REST API & Developer Portal
Programmatic access to every platform capability. Build integrations, trigger workflows, manage agents — all through well-documented APIs.
60+ REST Endpoints
Full CRUD for workers, workflows, tools, knowledge bases, memory, triggers, integrations, and scheduling. Every endpoint documented with OpenAPI specs.
Interactive Developer Docs
APIM Developer Portal with request/response schemas, copy-paste code samples, and live testing. Try endpoints before you write a line of code.
OAuth2 Client Credentials
Machine-to-machine authentication via Azure Entra ID. Bearer tokens, API key fallback, and per-tenant credential scoping.
Webhooks & Event-Driven
Trigger workflows from external systems via HTTP webhooks with HMAC signature verification. Pre-built profiles for Stripe, GitHub, and Jira.
Extensible Tool System
Seven tool types that agents use to interact with external systems. Build once, share across all workers and workflows.
| Type | Details |
|---|---|
| HTTP | REST calls with auth (bearer, API key, basic, OAuth2), body templating, JSONPath/regex parsing |
| Python | Inline scripts in a restricted sandbox — whitelisted builtins, 10s timeout |
| LLM | Model calls as reusable tools — registry resolution, JSON mode, custom parameters |
| Knowledge | Semantic search against Qdrant — top-N chunks with metadata filtering |
| Workflow | Invoke another workflow as a tool. Automatic schema generation. Zero config for consumers. |
| MCP / Native | Model Context Protocol servers plus native integrations built on demand |
| SMTP or Microsoft Graph with template-based content |
Every tool type supports parameter extraction, type coercion, result caching, return-direct mode, and smart post-processing filters.
Authentication & Access Control
Three auth methods, five RBAC levels, and tenant-isolated secrets management.
User Auth
Azure AD B2C with social and enterprise identity providers. JWT validation on every request.
M2M Auth
Azure Entra ID OAuth2 client credentials for service-to-service communication.
API Keys
Tenant-scoped API keys for lightweight integrations. Rotatable without downtime.
RBAC
Five levels — system admin, org admin, tenant admin, designer, viewer. Enforced at every endpoint.
Multi-Tenant Isolation
Org → Tenant → Department hierarchy. Data partitioned at every level. No cross-tenant leakage.
Dual Key Vaults
Platform-level vault for infrastructure secrets. Per-tenant vault for customer credentials. Never co-mingled.
Technical Architecture
Four layers that power every workflow, worker, and integration on the platform.
Agent Development Framework
Configure workers via API or visual designer. Define personas, bind tools, scope knowledge bases, and set memory hierarchies. Full CRUD through REST endpoints with OpenAPI schemas.
Integration Engine
Seven tool types — HTTP, Python, LLM, Knowledge, Workflow, MCP/Native, and Email. Each supports auth config, parameter extraction, result caching, and post-processing. Build custom tools that any worker can consume.
Orchestration Engine
22 step types across 6 categories: actions, AI, control flow, memory, people, and documents. Conditional branching, for-each and while loops, parallel fan-out with sync joins, and sub-workflow invocation.
Observability & Cost Tracking
Full execution traces per run — inputs, outputs, duration, token usage, cost per step. Live progress via SignalR. Activity dashboard with time-range filtering, success rates, and failure diagnostics.
Security & Compliance
Data & Credential Security
- Dual Key Vault — platform-level and per-tenant secret stores, never co-mingled
- Sandboxed Python execution — restricted builtins, whitelisted imports, 10s timeout
- Webhook signature verification (HMAC) on all inbound events
- Tenant-scoped API keys with rotation support
Compliance & Audit
- SOC 2 Type II preparation and audit readiness
- HIPAA compliance capabilities for healthcare deployments
- GDPR compliance for international data handling
- Full execution traces — timestamps, inputs, outputs, costs, approvals per step
Infrastructure
- Azure-hosted with Web Application Firewall (WAF) on all endpoints
- Org → Tenant → Department hierarchy with partition-level data isolation
- Five-level RBAC enforced at every API endpoint
- Azure AD B2C user auth, Entra ID M2M auth, API key auth
Ready to integrate?
Get API access, explore the developer docs, and build your first integration.