Connect external systems to Agent and business processes

Before you begin

Use a workspace where external connection administration is enabled. Open Settings → Company administration → General → External connections. If the menu is missing, ask your administrator to check availability and your connection read permission.

Reading, creating, editing metadata and managing credentials require separate permissions. Being the creator or named custodian does not grant additional access.

Register a connection

1. Under Scope, choose Personal connections, Company connections or Organization connections (a legal entity). Personal connections are hidden from other users. Organizational records require permission in the corresponding scope.
2. For a legal-entity connection, select the entity and choose Add connection. Check the target again in the registration form.
3. Enter a Connection name and Purpose. Describe the business reason, such as keeping delivery status up to date.
4. Select the Connection type and save.

The saved detail page shows the name, purpose, creator and custodian. Return to the list and reopen the record to confirm it was retained. A saved connection's scope and type cannot be changed.

Store or replace credentials

Credential editing controls require credential-management permission. Check the credential type issued by the external service before entering its value.

1. Select Bearer Token or API Key as the authentication method.
2. For an API key, select the service's required header: x-api-key, api-key or private-token.
3. Enter the New credential value and choose Save credentials. Never put a secret in the connection name or purpose.
4. Confirm the stored status and an empty input field. The saved plaintext cannot be displayed again.

Use the same procedure to replace a value. Failed saves retain your input so you can correct it. If someone else changed the record first, reload the current state and reassess the intended replacement.

Remove stored credentials

Choose Revoke credentials and confirm. Check that the status reports no stored credentials. The connection name and purpose remain. This removes Nexia's copy; it does not invalidate the key at the external provider. Revoke it there as well when it should no longer be used.

Troubleshooting

• A record is missing: check the selected scope and legal entity. Another user's personal connection is not visible to you.
• Editing controls are unavailable: read access does not include metadata or credential changes. Ask the administrator for the permission needed for your task.
• Saving fails: check the value's format and whether another user changed the record. If the issue persists, contact the administrator without including the secret in a message or screenshot.

Use an external operation in a Process Task

1. Open External connections in the process editor and select a legal-entity connection. Manage its credentials in Settings. Save the external HTTPS address and enable the connection.
2. Add a named operation with its HTTP method, path and input schema. For an external MCP connection, load the available tools and select one. Enable the operation.
3. In the process editor, select the registered operation for a service Task and map process variables to its inputs. When a published process reaches the Task, it waits for the call result before advancing.

The user starting the process needs permission to use the connection. Registered request definitions and destinations with operations are fixed. To change them, create a new connection or operation and bind it in a new process version. Credential changes do not silently send existing executions with replacement credentials. Check execution history and review the process incident. An API call with an uncertain remote outcome is not retried automatically.

Send a webhook

Select webhook signing for an HTTP connection and store the signing key shared with the receiver. Nexia signs POST deliveries. The receiver must verify the signature and timestamp and deduplicate message IDs. Failed deliveries are attempted up to eight times with increasing delays; every attempt rechecks current authorization and credentials.

Continue waiting work from an external webhook or API

First add a Wait for message step, select Receive an external message, and publish the process.

1. In a published process editor, open External connections, select a legal-entity HTTP connection and add a receiving endpoint. Choose webhook or Nexia API.
2. Select a message-waiting step in the current process and an expiry date. Issued endpoints cannot be retargeted.
3. The issued secret appears only once. Transfer it securely to the external system operator. Issuing a key does not grant access: an administrator with grant authority must authorize the receiver separately.
4. Send the running process ID and input payload to the endpoint. API requests use Bearer authentication and an idempotency key; webhooks include a signature, message ID and timestamp.

This endpoint delivers a message to the selected process wait. It does not start a process or expose unrestricted Nexia data access. An accepted response does not mean the whole process has completed. Keep the same body and message ID for replays. Expired or revoked keys and revoked receiving grants are rejected.

Find where a connection is used

The Settings detail shows destinations, operations and receiving targets read-only. In Used in, inspect the process and step and open the owning work. Only usages you may read are shown; readers without edit authority open the read-only inspector. Business bindings are not edited here. Renaming a connection or changing its purpose does not change execution configuration.

Use external HTTP/MCP operations with Agent

1. Open Agent management → External connections and select or register a connection in an authorized personal, tenant or legal-entity scope.
2. Configure its external destination and credentials, then register an operation. For MCP, load tools and choose the intended tool.
3. Select Allow Agent use (confirmation required) and save. The connection and operation must also be enabled.
4. Request the external work in a conversation. Review the destination and exact outgoing input before approving. Changed arguments cannot use the same approval.

Agent execution requires the current user's connection-use permission and the conversation's delegated scope. Revoking Agent sharing or disabling tool policy cancels queued work. Treat external results as business data, not trusted instructions.

Inspect existing external DB connections

In Settings → External connections, choose Company connections → View DB connections. Inspect the owning App, table, requester and provisioning state, then open the owning App for settings. Only records allowed by that App's read permission appear. This inventory does not edit database credentials or configuration, and provisioning state is not a live connectivity check.

Sign in to MCP with OAuth

In the MCP connection credentials, select OAuth → Check authentication settings. Review the advertised authorization server and requested scopes. Leave Client ID empty only when the server supports public-client registration. Services requiring prior registration need the exact displayed callback URL, Client ID and, where required, Client Secret registered with that service. Choose Sign in and connect, approve at the external service, and return to Nexia.

A user with credential-management permission configures the connection, usually a tenant administrator or a delegated role. Personal connections remain personal. The external account and approved scopes determine remote access; use an appropriate business account for shared connections. OAuth login does not grant Agent or App use by itself.

The server must support MCP authorization discovery and PKCE S256. There is no preset service catalog, and not every service's OAuth implementation is compatible. Sign in again when credentials cannot be refreshed. Revoking credentials stops Nexia from using them; revoke the external application's grant at the provider separately.

Agent email and delivery history

Configure a company or Legal Entity SMTP sender in Settings → Business email. Agent email requires the Legal Entity's business-email sending permission and an enabled email tool policy. Ask Agent to prepare the recipient, subject and body, then confirm the sender and exact content before sending. One plain-text recipient is supported per send. Changing the sender or authority before execution can block delivery.

Process email Tasks use directly authored content or App/company templates and process values. Business and Agent mail require an available SMTP sender. Account invitations, login guidance and password recovery use the platform system sender.

Open Settings → Delivery status to view system, Process, Agent, business and notification email together, filtered by source and status. Delivery-read permission is required. Follow related work or your own Agent conversation where available; mail-history access does not grant access to the underlying work or conversation. System-mail records begin when this feature is enabled; previously unrecorded history is not reconstructed.

Accepted means mail-server acceptance, not inbox delivery. Reconcile an unknown outcome before sending again. Agent mail requires a fresh approval even after an operator confirms non-acceptance. Bodies, passwords, authentication links and tokens are not displayed in this list.