Integration Actions
Send public-safe pentest evidence to Sandbox or BrowserOps only when the action has a clear operator purpose and downstream confirmation.
Preview
availableAnyone can preview the exact payload. No downstream call is made and no success is claimed.
Protected Send
operator checkpointThe server has PLATPHORM_API_KEY for downstream calls, but the browser action still needs an operator session key or Authorization header.
Evidence Contract
artifact backedHandoffs include run id, target scope, allowed host, selected evidence routes, trace ids, and a public-safe redaction policy.
Evidence source
Operator authorization
Server `PLATPHORM_API_KEY` is checked before this page renders. When present, protected sends use that backend credential without exposing it to the browser. Add a runtime PlatPhorm key only when the server key is missing or you need a one-action override.
What will be sent
- run id and target scope
- allowed-host validation result
- public-safe run and log artifact links
- trace/request ids
Evidence routes
- https://example.test
- https://pentest.platphormnews.com/runs/pentest-2026-06-14-a39c81cd
- https://pentest.platphormnews.com/api/v1/runs/pentest-2026-06-14-a39c81cd/logs
Expected confirmation
- handoff acceptance id
- schema/scope validation status
- safe replay or dry-run evidence pointer
Server-side `PLATPHORM_API_KEY` is configured. Protected sends are available from this deployment; the key is never rendered and delivery is still confirmed only by the downstream service.
Operator credential controlscollapsed by default
Runtime Credentials
Server credentials are used first. Browser-session keys are optional one-action overrides and are never rendered back.
Used for real-run setup, protected integration previews, downstream PlatPhorm handoff.
Used for model routing checks, future gateway-backed model calls.
Used for future sandbox job creation when server OIDC is unavailable.