Integrations: request bins refused, webhooks always signed, Set credential and Test, Microsoft Teams / Graph, pipeline rules and the API Call Log by Source IP

Connections, webhooks and pipelines refuse public request bins and tunnels unless an administrator records an exception; a webhook delivery is never sent unsigned; Set credential asks for what the connector authenticates with and Test tries it; Microsoft Teams / Graph is in the catalog; an active pipeline needs a destination and, if incremental, a Key line; and the API Call Log is broken down by Source IP, with repeated unauthenticated calls blocked and reported.

Platform › Connectivity › Integration (Connector Catalog, Connections, Data Pipelines), Events & Webhooks (Webhooks, Webhook Deliveries) and Published API (API Call Log).

Public request bins and tunnels

• A connection, webhook or pipeline that points at a public request bin or tunnel — webhook.site, requestbin, pipedream, beeceptor, ngrok, loca.lt, trycloudflare.com, smee.io and the like — is refused on save and on activation: anybody who has its address can read what is sent to it.
• Exception: an administrator can allow that one host on that one record by filling in Exception reason (at least 10 characters). The reason is kept with the record and in the audit trail. Others are told “Only an administrator can allow this exception.”
• Lists flag them: Endpoint warning on Connections, Receiver warning on Webhooks. Deliveries to such a host are held back as Not sent.
• A Production connection pointing at a reserved example address (example.com, .example, .test, .invalid) is refused on save; Sandbox, Test and Staging connections may keep one.

Signed webhooks are never sent unsigned

• A delivery whose webhook has no signing secret is not sent: “Not sent: no signing secret is set on this webhook, and a delivery is never sent unsigned. Set one with Set signing secret on the Webhooks screen, then send the event again.”
• A secret this server can no longer open fails the delivery with that reason, and the webhook cannot be made active until a new secret is set.
• Webhook Deliveries says how each was sent: Signed, Sent unsigned (older deliveries), Unsigned — no secret set, Unsigned — secret cannot be opened.
• Redeliver on a failed or abandoned delivery sends the same event again, with the same event id, once the receiver is put right (needs Change on the webhook).
• A receiver that answers with a web page is flagged “Answered with a web page — check the receiver”, and Webhooks counts Web-page answers.

Set credential and Test

1. On Connections choose Set credential. The fields are those the connection’s connector authenticates with (its Authentication on the Connector Catalog).
2. OAuth 2.0: Client id, Client secret, Token URL (https), Scopes, Audience. HMAC: Signing secret, Header name. mTLS: Client certificate (PEM), Private key (PEM), CA certificate (PEM). API key: API key, Header name. Basic: Username, Password. Bearer / JWT: Token.
3. Secret fields are masked with Show / Hide and are not saved by the browser. The credential is stored encrypted and cannot be read back, only replaced.
4. Press Test: a verified TLS 1.2+ handshake (and one request for HTTPS), plus the OAuth 2.0 client-credentials token exchange where that is the method. It says what failed.

An expired client certificate, a private key that does not belong to the certificate, a header name with other than letters, digits and hyphens, or a missing field is refused with the reason. Connections shows Auth and Credential columns.

Microsoft Teams / Graph

The Connector Catalog has Microsoft Teams / Graph (Microsoft, communication), authenticating with OAuth 2.0 client credentials: token URL https://login.microsoftonline.com/<tenant id>/oauth2/v2.0/token and scope https://graph.microsoft.com/.default. Set credential with your app registration’s client id and secret, then Test.

Data pipelines: when one may be active

• An active pipeline needs a destination resource — the object or table the records go to (for Salesforce, the object name).
• An incremental or change-data-capture pipeline needs at least one Key line in its field mapping, the field that identifies a record at the destination.
• Ledger data (journals, invoices) does not go to a CRM unless an administrator records an Exception reason; choose a finance or data-warehouse destination instead.
• The rules apply on run too: “Not run: …. Fix the pipeline on Platform › Data Pipelines and run it again.”

API Call Log by Source IP, and calls without a key

• The API Call Log’s From column is now Source IP, and its breakdown groups calls by Source IP.
• An address that makes 20 calls without a valid API key within 10 minutes is answered 429, “Too many calls from this address without a valid API key. Wait and retry with a valid key.” Addresses on the IP allowlist are exempt.
• At 50 such calls administrators are e-mailed “API: <count> calls without a valid key in <minutes> minutes” — at most once an hour, audited. The mail event is Many API calls arrive without a valid key on Platform › Email Rules, where it can be redirected or silenced.