Every surface below reads the same connector definition and the same saved tenant credentials. What differs is where field values come from, and who's responsible for mapping them.
1 · Directly from your app
Call the action over HTTP, in the body, supplying whichever fields the connector's setup left for the caller (source: caller fields not already covered by the org's field mapping):
POST /app/{orgcode}/ipaas/{connector}
{ "action_id": "create_contact", "fields": { "email": "jane@example.com" } } The action is a body field (action_id), not part of the URL. Tenant-sourced and identity-sourced fields are filled in automatically — don't send them; sending one does nothing.
2 · From an automation
Attach the connector action as the destination of an entity lifecycle event. Field values are mapped inline, per automation, resolved from the record that fired the event:
{
"entity_name": "Contact",
"event_type": "external.connector",
"event_stage": "after",
"event_optype": "create",
"destination_config": {
"connector_id": "salesforce",
"action_id": "create_record",
"field_mapping": { "sobject_type": "Contact", "Email": "{{source.email}}" }
}
} {{source.field}} references the entity record that triggered the event. As with org-level setup, every required field the action declares must be mapped before the automation can be saved — the builder blocks you from moving past the field-mapping step, and the save is rejected server-side too if it's ever bypassed.
3 · From a logic block
Add a connector step to a multi-step logic block. Field values can reference an earlier step's output or the logic block's own inputs:
{
"type": "connector",
"outputAs": "slackPost",
"config": {
"connectorId": "slack",
"actionId": "post_message",
"required": true,
"fieldMappings": [
{ "field": "channel", "value": "#alerts" },
{ "field": "text", "value": "{{previousStep.summary}}" }
]
}
} - The connector picker only lists connectors already adopted for the org; the action picker only lists actions usable from a logic block.
required: true(the default) fails the whole run if the workspace hasn't configured this connector. Setrequired: falseto skip the step silently instead when it isn't configured.- Every required field must be mapped before the block can be saved, same as an automation.
Result of a connector step is { status, headers, body } — reference it in later steps as {{slackPost.status}} / {{slackPost.body}}.
Outbound safety, every surface
- Every outbound call must be HTTPS and can't target a private IP or localhost.
- The resolved host must match the connector's own allowed domains.
- The resolved host must also match the org's own connector domain allowlist, if one is configured (Org Settings → Integrations).