No/Low-Code Platform Integration

This guide walks you through connecting a no-code platform to Pavri. The exact setup depends on which integration pattern you choose, but the outline is always the same:

1. Connect the platform to Pavri via the Integrations page
2. Register workflows (manually, or auto-discovery via connector)
3. Choose an enforcement model (observe-only / policy step / proxy)
4. Assign policies

Supported Platforms

Pavri supports 18 no-code/low-code platforms today. The full list is in Discovery concepts.

Step 1: Connect the Platform

Open the Pavri dashboard and go to Configuration → Integrations → No-Code Platforms. Choose your platform and provide:

Platform	Credentials Required
Power Automate	Microsoft Graph app registration (client ID, tenant ID, client secret)
Make	API token (from Make account → Profile → API). Team ID and API URL are optional; automatic team discovery requires Make organization/team read scopes.
Zapier	Platform API token
n8n	API key + base URL (for self-hosted: the URL of your n8n instance)
Workato	API key + Workato account URL
Dialogflow CX	GCP service account JSON
UiPath	Orchestrator URL + OAuth2 client credentials
ServiceNow	Instance URL + username/password or OAuth2
Cognigy	API key + Cognigy base URL
Botpress	Personal access token
Flowise	API key + Flowise base URL (for self-hosted)
ManyChat	API token
Landbot	Agent or customer API token
Honeycode	AWS IAM credentials
LangSmith Studio	LangSmith API key
Replit	Org API token
OpenAI Agent Builder	OpenAI API key

Pavri stores credentials encrypted and rotates them on your schedule.

Step 2: Register Workflows

You have three options for registering workflows as Pavri agents.

Option A: Auto-discovery (recommended)

After connecting the platform, Pavri's discovery worker polls the platform on an interval (default 15 minutes) and registers every workflow it finds. New workflows appear in the Agents inventory automatically.

Option B: Manual registration via REST API

From within your workflow, add a step that calls Pavri's register endpoint:

POST https://gateway.pavri.ai/v1/register
X-Api-Key: <tenant-api-key>
X-Org-Id: <org-id>
Content-Type: application/json

{
  "agent_name": "Make: Refund Processing Scenario",
  "platform": "make",
  "workflow_id": "scenario_987654",
  "team": "billing-ops",
  "environment": "production",
  "policy_names": ["refund_guardrails"]
}

The response includes an agent_id you can reference in subsequent API calls.

Option C: Platform-native connector package

(Coming soon — NLC Phase 2.3) Marketplace-listed connector modules for Power Automate, Make, and Zapier will register workflows with one click.

Step 3: Choose an Enforcement Model

Observe-only (baseline)

Simplest. Pavri ingests run history and audit logs from the platform, delivers inventory and detections, but doesn't block anything. Good for gaining visibility before enforcing.

No additional configuration — just connect the platform and let discovery run.

Policy step (inline evaluation)

Add a Pavri: Evaluate Policy step in your workflow before a high-risk action:

POST https://gateway.pavri.ai/v1/eval
X-Api-Key: <tenant-api-key>
Content-Type: application/json

{
  "agent_id": "<agent-id-from-register>",
  "action": "tool:http_request",
  "context": {
    "http.url": "https://api.stripe.com/v1/refunds",
    "http.method": "POST"
  }
}

Response:

{
  "decision": "deny",
  "reason": "F2-DENY-DOMAIN",
  "rule_id": "pol_outbound_restrictions_v1:deny_unknown_domains",
  "policy_id": "pol_outbound_restrictions_v1"
}

Branch on decision: allow → proceed, deny → route to fallback or abort.

Proxy (strongest enforcement)

Route HTTP/API calls through Pavri's outbound proxy. Instead of calling api.vendor.com, call proxy.pavri.ai/v1/proxy with:

{
  "target_url": "https://api.vendor.com/action",
  "method": "POST",
  "body": "...",
  "headers": { "Content-Type": "application/json" },
  "agent_id": "<agent-id>"
}

The proxy evaluates egress policy, injects approved credentials from Vault, strips sensitive caller-supplied headers (Authorization, Cookie, X-Api-Key, X-Forwarded-For), forwards the request, and emits a ToolCallEvent to Pavri telemetry.

Response shape:

{
  "status_code": 200,
  "headers": { "Content-Type": "application/json" },
  "body": "{\"result\":\"ok\"}",
  "latency": "127ms",
  "allowed": true,
  "reason": "",
  "rule_id": ""
}

Credential Mediation

If you want the proxy to inject secrets on your behalf (so platform users never see the upstream API keys):

1. Store the secret in HashiCorp Vault at a known path
2. In Pavri, configure a Credential Policy:
   • domain_pattern: api.stripe.com (supports wildcards: *.stripe.com)
   • vault_path: secret/nocode/stripe
   • header_name: X-Api-Token (or another business header — not Authorization, which is stripped)
   • inject_as: header | bearer | query_param

The proxy will read from Vault on every matching request and inject the credential automatically.

Approval Gates

For high-risk actions, configure an Approval Policy:

• trigger: domain_pattern, connector_type, or risk_level
• channel: slack, email, or webhook
• timeout_seconds + on_timeout (deny or allow)

When a workflow triggers an action that matches the policy, the proxy returns 202 Accepted with an approval_request_id. Your approvers get notified on the configured channel. When they resolve, the proxy completes the original forward.

Step 4: Assign Policies

Workflows appear in the Pavri dashboard at Agents with the platform badge. Click through to the agent detail page, then Policies → Assign Policy. The same policy DSL and templates that apply to coded agents apply here.

For platform-wide policies (e.g., "no Make scenario may call *.internal.corp"), use scope filters:

policy_id: pol_internal_ban_v1
scope:
  platform: make
enforcement_mode: enforce
rules:
  - id: deny_internal
    when: event.type == "tool_call" && event.http.url.domain endswith ".internal.corp"
    effect: deny

Testing Your Integration

Before rolling out enforcement, use observe mode for 1-2 weeks:

1. Set your policy enforcement_mode: observe
2. Let the workflow run normally
3. Review decisions in the dashboard under Analytics → Policy Evaluations
4. Adjust rules
5. Flip to enforcement_mode: enforce

Troubleshooting

The platform isn't in the list. Use the generic_http connector, which works with any platform exposing REST APIs with pagination and token auth.

Discovery found zero workflows.

• Check the platform credentials are valid (Integrations → Test Connection)
• Confirm the API token has read permission on workflows/scenarios/zaps
• Check the discovery worker logs under Operational Health

Policy step is slow. Target: p95 under 300ms. If you're seeing more:

• Pick a regional Pavri endpoint closer to your platform
• Reduce the number of context fields being sent (keep them under 1KB)
• Check that your platform is not adding its own proxying overhead

Proxy requests fail.

• Verify the target_url domain is in an allowed-domains egress rule
• Check that the caller agent is registered and assigned a policy
• Review the reason field on the denied response

See Also

• No/Low-Code Security Plane concept
• Workflow Certification guide
• Policy Eval API reference