Get

Anthropic Claude API integration for LLM capabilities.

Customer provides API key and optional configuration for proxies.

Attributes: type: Integration type discriminator for union resolution api_key: Anthropic API key (required) base_url: Base URL for API proxies (optional, defaults to Anthropic's API)

OpenAI API integration for GPT models and embeddings.

Customer provides an API key and optional proxy configuration.

Attributes: type: Integration type discriminator for union resolution api_key: OpenAI API key (required) base_url: Base URL for API proxies (optional, defaults to OpenAI's API)

DigitalOcean Gradient AI integration for LLM capabilities.

Attributes: type: Integration type discriminator for union resolution api_key: Gradient AI API key (required)

Datadog monitoring platform for metrics, logs, traces, and alerts.

Customer provides API key, Application key, and API URL selection.

Attributes: type: Integration type discriminator for union resolution api_key: Datadog API key (required) app_key: Datadog Application key (required) api_url: Datadog API URL (optional, e.g., https://api.datadoghq.com, https://api.datadoghq.eu)

Customer AWS role Traversal assumes to read CloudWatch metrics and logs.

Shares the cross-account IAM role credential plane with the AWS CLI integration (aws_cli), but is a distinct telemetry integration: it exposes CloudWatch Logs and Metrics through dedicated SDK-backed tools rather than the terminal AWS CLI. Unlike aws_cli it carries a list of regions to query.

Elasticsearch search and analytics engine for log aggregation.

Customer provides connection details (hosts or cloud ID) and authentication credentials (basic auth, API key with ID, or API key only).

Attributes: type: Integration type discriminator for union resolution connection: Connection configuration (hosts or cloud ID) auth: Authentication configuration (basic auth or API key variants)

Amex EMIM (Emergency Incident Management) API integration.

EMIM provides access to bridge details, postmortems, and incident data for Amex emergency incidents.

Attributes: type: Integration type discriminator for union resolution api_key: EMIM API key for MAC signature authentication api_secret: EMIM API secret for MAC signature authentication api_host: EMIM API host URL (e.g., "emim.example.com")

Prometheus time-series database for metrics collection.

Customer provides server URL and optional authentication (basic auth or bearer token).

Attributes: type: Integration type discriminator for union resolution url: Prometheus server URL (required) auth: Optional authentication configuration (basic auth or bearer token) enable_ssl: Whether to enable SSL for the connection

Victoria Metrics time-series database for metrics storage and querying.

Cluster URLs and a single shared auth are carried in digital_ocean_vm_integration.

IMPORTANT REMARK:

• The way this whole class is structured is a massive hack. The real problem is that we currently do not support multiple integrations of the same type for a particular customer. In other words, we cannot have multiple Victoria Metrics integrations for a particular customer.
• This is why cluster URLs and authentication live in the digital_ocean_vm_integration wrapper. Ideally, we would have a list of VictoriaMetricsIntegration objects with their own authentication configurations.

Attributes: type: Integration type discriminator for union resolution digital_ocean_vm_integration: Configuration for connecting to multiple Victoria Metrics clusters with a single authentication configuration

AppDynamics application performance monitoring platform integration.

Customer provides OAuth credentials for AppDynamics API access.

Attributes: type: Integration type discriminator for union resolution client_id: OAuth client ID (required) client_secret: OAuth client secret (required) base_url: AppDynamics API base URL (required)

ServiceNow IT service management and incident tracking platform integration.

Attributes: type: Integration type discriminator for union resolution instance_url: ServiceNow instance URL auth: Authentication configuration (client_credentials, password_grant, or basic_auth) ssl_verify: Whether to verify SSL certificates. Set False for on-prem instances with internal CAs that are not in the system trust store. metrics_api_tables: CMDB class tables queryable via the Clotho metrics API. table_api_tables: Fallback table_query tables union'd into live sys_db_object discovery only when that walk is cut short; ignored when it completes. table_query_filters: Per-table encoded-query conditions AND'd onto every Table API read of that table, scoping it to the rows this org may see. sys_db_object_page_size: Pagination page size for sys_db_object discovery. sys_db_object_probe_concurrency: Max concurrent per-table access probes.

GitHub source code hosting and version control platform integration.

Customer provides either GitHub App installation ID (preferred) or a personal access token for authentication.

Attributes: type: Integration type discriminator for union resolution auth: Authentication configuration (installation ID or access token) api_url: GitHub API URL for Enterprise deployments (optional) repos: List of repositories in 'owner/repo' format (optional) organization: GitHub organization name for organization-wide access (optional) role: Traversal read vs write label (default read)

Credentials and verification contract for inbound GitHub webhooks.

GitLab source code hosting and version control platform integration.

Supports both gitlab.com and self-hosted GitLab instances.

Customer provides a personal access token, project access token, or group access token for authentication. Self-hosted instances can specify a custom API URL.

Attributes: type: Integration type discriminator for union resolution auth: Authentication configuration (personal, project, or group access token) api_url: GitLab API URL (default: https://gitlab.com for gitlab.com, custom for self-hosted) project_ids: List of project IDs (numeric) to access (optional) group_id: GitLab group ID for group-wide access (optional) role: Traversal read vs write label (default read)

Grafana observability platform for metrics, logs, and traces visualization.

Customer provides server URL and authentication credentials (bearer token or username/password).

Attributes: type: Integration type discriminator for union resolution url: Grafana server URL (required) auth: Authentication configuration (bearer token or basic auth) enable_querying: Whether Traversal may run queries through this Grafana instance.

ThousandEyes network intelligence and monitoring platform integration.

Customer provides API key for ThousandEyes API access.

Attributes: type: Integration type discriminator for union resolution api_key: ThousandEyes API key (required)

Notion workspace and knowledge management platform integration.

Customer provides integration token for Notion API access.

Attributes: type: Integration type discriminator for union resolution token: Notion integration token (required, begins with secret_)

OpenSearch search and analytics engine (Elasticsearch fork).

Customer provides connection details (hosts) and authentication credentials (basic auth, API key with ID, or API key only).

Attributes: type: Integration type discriminator for union resolution hosts: One or more OpenSearch hosts auth: Authentication configuration (basic auth or API key variants)

Splunk log management and security information platform integration.

Customer provides instance URL and authentication (basic auth or bearer token).

Attributes: type: Integration type discriminator for union resolution url: Splunk instance URL (required) auth: Authentication configuration (basic auth or bearer token)

Confluence wiki and documentation platform integration.

Attributes: type: Integration type discriminator for union resolution url: Confluence instance URL (required) auth: Authentication configuration (Basic Auth, Bearer token, or a client-credentials variant for Cloud reached via an egress gateway) cloud_id: Atlassian cloud ID for multi-tenant deployments (optional, required for api.atlassian.net) scope_space_keys: Space keys whose content Traversal may read. scope_root_page_ids: Pages whose whole subtree Traversal may read.

FireHydrant incident management and retrospective platform integration.

Customer provides API key for FireHydrant API access.

Attributes: type: Integration type discriminator for union resolution api_key: FireHydrant API key (required)

Slack team communication and collaboration platform integration.

Customer provides bot token for Slack API access.

OAuth credentials and workspace metadata are persisted together in the integrations v3 secret for this instance.

Microsoft Teams chat platform integration.

The Teams analogue of SlackIntegration: the typed credentials blob for a Teams bot install, stored as an AWS secret on an integration_instances row of integration_type = teams. There is no Postgres install table — Teams ships natively on integration_instances.

Credentials are Azure Bot Service / Bot Framework app credentials: the bot's Microsoft app (client) id plus its client secret. tenant_id is the Azure AD tenant the bot is installed in and serves as the third_party_id for the integration_instances row.

Attributes: type: Integration type discriminator for union resolution. app_id: Microsoft/Bot Framework app (client) id. A public identifier, not a secret. app_password: Bot client secret. Required, secret. tenant_id: Azure AD tenant id; the install identifier (third_party_id). app_type: Bot Framework app type ("MultiTenant" / "SingleTenant" / "UserAssignedMSI"). bot_id: The bot's id in Teams (often equal to app_id). Install metadata. bot_name: Human-readable bot/app display name. Install metadata. service_url: Bot Framework service URL for the tenant, discovered from inbound activities and required to send proactive messages. Install metadata. installed_at: Installation timestamp. Install metadata. archived_at: Lifecycle marker set when the install was archived; None for live installs.

Loki log aggregation system integration.

Grafana Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus.

Attributes: type: Integration type discriminator for union resolution url: Loki server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments

Linear issue tracking integration.

Linear is a modern issue tracking tool for software teams.

Attributes: type: Integration type discriminator for union resolution api_key: Linear API key for authentication (required)

Mimir - scalable long-term storage for Prometheus metrics.

Customer provides server URL and authentication. Mimir typically requires an X-Scope-OrgID header for multi-tenancy.

Attributes: type: Integration type discriminator for union resolution url: Mimir server URL (required) basic_auth: Optional basic authentication credentials bearer_token: Optional bearer token for authentication org_id: X-Scope-OrgID header value for Mimir multi-tenancy

MotherDuck serverless analytics integration.

MotherDuck is a serverless analytics platform built on DuckDB.

Attributes: type: Integration type discriminator for union resolution token: MotherDuck authentication token (required)

Jira issue tracking integration.

Jira is an issue tracking and project management tool by Atlassian.

Attributes: type: Integration type discriminator for union resolution base_url: Jira instance URL (e.g., https://company.atlassian.net or https://api.atlassian.net) auth: API-token auth for Cloud or username/password Basic Auth for Server/Data Center cloud_id: Atlassian cloud ID for multi-tenant deployments (optional, required for api.atlassian.net)

Kubernetes API integration for sandbox kubectl access.

Holds a cluster connection (how to reach the API server) and an auth (how to authenticate). Commands receive a per-exec kubeconfig built from a short-lived token. The two axes are orthogonal except for aws_eks, which is self-authenticating and pairs only with the aws_eks_derived sentinel — the pairing validator enforces the valid combinations.

Coralogix observability platform integration.

Coralogix is a full-stack observability platform that provides log analytics, metrics, and tracing capabilities.

Attributes: type: Integration type discriminator for union resolution api_key: API key for Coralogix authentication (required) base_url: Coralogix API base URL (e.g., "https://api.eu2.coralogix.com")

Cribl.Cloud observability pipeline integration.

Authenticates via OAuth client credentials against the Cribl.Cloud workspace URL.

Attributes: type: Integration type discriminator for union resolution url: Cribl.Cloud workspace URL (required) auth: Cribl.Cloud OAuth client credentials

Incident.io incident management platform integration.

Customer provides API key for incident.io API access. The API key is used as a Bearer token for all upstream requests.

Attributes: type: Integration type discriminator for union resolution api_key: Incident.io API key (required, begins with inc_)

Sentry error and performance monitoring platform integration.

Customer provides an auth token (org-scoped internal-integration token preferred, personal auth token as a fallback) plus their organization slug. The token is used as a Bearer token for all upstream requests.

Attributes: type: Integration type discriminator for union resolution auth_token: Sentry auth token (required) organization_slug: Sentry organization slug the token belongs to (required, all deployments). Analogous to the cloud ID on Atlassian. base_url: API base URL. Defaults to https://sentry.io when unset. Set to https://de.sentry.io for the EU region, or the custom domain for single-tenant / self-hosted deployments.

Grafana Tempo distributed tracing backend integration.

Attributes: type: Integration type discriminator for union resolution url: Tempo server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments

Grafana Alertmanager integration for querying active and historical alerts.

Attributes: type: Integration type discriminator for union resolution url: Alertmanager server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments

Configuration for a Nubank Alexandria MCP endpoint.

Attributes: type: Integration discriminator (always IntegrationType.ALEXANDRIA). enabled_data_types: Alexandria provides log data via Trino queries. server_url: Alexandria MCP endpoint URL. Defaults to the prod-global cluster-internal address, but is configurable so different envs (blue/green, ist, us, br) can be used without a code change. bearer_token: Optional Nubank API key JWT sent as Authorization: Bearer. Required at query time; omitted on legacy instances until migrated.

Configuration for a Nubank Honeycomb MCP endpoint.

Attributes: type: Integration discriminator (always IntegrationType.HONEYCOMB). enabled_data_types: Honeycomb provides trace data via MCP tools. server_url: Honeycomb MCP proxy endpoint URL. bearer_token: Optional Nubank API key JWT sent as Authorization: Bearer. Required at query time; omitted on legacy instances until migrated.

Dynatrace observability integration supporting Classic API and/or Grail.

Customers populate one or both of (classic_url + api_token_auth) and (platform_url + platform_auth). At least one complete pair is required; the health checker and clients will only exercise the pair(s) that are configured.

Typical configurations:

• SaaS, mid-migration: both pairs. Classic API token unlocks /api/v2/problems, /api/v2/entities, etc.; OAuth unlocks Grail (/platform/storage/query/*).
• SaaS, Grail-only: only platform_url + platform_auth. Problems and entities still reachable via DQL (fetch dt.entity.host, …).
• Managed / self-hosted: only classic_url + api_token_auth (Grail is not deployed on Managed).

Configuration for a single MCP server.

Three auth methods are supported, distinguished by how the credential is obtained:

• bearer_token: a static credential, stamped on a header as-is. No acquisition step. auth_header_name and auth_scheme shape the header and default to Authorization / Bearer, i.e. Authorization: Bearer <auth_token>. Override them for servers that want something else: Basic for HTTP Basic, Bearer Basic for Mixpanel's documented hybrid, or auth_scheme=None plus an X-Api-Key header name to send the raw credential with no prefix.
• client_credentials: exchange service-account credentials for a short-lived token at a custom token endpoint. Carried by the shared client-credentials config, whose auth_type selects the wire format (e.g. basic_json: HTTP Basic auth + JSON body).
• oauth: standard OAuth 2.0 authorization-code + PKCE + Dynamic Client Registration (RFC 7591/7636). User-authorized at creation time via a popup; tokens are stored encrypted, refreshed on demand using the refresh token if the server issued one.

auth_header_name / auth_scheme apply only to bearer_token. The other two acquire a token whose transport is fixed by their own spec, and always send it as Authorization: Bearer <token>.

Multiple MCP servers per organization are achieved by creating multiple IntegrationInstance rows of type mcp via the v3 integrations API; each instance carries its own McpIntegration payload.

PagerDuty incident management and on-call platform integration.

Read-only. Customer provides an API key created at PagerDuty's Read-only access level, enforcing no-writes server-side.

Attributes: type: Integration type discriminator for union resolution api_key: PagerDuty API key (required, Read-only access level)

Spinnaker continuous-delivery platform integration.

Self-hosted CD platform; auth method varies by deployment. Five auth modes are supported via the auth discriminated union — see each variant's docstring for details on when to use it.

Attributes: type: Integration type discriminator for union resolution gate_url: Spinnaker Gate base URL (include port for X.509, e.g. :8085) auth: Authentication configuration (one of five variants) applications: Optional list of Spinnaker applications to scope queries to

JFrog Artifactory container registry integration.

Used primarily for querying Docker image tags and manifests to map container image digests back to git commit SHAs.

Customer AWS role Traversal can assume for terminal AWS CLI commands.

Amex Bridge Summarizer integration for retrieving Webex meeting captions.

Authenticates via the Amex AuthBlue App2App client-credentials flow: username and password are HTTP-Basic-authed against authblue_signin_url (proxied through the org's relay) to mint a short-lived blueToken JWT. That token is sent as a Bearer header to bridge_captions_url to fetch caption records for a given bridge id and time window. Token minting goes through the shared basic_json_client_credentials client-credentials flow.

App2App only accepts AD service accounts (e.g. svc.ai-ops); real user LDAP creds are rejected. AuthBlue exposes different App2App hosts per environment (E1 dev, E2 qa, E3 prod), so the URL is configured per integration instance rather than hardcoded.

Attributes: type: Integration type discriminator for union resolution. authblue_signin_url: AuthBlue App2App token endpoint that mints the blueToken (e.g. https://authbluetokens.aexp.com/v1/app2app/tokens for prod). Historical name kept for stored-config compatibility. bridge_captions_url: Bridge Summarizer endpoint that returns Webex caption records (e.g. https://bridgesummarization.aexp.com/get_webex_captions). username: AD service account name (App2App rejects user LDAP creds). password: AuthBlue password for the service account.

Configuration for a DigitalOcean deptracker REST endpoint.

Attributes: type: Integration discriminator (always IntegrationType.DEPTRACKER). enabled_data_types: Deptracker provides deployment events. server_url: Deptracker REST base URL (e.g. https://<traversal-domain>/dep-tracker). The /api/v1/query path is appended by the client.

Configuration for DigitalOcean's internal Backstage-shaped catalog.

Attributes: type: Integration discriminator (always IntegrationType.DO_SERVICE_CATALOG). enabled_data_types: The catalog provides topology (service inventory + dependsOn edges + GitHub source links). server_url: Catalog base URL (e.g. https://servicecatalog.internal.digitalocean.com). The client appends /entities for queries. auth_token: Bearer token presented in the Authorization header.

Azure DevOps work tracking, repositories, and pipelines integration.

Covers both deployments behind one URL field: organization_url is the organization base on Azure DevOps Services (https://dev.azure.com/{organization}) or the collection base on on-premises Azure DevOps Server (https://tfs.corp.com/tfs/DefaultCollection). Every REST route hangs off that base as _apis/..., so the two shapes need no separate schema.

Attributes: type: Integration type discriminator for union resolution organization_url: Azure DevOps organization or on-premises collection URL auth: Personal access token credentials

Customer Azure (Commercial Cloud) tenant Traversal runs CLI and Monitor queries against.

Scoped today to capturing the tenant ID the agent will later run az CLI and Azure Monitor queries against. Role-grant and connectivity fields are added once Entra publisher verification and the connector's federated credential land — see RFC: Azure Integration (Azure CLI, Azure Monitor).

Azure Government and other national/sovereign clouds (e.g. Azure China) are explicitly out of scope: they are fully separate login systems requiring their own app registration, not representable by this type.

Distinct from AzureDevopsIntegrationConfig, which covers Azure DevOps (source control, pipelines) and is tracked in its own RFC.

Container for Traversal API key configurations.

Stores a list of API keys for an organization. Each organization can have multiple users with multiple keys each.

Attributes: type: Integration type discriminator for union resolution. api_keys: List of Traversal API key configurations.