Connector spokes

A spoke is a connection to a system you already run — PagerDuty, Jira, ServiceNow, Salesforce and the rest. Connect one and its credentials are encrypted and held in the vault; from then on your workflows can call it, and its events can start your workflows.

Where a Webhook pushes your events outward, a spoke is a two-way link: actions are things AxisSynapse does in the other system, triggers are things that system does which start work here.

TL;DR — Settings → Integrations, pick a spoke, Connect, paste its credentials. Use Run action to prove it works before wiring it into anything. Every call is rate-limited, audited, and protected by a Circuit breaker that pauses a spoke that keeps failing.

What connecting gives you

Before you start

You need the Workspace admin role, and on the other system, enough access to create an API credential. Each spoke below lists exactly which one — several vendors offer more than one kind of credential and only one of them works.

Connect a spoke

1. 1

   Open Settings → Integrations

   Every available spoke is listed with the actions and triggers it supports and the kind of credential it expects. Spokes you have already connected appear at the top.

2. 2

   Click Connect

   The form asks only for what that spoke actually needs. Some want a token; some want a username and password; some want a base URL because the vendor gives every customer their own address.

3. 3

   Prove it with Run action

   Pick an action, fill in the inputs, and run it once. This is a real call — a real incident, a real issue, a real record — so use a test project or a throwaway record the first time.

4. 4

   Read the response

   A green result shows the vendor's response body. A failure shows what the vendor said, in their words. That message is almost always specific enough to fix on the first try.

Setting up each connector

The credential each vendor wants is rarely the one you would guess, and picking the wrong one usually produces an error that points somewhere else entirely. What follows is what actually works, verified against a live account for each.

PagerDuty

Trigger an incident. No connection credential at all — the Events API authenticates on the routing key carried in each request.

1. 1

   Create a service

   In PagerDuty: Services → Service Directory → New Service.

2. 2

   Add an Events API V2 integration

   On the Integrations step, choose Events API V2. Copy the 32-character Integration Key.

3. 3

   Connect and run

   Connect the spoke, then run Trigger an incident with the integration key as the Routing key. Severity must be one of critical, error, warning or info — the field is a picker, so you cannot get it wrong.

Jira

Create an issue, add a comment. Email plus an API token, and your own site address.

1. 1

   Create an API token

   At id.atlassian.com → Security → API tokens, create a token and copy it. This is not your Atlassian password.

2. 2

   Find your project key

   In Jira: Projects → View all projects. The Key column holds a short uppercase code such as OPS — every issue is prefixed with it. It is not the project name.

3. 3

   Connect

   Base URL is your site: https://your-site.atlassian.net. Username is your Atlassian email. Password is the API token.

4. 4

   Run it

   Run Create an issue with the project key, a summary, and an issue type. Issue type is required and must already exist in that project — commonly Task, Bug or Story, though a project can define its own.

ServiceNow

Read a table. Username and password, your instance address, and one role most people miss.

1. 1

   Grant the Basic-auth role

   ServiceNow restricts Basic authentication to users holding a specific role. In the instance: All → Users, open the user, Roles → Edit, and add snc_basic_auth_api_access.

2. 2

   Make sure the password is settled

   If the account was recently given a password by an administrator, ServiceNow marks it as needing a reset. Sign in as that user once and complete the change before using it here.

3. 3

   Connect and run

   Base URL is your instance, e.g. https://your-instance.service-now.com. Then run Read a table with incident and a limit of 1.

Salesforce

Create a record. OAuth, which means an app registration rather than a password.

1. 1

   Create an External Client App

   In Setup → App Manager, choose New External Client App. Newer orgs no longer offer "New Connected App" — this replaced it.

2. 2

   Enable OAuth

   Under API (Enable OAuth Settings): turn OAuth on, set any callback URL (it is required but never used here), and add the scope Manage user data via APIs (api).

3. 3

   Enable the client-credentials flow

   Still in settings, under Flow Enablement, tick Enable Client Credentials Flow. Save.

4. 4

   Set the Run As user

   On the Policies tab, a Run As field now appears. It wants a Salesforce username, which looks like an email but usually carries a suffix — copy it from Setup → Users, not from your inbox.

5. 5

   Connect

   Take the Consumer Key and Consumer Secret from the app. Base URL and Token URL are both your org's domain, the token URL ending /services/oauth2/token.

Zendesk

Create a ticket. An OAuth client, not an API token.

1. 1

   Create an OAuth client

   In Zendesk: Admin Center → Apps and integrations → APIs → OAuth clients → Add OAuth client. Note this is the one under APIs, not the similarly named entry under Connections — that one is for Zendesk connecting outward.

2. 2

   Fill it in

   Give it a name and description, set Client kind to Confidential, and put any redirect URL in — it is required and never used here. Save, then copy the Secret; it is shown once.

3. 3

   Note the identifier Zendesk actually saved

   The Identifier is your client id, and Zendesk does not always keep what you typed. Read it back off the saved client rather than assuming.

4. 4

   Connect

   Base URL is https://your-subdomain.zendesk.com, and the Token URL is that address followed by /oauth/tokens. Client id is the identifier; client secret is the secret you copied.

HubSpot

Create a contact. A private app token — not one of HubSpot's OAuth apps.

1. 1

   Create a private app

   In HubSpot: Settings → Integrations → Private Apps → Create a private app. Give it a name.

2. 2

   Grant the scopes

   On the Scopes tab, search for contacts and tick crm.objects.contacts.read and crm.objects.contacts.write. Create the app and copy the token it shows.

3. 3

   Connect and run

   Paste the token. There is no base URL — HubSpot's is the same for everyone. Then run Create a contact with an email address.

Microsoft 365

Send mail. An app registration, and one approval only an administrator can give.

1. 1

   Register the app

   At entra.microsoft.com → App registrations → New registration, name it and register. Copy the Application (client) ID and the Directory (tenant) ID from the overview.

2. 2

   Create a secret

   Certificates & secrets → New client secret. Copy the Value, not the Secret ID — they sit next to each other and only the Value works. It is shown once.

3. 3

   Add the permission and get it approved

   API permissions → Add a permission → Microsoft Graph → Application permissions → Mail.Send. Then Grant admin consent. That button is greyed out unless you are an administrator; without the green tick the token arrives with no permission to send.

4. 4

   Connect and run

   Token URL is https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token. Leave Scope blank. There is no base URL. From user must be a real licensed mailbox in your tenant, not any address.

What happens on every call

When a call fails

Using a spoke in a workflow

A connection on its own does nothing. To put it to work, add a connector step to a workflow, choose the connection and the action, and map your record's fields onto the action's inputs.

See Reference → Audit codes for the full list and what each one records.