User.Read.All	Application	Read all users' full profiles

Microsoft Teams API-DP

1. Navigate to https://portal.azure.com. 
2. Select App Registrations. 
3. Click New Registration.
   
   
    
4. Enter the following details:
   1. Name—Enter a name for the application.
   2. Supported account types—Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
   3. Redirect URL—Select Web as the URL type, and then enter the URL in the following format:
      • https://<cluster-FQDN>/v1/msteams/auth-callback
        
        
5. Click Register to complete the registration. 
6. Record the application (client) ID and store it for later use.
   
   
    
7. In the left menu, select Certificates & secrets.
8. Click + New client secret.
   
   
    
9. Enter a description and expiry time, and then click Add at the bottom of the page.
10. Record the Value (not the Secret ID) and store it for later use. Note that this value is not accessible once you leave the page.
    
    

    Note: For details on configuring and using the saved credentials from step 6 and 10, refer to the msteams block in the API-DP Helm values.yaml file.

11. Assign API permissions in the created application:
    1. In the newly created application's left menu bar, click API Permissions, and then select the + Add a permission option.
    2. Assign all required Microsoft Graph permissions by selecting each permission type individually.
        

       Permission	Permission Type	Description
       offline_access	Delegated Permission	Maintain access to data you have given it access to
       ChatMessage.Send	Delegated Permission	Send user chat messages
       Directory.Read.All	Delegated Permission	Read directory data
       ChannelMessage.Send	Delegated Permission	Send channel messages
       Channel.ReadBasic.All	Application Permission	Read the names and descriptions of all channels
       ChannelMessage.Read.All	Application Permission	Read all channel messages
       ChannelMessage.UpdatePolicy	Application Permission	Flag channel messages for violating policy
       Chat.Read.All|	Application Permission	Read all chat messages
       Chat.ReadWrite.All	Application Permission	Read and write all chat messages
       Chat.UpdatePolicyViolation	Application Permission	Flag chat messages for violating policy
       ChatMessage.Read.All	Application Permission	Read all chat messages
       Directory.Read.All	Application Permission	Read directory data
       Organization.Read.All	Application Permission	Read organization information
       Team.ReadBasic.Alll	Application Permission	Get a list of all teams
       TeamMember.ReadWrite.All	Application Permission	Add and remove members from all teams
       User.Read.All	Application Permission	Read all users' full profiles

12. After adding permissions, select Grant admin consent for <org_name>.

Microsoft Yammer API-DP

1. Navigate to https://portal.azure.com. 
2. Select App Registrations. 
3. Click New Registration.
   
   
    
4. Enter the following details, then click Register.
   1. Name: Enter a name for the application.
   2. Supported account types: Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
   3. Redirect URL: Select URL type as Web and enter the URL in the following format:
      • https://<cluster-FQDN>/v1/msyammer/auth-callback
        
        
        
        The application is registered.
5. Record the application (client) ID.
   
   
    
6. In the left menu bar, select Certificates & secrets.
7. Click + New client secret.
   
   
    
8. Enter a description and expiry time, and then click on Add at the bottom of the page.
9. Immediately copy the Value (not the Secret ID) to somewhere safe. Note that this value will no longer be accessible after you leave the page.
   
   

   Note: For details on configuring and using the saved credentials from step 5 and 9, refer to the msyammer block in the API-DP Helm values.yaml file. 

10. Assign API permissions in the created application:
    1. In the newly created application's left menu bar, click API Permissions, then select the + Add a permission option.
    2. Select following permissions one by one and click Add Permission.
       1. Under Microsoft graph >  Delegated permission >. User.Read.
       2. Under Yammer > Delegated permission > access_as_user.
          
          

Notion for API-DP

To create a new API-DP integration in Notion:

1. Click the three dots in the upper right corner of the screen, and then select Add connections > Manage connections.
   
   
2. Select My connections > Develop or manage integrations.
   
   
    
3. In the Integrations screen, click + New Integration.
   
   
    
4. In the APIDP-Notion screen, enter a name in the Company name field.
   
   
    
5. Set the integration to public.
6. Connect to one workspace and fill out the required information.
7. Under OAuth Domain & URIs, enter the Redirect URI using the following format and then click Save:
   
   https://<cluster-FQDN>/v1/notion/auth-callback
   
   
8. The OAuth Client-ID and OAuth Client Secret are displayed under Secrets. Record and store them for later use. 
   
   

Salesforce for API-DP

1. Login to https://login.salesforce.com/ and navigate to Setup.
2. In the left menu, click Platform Tools > Apps > External Client Apps > Settings.
   
   
    
3. Turn on Allow creation of connected apps, if available, and click New Connected App.
   
   
    
4. Enter the required information for the app, including the name, API name, contact email, and description.
   
   
    
5. In the API (Enable OAuth Settings) section, click the checkbox for Enable OAuth Settings.
   
   
    
6. Enter the Callback URL for the app in the format shown below, and then select the full and refresh_token scopes, as shown below:
   • Callback URL: https://<cluster-FQDN>/v1/salesforce/auth-callback
     
     
      
7. Retain the default settings for the remaining fields, and save the changes.
8. Click Manage Consumer Details, which displays a Consumer Key and Consumer Secret, and save these credentials for later use.
   
   
    
9. Run the script provided by Versa Networks and follow the onscreen instructions to obtain the app ID and save it for later use.

   Note: For details on configuring and using the saved credentials from Step 8 and app ID from Step 9, refer to the Salesforce block in the API-DP Helm values.yaml file.

ServiceNow for API-DP

No configuration is required for ServiceNow.

Slack for API-DP

1. Navigate to https://api.slack.com/apps and log in.
2. Click Create New App. and then select From an app manifest.
   
   
    
3. Select the workspace to develop the app, and then click Next.
   
   
    
4. Choose either YAML or JSON, erase the default content, and paste the app manifest provided below in Slack for Application Manifests (by replacing the placeholders for the app name, auth callback, and webhook URLs), then proceed to the next step. 
   
   
    
5. Confirm the details, and then click Create.
   
   
    
6. Under Settings, select Manage Distribution.
   
   
    
7. Click to expand the Remove Hard Coded Information section, and then click the checkbox to continue. 
   
   
    
8. Click on Activate Public Distribution at the bottom of the page.
   
   
    
9. Under the Event Subscriptions tab, make sure you do not see "Your URL didn't respond". If you do see this message, as shown below, click Retry.
   
   
    
10. Navigate to the Basic Information tab.
11. Copy the Client ID, Client Secret, and Signing Secret, and store them for later use. 
    
    

    Note: For details on configuring and using the saved credentials, refer to the Slack block in the API-DP Helm values.yaml file.

Trello for API-DP

1. Navigate to https://trello.com/power-ups/admin and log in.
2. Click the Get Started button or navigate to the Apps section.
3. Click the New button to start the application creation process.
   
   
    
4. Fill in the required details for your application, including the name, Workspace, and any relevant URLs, then click Create.
   
   
    
5. Navigate to API key tab, and then click Generate a new API key.
   
   
    
6. In the Allowed origins field, enter the Callback URL in the format shown below, and then click Add:
   • Callback URL: https://<cluster-FQDN>/v1/trello/auth-callback
     
     
7. Copy the API key and Secret and store them for later use.

   Note: For details on configuring and using the saved credentials, refer to the Trello block in the API-DP Helm values.yaml file.

Zendesk for API-DP

1. Click the Settings icon in the left menu, and then click Go to Admin Center.
   
   
    
2. Add the OAuth client by navigating to Admin Center > Apps and Integrations > APIs > Zendesk API > OAuth Client > Add OAuth Client.
   
   
    
3. Set the Unique identifier and Type to be confidential, enter the Redirect URL in the format shown below, and then generate the secret:
   • Redirect URL: https://<cluster-FQDN>/v1/zendesk/auth-callback
     
     
4. Click Save.
5. Store the secret for later use. The unique identifier and secret is the client-id and client-secret used to grant access.
6. To create the webhook, go to Apps and integrations > Webhooks > Create Webhook.
   
   
    
7. In the Create webhook screen, select Trigger or automation.
   
   
    
8. Enter the endpoint URL in the format shown below, the request method (POST), and the format (JSON):
   • Endpoint URL: https://<cluster-FQDN>/v1/zendesk/webhook
     
     
9. To create a Trigger, go to Objects and rules > Triggers > Add Trigger. 
   
   
    
10. Add conditions when an event happens (in this case, when comment is created or updated).
    
    
     
11. For Actions, choose the webhook created.
    
    
     
12. Customize the JSON body:

{ "user": { "id": "{{current_user.id}}", "name": "{{current_user.name}}", "email": "{{ticket.requester.email}}" }, "obj_owner":{ "name": "{{ticket.requester.name}}", "email": "{{ticket.requester.email}}" }, "tenant": { "id" : "{{current_user.organization.id}}", "name" : "{{ticket.brand.name}}" }, "created_at": "{{ticket.updated_at_with_timestamp}}", "ticket_id" : "{{ticket.id}}", "obj_id": "{{ticket.latest_comment.id}}", "subject": "{{ticket.title}}", "content": "{{ticket.latest_comment.value}}", "attachments": [ {% for attachment in ticket.latest_comment.attachments %} { "name": "{{attachment.filename}}", "url": "{{attachment.url}}" }{% unless forloop.last %},{% endunless %} {% endfor %} ] }

Zoom for API-DP

Note: All steps should be performed from the Admin Account.

1. Navigate to Account Settings.
   
   
    
2. Navigate to Admin -> App Marketplace.
3. In the App Marketplace, select Build App from the drop-down list in the top right corner.
   
   
    
4. Click General App, and then click Create.
   
   
    
5. Copy the Client ID and Secret and store them for later use.
   
   
6. Add the OAuth Redirect URL in the format shown below, and then click Continue:
   
   Redirect URL: https://<cluster-FQDN>/v1/zoom/auth-callback
   
   
7. Get the token for event subscription.
   
   
    
8. Enable and configure event subscription.
   1. Set Webhook for file-send/message-send and Webhook Event notification endpoint URL in the following format:
      
      Event notification endpoint URL: https://<cluster-FQDN>/v1/zoom/webhook
      
      
      
      
      • Team Chat DM Message Posted
      • Team Chat DM Message Updated
      • Team Chat DM Message Deleted
      • Team Chat Channel Message Posted
      • Team Chat Channel Message Updated
      • Team Chat Channel Message Deleted
      • Team chat file uploaded
      • Team chat file changed
      • Team chat file deleted
         
   2. Set Webhook for meeting-join/channel-join and Webhook Event notification endpoint URL.
      
      
      
      
       
      • Meeting
        • Participant/Host joined meeting
      • Chat Channel
        • Chat Channel Created
        • Chat Channel Updated
        • Chat Channel Deleted
        • Member Invited
        • Member Removed
        • Member Joined
           
9. Click Save and continue.
10. Click Continue for Surface configuration.
    
    
     
11. Click Continue for Embed configuration.
    
    
     
12. On the next screen “Add Scopes”, search and add scopes as shown in the below screens.
    
    
    
    
    
    
    
    
    
    Account
    • account:read:account_setting:master — View an account's settings
    • account:read:settings:master — View an account's settings
    • account:read:account_setting:admin — View an account's settings
    • account:read:settings:admin — View an account's settings
    • account:read:lock_settings:admin — View an account's lock settings
    • account:read:managed_domains:admin — View an account's managed domains
    • account:read:registration_settings:admin — View an account's registration settings
    • account:read:vanity_url:admin — View an account's vanity URL
    • account:read:entitlement:admin — View an account's entitlement
    • account:read:trusted_domains:admin — View an account's trusted domains
    • Meeting
      • meeting:read:participant:admin — View a meeting's participant
      • meeting:read:participant:master — View a meeting's participant
    • Recording
      • cloud_recording:read:list_user_recordings:admin — Lists all cloud recordings for a user
    • Team Chat
      • app:channel_content:write:admin — Enable Chatbot within Zoom Team Chat Channel
      • imchat:bot — Enable Chatbot within Zoom Team Chat Client
      • team_chat:update:chat_control:admin — Update a chat control
      • team_chat:write:legal_hold_matter:admin — Add legal hold matter
      • team_chat:delete:legal_hold_matter:admin — Delete legal hold matter
      • team_chat:update:legal_hold_matter:admin — Update legal hold matter
      • team_chat:delete:file:admin — Delete a chat file
      • team_chat:write:migrate_dm_conversation_or_channel_operations:admin — Migrate DM conversation and channel operation
      • team_chat:write:migrate_chat_messages:admin — Migrate chat messages
      • team_chat:write:migrate_channel_members:admin — Migrate channel members
      • team_chat:write:migrate_a_chat_channel:admin — Migrate a chat channel
      • team_chat:write:migrate_chat_message_reactions:admin — Migrate chat message reactions
      • team_chat:write:contact_information:admin — Send contact invitation
      • team_chat:read:list_user_channels:admin — View a user's chat channels
      • team_chat:read:list_channels:admin — View chat channels
      • team_chat:read:channel:admin — View a chat channel
      • team_chat:read:user_channel:admin — View a user's chat channel
      • team_chat:read:list_members:admin — View a chat channel's members
      • team_chat:read:list_invitations:admin — List a user's pending invitations
      • team_chat:read:list_administrators:admin — View a chat channel's admins
      • team_chat:read:mention_group:admin — List all the mention groups in a channel
      • team_chat:read:list_channel_activity_logs:admin — Channel activity logs for specific channel
      • team_chat:read:list_user_sessions:admin — View a user's chat sessions
      • team_chat:read:list_user_messages:admin — View a user's chat messages
      • team_chat:read:user_message:admin — View a user's chat message
      • team_chat:read:thread_message:admin — Retrieve messages under a thread
      • team_chat:read:list_bookmarks:admin — List user's bookmarks
      • team_chat:delete:member:admin — Remove a chat channel's member
      • team_chat:delete:user_channel:admin — Delete a user's chat channel
      • team_chat:update:mention_group:admin — Update the mention group's information
      • team_chat:delete:channels:admin — Delete channels
      • team_chat:write:mention_group:admin — Create a mention group
      • team_chat:update:retention:admin — Update retention policy of a channel
      • team_chat:write:groups:admin — Add groups to a chat channel
      • team_chat:read:retention:admin — Get retention policy of a channel
      • team_chat:write:administrator:admin — Add administrators to a chat channel
      • team_chat:write:user_channel:admin — Create a chat channel for a user
      • team_chat:delete:channel:admin — Delete a chat channel
      • team_chat:write:members:admin — Add members to a chat channel
      • team_chat:delete:group:admin — Remove a chat channel's member group
      • team_chat:write:search_channels:admin — Search account's channels
      • team_chat:update:channel:admin — Update a chat channel
      • team_chat:delete:mention_group:admin — Delete a mention group
      • team_chat:update:user_channel:admin — Update a user's chat channel
      • team_chat:update:archive_channels:admin — Archive or unarchive channels
      • team_chat:read:list_groups:admin — View a chat channel's member groups
      • team_chat:delete:batch_members:admin — Remove a chat channel's members
      • team_chat:delete:batch_administrators:admin — Remove a chat channel's admins
      • team_chat:delete:user_message:admin — Delete a user's chat message
      • team_chat:write:user_message:admin — Create a chat message for a user
      • team_chat:write:message_files:admin — Add files to chat messages
      • team_chat:write:files:admin — Add files to chat
      • team_chat:update:user_message:admin — Update a user's chat message
      • team_chat:update:message_emoji:admin — Update a user's chat message emoji reaction
      • team_chat:update:message_status:admin — Update a user's chat message read status
      • team_chat:read:file:admin — Get chat file information
      • team_chat:read:migrated_channels:admin — Get migrated chat channels
      • team_chat:read:migrated_users:admin — Users can view migrated chat users
    • User
      • user:read:token:admin — View a user's token
      • user:read:list_assistants:admin — View a user's assistants
    • Users
      • user:read:list_users:admin — View users
      • user:read:user:admin — View a user
      • user:read:user:master — View a user
         
13. After selecting the scopes, click Continue. The app is configured.

Amazon Web Services for API-DP

The information in this section applies to service providers who operate the API-DP platform and provide the API-DP services to their customers, and covers the one-time provider-side setup that should be completed before onboarding the first customer. The provider's customers own the AWS accounts that are being protected. For information about the per-customer steps, such as granting access, downloading the aws_cft.zip file, and deploying the CloudFormation templates, see Configure Cloud Applications to Use with API-Based Data Protection. 

Amazon Web Services (AWS) is an IaaS connector, so the provider does not need to register an OAuth application. Access works as follows:

• The provider holds one long-lived identity and access manager (IAM) user.
• Each customer creates a cross-account role that trusts it.

The provider never holds customer credentials. It holds only its own IAM user, whose sole permission is to assume <Provider>_Role in customer accounts. The provider name is a prefix that is included in every resource created by the customer's stack, so the resource must be created before any customer is onboarded.

The provider performs the following steps before onboarding a customer.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/<Provider_name>_Role"
        }
    ]
}

global:
   providerName: "abc"

global:
  services:
    aws:
      enable: true
      iam_user: "<iam user name from Step 1>"
      account_number: "<provider account number from Step 1>"

aws:
  enable: true
  auth:
    secretData:
      clientId: "<base64 of the AWS access key ID>"
      clientSecret: "<base64 of the AWS secret access key>"

printf '%s' '<AWS access key ID>'     | base64
printf '%s' '<AWS secret access key>' | base64

# 1. your provider prefix applied throughout (expect several matches each)
grep -c "Abc_" aws-instance-role-master.yaml aws-instance-setup-master.yaml

# 1b. and none of the shipped default prefix left behind (expect 0 each)
grep -c "Versa" aws-instance-role-master.yaml aws-instance-setup-master.yaml

# 2. trust policy points at the PROVIDER's account and IAM user
grep "arn:aws:iam::.*:user/" aws-instance-role-master.yaml

# 3. webhook endpoint is the provider's own cluster
grep "Endpoint:" aws-instance-setup-master.yaml

kubectl get secret saas-aws-oauth -n apidp -o jsonpath='{.data.client-id}' | base64 -d

Google Cloud Platform for API-DP

No configuration is required for Google Cloud Platform.

Microsoft Azure for API-DP

No configuration is required for Microsoft Azure.

Oracle Cloud Infrastructure for API-DP

No configuration is required for Oracle Cloud Infrastructure.

Supported Software Information

Release 12.2.2 and later support all content described in this article.

Additional Information

Configure API-Based Data Protection Policies for IaaS
Configure API-Based Data Protection Policy for SaaS
Configure Cloud Applications to Use with API-Based Data Protection