documentation

Introduction A sweep does not put anything under governance. It produces a list of discovered assets on the connection that found them, and leaves them there until somebody decides which ones matter. Registering is that decision. It is a deliberate, reversible act, and it is what moves an asset from "we know this exists" to "this is governed". "Discovery answers what exists. Registration answers what we are accountable for. They are not the same list, and they should not be." Where to find it AI Governance > Discovery > select a connection > Assets Access to AI Governance is granted through platform roles. Ask your workspace administrator, or see Settings > Governance > Roles for how permissions are assigned. The Assets table Opening a connection shows everything it discovered — "agents and models discovered and registered through this connection", with a count beside the heading. Column What it tells you REGISTER A toggle. On means registered and under governance; off means discovered only. ASSET NAME The name the source platform reports. ASSET TYPE Agent or Model . One connection can return both. STATUS Active , Setup Pending or Excluded . WORKSPACE The workspace the asset belongs to. OWNER Who is accountable for it. LAST UPDATED When the asset record last changed. What the statuses mean here Excluded — Discovered, not registered. Its REGISTER toggle is off, and nothing governs it. This is the default state of everything a sweep returns. Setup Pending — Registered, but no sessions have arrived yet. On Anthropic, Salesforce, Snowflake, Microsoft Copilot, Databricks, UnifyApps, Workato and OpenAI a scheduler fetches them through the connection every 15 minutes (hourly after three failed attempts), so this usually means the agent has not run yet. AWS Bedrock and n8n agents need the steps on the agent's Setup tab. Active — Registered and reporting. Register discovered assets Step 1: Open the connection From Discovery , click the connection you want to work through. If the sweep is still running you will see Initial sync in progress — wait for it to finish. Step 2: Decide what to register Read the list before you act on it. Three outcomes, and most assets are one of the first two. Register it — It handles company data or talks to customers. Toggle REGISTER on. Leave it discovered — It is real but low-risk. Leaving it Excluded is a decision, and a defensible one — you know it exists and have chosen not to govern it. Retire it — Nobody claims it and it has not run in months. Retire it on the source platform; the registry reflects the platform, so a toggle here does not stop the agent. Step 3: Register, one at a time or all at once Toggle REGISTER on individual rows, or use the N assets discovered banner's Register All to take everything the sweep returned. Dismiss hides the banner without registering anything. Register All is the right move on a platform you already understand. On a first sweep it skips the review step that makes the inventory worth having. Step 4: Assign ownership Ownership is the step people skip and regret. Incidents route to owners; an unowned agent generates findings nobody triages, which is worse than no finding at all. Step 5: Apply a policy Registration brings an asset into the registry. It does not put it under policy — that is applied separately. See Apply a Policy to Assets . Registering automatically A connection's Settings carries Auto-register agents — "add newly discovered agents to the registry automatically". It is off by default . Turned on, every agent a future sweep finds is registered without review. That is the right setting once you know what a platform holds and you want new agents governed from the moment they appear. It is the wrong setting on a platform you have not yet inventoried, because it converts a review queue into a registry you did not curate. Refer: Sync interval and auto-register are set per connection. See Add an Application . Important considerations Registration is per asset

Use the Granola connector to capture and summarize meeting notes with AI. Integrating your application with Granola lets you use these operations in an automation. It exposes 3 actions, listed below. Add the connector from the Connections area, authenticate, then select its operations in the automation builder. Capabilities: actions, knowledge (RAG). Authentication Before you begin, make sure you have the following information: Connection Name: Choose a meaningful name for your connection. This name helps you identify the connection within your application or integration settings. Authentication Type: The authentication method for this connector is defined in the connection setup. Select the connector in the Connections area to see the fields it requires. Actions Action Name Description Get note Retrieves a single Granola meeting note by ID. List folders Lists accessible folders in Granola with pagination. List notes Lists accessible meeting notes in Granola. Overview The Granola API provides programmatic access to your workspace's meeting notes and related data through a RESTful interface, enabling integration with existing tools and custom workflows. API Key Access Scopes API keys support two access scopes: Scope Access Personal notes Notes you own, notes directly shared with you, notes in private folders shared with you Public notes Notes visible to everyone in the workspace, notes in the Team space Obtaining an API Key Open the Granola desktop app Navigate to Settings → Connectors → API keys Click Create new key Select the note access scopes for the key Click Generate API Key On Enterprise plans, workspace admins must enable API key access scopes in Settings → Workspace → General → API access for members . Revoking an API Key Go to Settings → Connectors → API keys Find the key and click Revoke Confirm in the dialog Once revoked, the key is permanently disabled and cannot be restored. Updating an API Key Go to Settings → Connectors → API keys Find the key and click Edit Select the desired note access scopes Click Save changes Quick Start List notes created in the past week: curl "https://public-api.granola.ai/v1/notes?created_after=$(date -u -v-7d +%Y-%m-%dT%H:%M:%SZ)" \ -H "Authorization: Bearer grn_YOUR_API_KEY" Retrieve a specific note with its transcript: curl "https://public-api.granola.ai/v1/notes/not_1d3tmYTlCICgjy?include=transcript" \ -H "Authorization: Bearer grn_YOUR_API_KEY" Transcript Format macOS transcripts include speaker.source as either "microphone" or "speaker". iOS transcripts return speaker.source = "microphone" with optional diarization_label values (Speaker A/B/etc). The API only returns notes with generated AI summaries and transcripts. Processing notes return 404. Rate Limits Metric Limit Burst capacity 25 requests in 5 seconds Sustained rate 5 requests/second (300/minute) Exceeding limits returns a 429 Too Many Requests response.

A single connected object rarely holds just one kind of thing — a folder of files, a table of tickets, or a feed of messages usually mixes several record types together. Discover & Enrichment is the wizard step that lets you use AI to sort those records into meaningful groups and enrich them, before

A single connected object rarely holds just one kind of thing — a folder of files, a table of tickets, or a feed of messages usually mixes several record types together. Discover & Enrichment is the wizard step that lets you use AI to sort those records into meaningful groups and enrich them, before they ever reach the mapping step. Overview Discover & Enrichment sits between choosing which objects to read and mapping those objects onto graph nodes. It goes beyond simple field-to-field mapping: it lets AI look inside unstructured or semi-structured content — free text, attachments, loosely typed records — identify what each record actually is, and add information to it. "What you build here feeds the Map step next," so your choices shape what you see when you map. This page covers only discovery and enrichment; see the source connection setup guide for connecting a source. Turning it on: the toggle Each object you selected gets its own Discover & Enrich specific entities toggle. Turning it on sorts records into entities and enriches each group differently, rather than treating every record the same way. Where it starts depends on the connector — some apps support discovery by default — but you can flip it either way: Off: a single, flat Enrich All Records list. Every record runs through the same enrichment steps. On: a Discover entities with picker followed by an Entities list. Discovery runs on every record to classify it, and the entities list splits records into groups by condition, enriching each differently. Flip the toggle before configuring anything — switching it discards whatever you've built for that object, immediately and without a confirmation prompt. The step is optional per object, but once started, it must be finished before you can continue. Agent-based and Automation-based methods Whether you're configuring the discoverer or an entity's enrichment, you choose one of two methods, then the specific agent or automation to run: Agent-based. An AI agent receives the full record — no input mapping needed — and classifies or enriches it using its own reasoning. View Schema shows what fields it returns. Automation-based. A workflow does the extraction instead. Since it expects specific inputs rather than a full record, you map each input to a source property yourself with Map inputs . UnifyApps flags unmapped required inputs and rejects mismatched field types at save time. Only published agents and automations appear in the picker, and your source always runs the latest published version. If the one you want isn't listed, a shortcut opens the builder so you can publish it and return to your draft. Each entity also needs a name and a Classify When condition built on the discoverer's nprt fields; each enrichment list accepts a single enrichment step. How discovered entities feed into mapping Your choices here change what you see in Map next. With the toggle off, you map the object itself, same as without this step. With the toggle on, Map replaces the object with the entities you defined — you map each discovered entity to graph nodes and edges individually. Any fields your enrichment added appear in Map as extra source fields, grouped under the enrichment's name, ready to map onto destination properties alongside the record's original fields. In short: discovery decides how records split, enrichment adds to what each record knows, and mapping wires both into your graph's structure. Notes Entity names accept only letters and numbers; the name is also the entity's identity, so renaming one effectively re-creates it. If a condition references a field your discoverer no longer returns, it's flagged for you to fix or remove rather than silently dropped. Changing the toggle, or the object's underlying connection, resets this step's configuration — settle on your approach before building out entity conditions.

Memory Sets are the containers that bundle an agent's memory profiles so several agents can share the same memory configuration. Overview A memory set is a bundle of memory profiles — "Bundled collections of memory profiles" — that you attach to agents so they remember things across conversations. The set itself is just a container with a name, description, and tags; the real behavior (what's remembered, for whom, and for how long) is configured on the memory profiles inside it. The Memory Sets area lists every set in the workspace and is where you create, open, share, and delete them. Creating a Memory Set On the Memory Sets list, use New Memory Set (or Add Memory Set from the empty state) to open the create dialog — "Group memory profiles for specific use cases." Fill in: Field Description Name Required — "Enter Memory Set name." Description "Describe your memory set here..." Tags Pick or create tags. Workspace The owning project. On create you're taken straight to the set's Profiles tab to add your first profile. What's on the Memory Set List Each row shows the Memory Set Name , Referenced Agents (how many agents use the set), Tags , Owner , and Last Updated ; the Workspace column appears when you're viewing across projects. Search with Search memory sets . Each row's actions are Edit , Share , and Delete . If you have none yet, the empty state reads Create Memory Set — "Create a new memory set to store and manage your memory profiles." The Tabs Inside a Memory Set Open a set to find three tabs: Profiles — the memory profiles in this set. Each row shows the profile name, its Memory Type (Semantic, Episodic, or Procedural), Scope , the model used to generate memories, and an enable toggle. Add one with Add Memory Profile . Memories — a read-only view of the actual stored memories. Each row shows the Memory Text , Reference Chats (a link back to the conversation it came from), its type, scope, and owner. Search the memory text; click a row to open the source conversation. Referenced Agents — the agents linked to this memory set. If none are linked, it reads No Referenced Agents — "No AI Agents are currently linked to this Memory Set." The set header lets you Share , Publish the set, and Add Memory Profile ; it shows Undeployed Changes until you publish a version. Why Can't I Edit or Delete Stored Memories? The Memories tab is read-only by design — it shows what the agent has stored, but you don't hand-edit individual memories there. What gets stored, refreshed, and expired is governed by each memory profile's settings (see Memory Profiles ), including an optional expiration period that deletes memories after a set duration. Note: To change what's remembered, adjust the profile, not the individual memory entries. Each stored memory carries provenance — which user's chat it came from, which agent, and which conversation — which is what the Reference Chats link uses. How Attaching a Set to an Agent Works, and Can Users Opt Out? Attaching a set simply grants that agent access to the set — its Referenced Agents list is exactly the agents that have been granted access, and at runtime the platform resolves an agent's applicable memories from the sets and profiles it can access. Two enforcement details worth knowing: Per-user opt-out — memory can be disabled for a specific user, per profile or per set. An opted-out user's conversations are skipped when memories are written, and no memories are retrieved into their chats. Team scope is checked at read time — a team-scoped profile in a shared set only serves memories to users who are members of the profile's team(s), even though the set itself is attached to the agent for everyone. So sharing a set across agents shares the configuration and store , while scope and opt-outs still control who actually reads and writes each memory.

Use the Chargebee connector to manage subscriptions and recurring billing. Integrating your application with Chargebee lets you use these operations in an automation. It exposes 11 actions, listed below. Add the connector from the Connections area, authenticate, then select its operations in the automation builder. Capabilities: actions. Authentication Before you begin, make sure you have the following information: Connection Name: Choose a meaningful name for your connection. This name helps you identify the connection within your application or integration settings. Authentication Type: The authentication method for this connector is defined in the connection setup. Select the connector in the Connections area to see the fields it requires. Obtaining Your API Key Login into your Chargebee account. Navigate to Settings, then click Configure Chargebee. Click on API Keys and Events, then open the API Keys tab. Click Add API Key. Select a key type (Full-Access Key for general use, or Read-Only Key if you only need read access) and give it a name. Click Create Key to generate the key. Copy the generated API key and store it securely for further authentication purposes. Actions Action Name Description Assign a payment role Assigns a payment role to a payment source in Chargebee Cancel subscription Cancels the specified subscription in Chargebee Create a customer Creates a new customer in Chargebee Download invoice PDF Downloads invoice as a PDF in Chargebee Get hierarchy for a customer Retrieves the full or partial account hierarchy for a customer in Chargebee Get subscriptions Returns a list of all subscriptions in Chargebee Link a customer Links a customer to an account hierarchy in Chargebee Retrieves a list of customers Retrieves a list of all customers in Chargebee Retrieves the credit card Retrieves the credit card for a customer id in Chargebee Unlink a customer Unlinks a customer from its parent account in Chargebee Update a customer Updates the customer resource in Chargebee

The Excel node's media operation lets you embed an image into a specific location on a spreadsheet sheet — useful for inserting logos, charts exported as images, QR codes, or other visual assets into automated reports before they are stored or distributed. Overview Insert image into Excel sheet takes an image — supplied either as Base64 text or as a file object — and places it on a named sheet of an Excel workbook. You control where the image is anchored (after the last row, after the last column, or at a specific cell) and how it is sized (its original size, a scale factor, or a span across a number of columns and rows). The image is embedded in the workbook file itself, so it travels with the file when it is stored or sent. This operation works on XLSX or XLS files; use the Format Conversion operations to convert a workbook into one of those formats beforehand if needed. Operations Operation Description Key inputs Insert image into Excel sheet Embeds an image (provided as Base64 text or a file object) into a sheet of an Excel workbook. The image is anchored using the chosen Anchor Mode and sized using the chosen Sizing Mode. File, File Type, Sheet name, Image Input Type, Image Mimetype, Anchor Mode, Sizing Mode Input Field Type Required Description File File reference Yes The Excel workbook into which the image will be embedded. Must be in XLSX or XLS format (set via File Type). File Type Enum Yes Type/extension of the Excel file: XLSX or XLS. Defaults to XLSX. Sheet name String No Name of the sheet to insert the image into. If left empty, the first sheet is used. If the named sheet is not found, a new sheet with that name is created. Image Input Type Enum Yes How the image is provided: Base64 (a Base64-encoded string) or File Object (a UnifyApps file object). Defaults to Base64 . Base64 Image String Yes — when Image Input Type is Base64 The Base64-encoded image to embed. Input File File reference Yes — when Image Input Type is File Object UnifyApps file object containing the image to embed. Image Mimetype Enum Yes Mimetype of the image: PNG or JPEG. Defaults to PNG. Anchor Mode Enum Yes Where to place the image: After last row (column A, in the row right after the last row with data), After last column (row 1, in the column right after the last column with data), or Specific cell (uses the Anchor Row and Anchor Column you provide). Defaults to After last row . Anchor Row Integer Yes — when Anchor Mode is Specific cell Row index (0-based) for the top-left corner of the image. Anchor Column String Yes — when Anchor Mode is Specific cell Column letter for the top-left corner of the image (e.g. A, B, AA). Sizing Mode Enum Yes Original size keeps the native image size, Scale factor applies a multiplier (Scale Factor), and Span N x M cells fits the image inside a number of columns and rows (Span Columns, Span Rows). Defaults to Original size . Scale Factor Number Yes — when Sizing Mode is Scale factor Multiplier applied to the original image size (1.0 = 100%). Span Columns Integer Yes — when Sizing Mode is Span N x M cells Number of columns the image should span. Span Rows Integer Yes — when Sizing Mode is Span N x M cells Number of rows the image should span. Replace existing image at anchor Boolean No If enabled, removes any image already anchored at the same cell before inserting the new one. Only effective for XLSX; XLS files keep existing pictures regardless of this setting. Defaults to true (enabled). Output Returns a single Success boolean confirming whether the image was inserted — the action does not return a new file object. Notes Image insertion requires the workbook to be in XLSX or XLS format (set via File Type). If the source file is XLSB, use Convert Excel file format to convert it to XLSX or XLS before inserting the image. The image is anchored according to the chosen Anchor Mode — after the last row, after the last column, or at a specific cell (set via Anchor Row and Anchor Column). If rows or columns above or t

Introduction Two views of spend that do not overlap. Agent view covers the spans of your agents and leaves out spans that belong to model assets; Model view covers only the spans that belong to model assets. Each call is counted in one view, never both. Where to find it AI Governance > Cost Explorer . The Agent / Model toggle sits under the title. What each view is for Agent view Model view Attributes cost to The agent that ran The model that was called Answers "What is this capability costing us?" "What are we spending on this provider?" The owner is A team, with a budget Usually nobody in particular Action it supports Fix or fund a specific workload Negotiate, consolidate, or switch Unit underneath Traces Spans Note: The two views do not overlap. Spans that belong to a model asset are counted in the Model view and left out of the Agent view, so neither total double-counts the other. Read them side by side to see where spend sits: in the work your agents do, or in the models you have registered. When agent view is the right lens Agent view is the accountability lens, because an agent has an owner and a purpose. It is what you need for: Chargeback and budgeting — An agent maps to a team and a use case. A model does not. Justifying a workload — ROI compares an agent's cost against the outcomes it produced. Only the agent side of that comparison exists in model view — see Reading the ROI View . Finding the expensive workload — One agent consuming a disproportionate share is a finding you can act on, because someone owns it. When model view is the right lens Model view is the procurement lens. It covers spans from registered model assets only — an agent's own model calls show in the Agent view's LLM column, not here. Use it for: Spend on registered models — What the models you have registered as assets cost, grouped by Model , Provider or Owner . Seeing the effect of a model choice — The cost difference between two models is a property of the models, and it shows up here first. Finding shared infrastructure nobody owns — A high-spend model that no single agent dominates is shared, and shared and unowned is the most common cost blind spot. "Agent view tells you who to talk to. Model view tells you what to negotiate." Reading them against each other The interesting findings live in the gap between the two views, and they are only visible if you look at both: Pattern Likely meaning One model dominates, no single agent does A default model used everywhere. A change here moves everything at once One agent dominates, spread across models A complex workload calling several models per run. Look at the trace shape An expensive model with one agent behind it The cleanest case — one owner, one decision Model spend far exceeds the agents you recognise Something is calling that model outside the agents you have registered That last row is the one worth acting on. It is a coverage gap wearing a cost report's clothes, and the fix is in the registry rather than in Cost Explorer. Group by, and the honest limit Within either view, grouping narrows the picture further — Agent , Owner or Cost Type in the Agent view; Model , Provider or Owner in the Model view. Grouping does not change the total; it changes how the same total is divided. One limit worth stating in both views: spend that is not attributed to anything still exists. Any breakdown covers the spend it can attribute, and the remainder is real money that no slice of this screen will show you. It is the same caveat that makes a return-on-spend figure only as good as its measured spend — see Reading the ROI View . Related Cost Explorer Overview How Cost & Tokens Are Calculated Model Record Reference

A scan is how a data quality suite checks your data against the rules you've assigned to it. Every scan produces a score you can trend over time, breaks that score down by quality dimension and by object, and lets you drill all the way down to the individual records that failed. This page walks thro

A scan is how a data quality suite checks your data against the rules you've assigned to it. Every scan produces a score you can trend over time, breaks that score down by quality dimension and by object, and lets you drill all the way down to the individual records that failed. This page walks through starting a scan, reading the trend chart, understanding dimension scores, and finding the records behind a result. Overview Each suite has a Scans tab where you trigger new scans and review past ones. A scan evaluates every assigned rule against every record in the suite's assigned objects, then rolls the results up into an overall score and a set of dimension scores. From there you can open any scan to see how each object performed, open any object to see how each rule performed, and open any rule to see the exact records it evaluated. Running a scan Click Start Scan in the suite header to kick off a run at any time. If the suite has never been scanned, the Scans tab shows an empty state instead — click Start Your First Scan to trigger your first assessment. Once a scan starts, you'll see a confirmation that the scan has begun and the data is refreshing; the scan runs in the background, checking every assigned rule against every record in every assigned object, and the history table updates automatically when it finishes. Scans also run automatically on the suite's configured schedule, so you don't have to trigger every run by hand. Reading the trend chart and scan history The top of the Scans tab shows a Scan Performance Trend chart, with headline totals for Total Scans and Avg. Score . Use it to see at a glance whether data quality is improving, holding steady, or slipping over time. Below the chart, the scan history table lists every run with its execution time, status, the number of evaluation rules and objects involved, how long the scan took, and its overall DQ score. A scan's status is one of Running , Completed , Failed , or Scheduled . Click any row to open that scan's detailed results. Understanding quality dimension scores Every record a rule checks gets an individual result — for example Valid or Invalid, Complete or Not Complete — and the rule contributes its configured score toward the overall total. Open a scan to see the Overall Scan Score for that run (it shows as calculating while the scan is still running), along with an average score for each quality dimension: Validity — whether values conform to the format or constraints a rule expects. Uniqueness — whether values are duplicated when they shouldn't be. Completeness — whether required values are present. Accuracy — whether values correctly reflect what they're meant to represent. Timeliness — whether data is current enough for its intended use. Below these headline stats, Object Level Analysis breaks the same scores down per object, so you can quickly see which dataset is pulling the overall score down. Drilling into an object and its rules Open any object from a scan's results to see its Rule Level Analysis — one row per rule applied to that object, showing the rule's quality dimension, which of the object's fields it was applied to, any filters that scoped which records it evaluated, and a summary of its result. Open a rule from that list to see two tabs. Result Analysis shows the rule set's score breakdown, a count of results at the record level, and the filters that were applied along with how many of the object's records they matched. Rule Logic shows how the rule is configured — its attributes, parameters, and a preview of its underlying logic — so you can confirm it's checking what you expect. Viewing the records behind a result To see exactly which records drove a rule's result, click View Records from that rule's result. This opens a record-level list for the rule, scoped to the object it ran against, showing every evaluated record and its individual outcome. Instead of guessing what's behind an Invalid or Not Complete percentage, you can inspect t

Introduction Almost every Monitoring question is really a telemetry question. The screen shows what was sent; when it looks wrong, the cause is usually upstream of it. Monitoring is empty, or nearly Are any agents Active? — Monitoring can only show instrumented traffic. Agents in Setup Pending contribute nothing, and unregistered agents contribute nothing at all. Is the time range wider than the traffic? — A quiet window over a genuinely busy agent is a range problem, not a data one. Is the scope narrowed to an idle agent? — Reset to All Agents to separate "this agent is quiet" from "everything is quiet". Note: An empty dashboard and a well-behaved estate look identical. This is the single most important thing to internalise about Monitoring. Before reporting that everything is healthy, confirm that something is actually being measured — the registry, not Monitoring, is where you check that. The numbers do not match what I expect Symptom Usual cause Spend far below the provider invoice Uninstrumented traffic, or models with no rate. Cost here is a floor Latency jumped, nothing deployed A slower model or tool, or more calls per run — compare p99 on LLM Calls with p50 on Tools , and check Run Types LLM calls rose, traces did not Retries, a longer chain, or you enabled an LLM-based control or an AI judge Tool view is empty Tool spans are not being emitted. Instrumenting the model client alone produces this exactly One agent dominates everything Often correct. Confirm at agent scope before treating it as an anomaly Traffic dropped to zero Take this seriously before assuming a reporting fault. In rough order of likelihood: the agent was decommissioned or its schedule changed; a deployment dropped the instrumentation; credentials or an ingest key rotated; or a network change blocked egress from where the agent runs. The quickest split is to check whether the agent is doing its job at all. If it is working and not reporting, the problem is the exporter. If it is not working, Monitoring is telling you the truth. Frequently asked Does Monitoring show policy violations? — No. That is Incidents. Monitoring shows behaviour, Incidents shows breaches, Evaluation shows quality. Can I get alerted when something changes? — Not from AI Governance today. There are no notifications on this surface — the review cadence is the mechanism, as it is for incidents. See Escalation & Notifications . Why do Monitoring and Cost Explorer show different totals? — Check the ranges and the scope first — a rolling window and a different period are not comparable. Both read the same telemetry. An agent shows activity but no cost — Token counts are missing from the spans, or no rate exists for that model. Usage is observed independently of pricing. Related Monitoring Overview Scoping: All Agents vs One Agent Agent Registry Troubleshooting

Integrating your application with Razorpay enables seamless online payment processing by supporting multiple payment methods such as cards, UPI, and net banking within a single platform. Razorpay helps automate payment collection, manage transactions, and ensure secure and reliable payment experiences, allowing businesses to streamline their financial operations efficiently. Authentication: Connecting your application with Razorpay enables smooth payment collection, real-time transaction tracking, and automated billing processes across multiple payment channels. Before you begin, ensure you have the following information: Connection Name : Choose a meaningful name for your connection. This name helps you identify the connection within your application or integration settings. It could be something descriptive like "MyAppRazorpayIntegration". Basic Based : Log in to your Dashboard using your credentials. Go to Account & Settings. Open API Keys under Website and App Settings. Click on Generate Key to create an API key. Copy the generated key ID, key secret and use it for further authentication purposes. Actions: Action Name Description Create a standard payment link Creates a standard payment link in Razorpay Create order Creates a new order in Razorpay Create payout links using contact details Creates a payout link using contact details in Razorpay Fetch all settlements Fetches all settlements from your Razorpay account Fetch settlement Fetches settlement reconciliation details in Razorpay Get order by ID Fetches the details of a specific order by its ID in Razorpay Get payout link status Gets the status of a payout link in Razorpay Initiate refund Initiates a refund for an order in Razorpay List all orders Lists all orders in Razorpay List payments of order Fetches all payments of an order from Razorpay Update order Updates the notes of an existing order in Razorpay Triggers : Trigger Name Description On payment Triggers when a payment is successfully made in Razorpay

Introduction Content Filter covers the safety categories every organisation ends up needing and nobody wants to define from scratch. Unlike most checks it is not one detector but seven, each ticked and tuned separately — which makes it the check where configuration matters most. What it detects "Common safety categories — hate, violence, sexual, self-harm, and more." Category Covers Hate Hateful content directed at people or groups Violence Violent content and threats Sexual content Sexual material Self-harm Self-harm and suicide content Harassment Targeted abuse Criminal misconduct Facilitation of criminal activity Profanity Coarse language Thresholds Tick each category to check, and set its threshold to High , Medium or Low . A category you leave unticked is not evaluated. The threshold is a confidence level, and the product states the trade-off directly: higher settings mean higher likelihood and fewer false positives. Level Behaviour Use when Unticked The category is not evaluated It is not a risk for this agent, or another control covers it Low Fires on weaker signals — more catches, more noise Missing something is much worse than a false positive Medium Balanced The sensible default for most categories High Fires only on strong signals The category is noisy on your traffic and you want only clear cases Set each category separately. The instinct is to pick one level and apply it across all seven; the result is a control that is too loose where it matters and too tight where it does not. A customer-support agent may want Self-harm on Low and Profanity on High — missing a distress signal is serious, and flagging every swear word is not. "Seven dials, not one. Turning them all to the same number is the fastest way to a control nobody trusts." Where to run it Applied on Catches User input What users bring to the agent — including distress signals worth routing to a human Agent output What the agent says back. The reputational surface. Content Filter runs on User input and Agent output only, and you choose a Classifier model for it. Most teams start on Agent output — what your agent says is what you are accountable for. Add User input when you also want to know what is being asked. Tuning Tune per category, per agent — A clinical agent and a marketing agent need different settings on the same seven dials. Watch Profanity — It is almost always the noisiest, and almost always the least consequential. Start it at High , or leave it unticked. Treat Self-harm as an operational signal, not just a policy one — A hit on user input may need a human, not a log entry. Decide the escalation path before enabling it. Grade the severity — These categories do not all matter equally. A single ungraded control across all seven flattens that. Known limitations Categories are fixed — You tune thresholds, not definitions. Something outside the seven needs Denied Topics or Custom (LLM check) . One action across all categories — The control has one action. To block hate and only flag profanity, use two controls. Context is not intent — Content quoting or reporting unsafe material can read as producing it. It calls a model — Each evaluation uses the Classifier model you choose, which lands in governance spend. Related Check Types Denied Topics (AI Governance) Severity & How It Is Assigned

Tag renders small colored label chips (status pills, category badges, filter chips). Typography (Text) displays bindable text in Plain Text, Markdown, Rich Text, or HTML content types.

The Tag block renders a small colored label — a pill or chip — showing a short piece of text. Its look is driven by four style axes: a Color , a Variant , a Size , and a Shape . You can add a Status Dot, start/end Icons, a Max Width, a Disabled condition, and a Dismissible toggle (X button). Tags are display-first but interactive: wire On Click to make the pill act like a button, or On Dismiss to react when users remove it. Note: Use Tag when you need a short text marker with color and shape (status, category, count). Use Avatar when you need an image/initials marker, or Button/Icon Button when you need an action control. Tag — Content Properties Property Type Default Description Label string (bindable, translatable) Tag The text shown on the tag. Non-text values are converted to text Tooltip string (bindable, translatable) — Hover tooltip text Interactions event list — On Click and On Dismiss event handlers Permissions permission rule — Restrict who sees the block Tag — Appearance Properties Property Type Default Description Variant Soft, Clear, Solid, Subtle, Ghost or Outlined Solid The tag's style family: how the Color turns into fill, border and text Size xs, sm or md sm The tag's height and text size Color named color, fine-tuned colors or conditions brand Base color from which fill, border and text are derived. Supports conditions for data-driven coloring Shape Square (2px), Rounded (6px) or Pill (fully rounded) Pill (unless your theme sets a different default) Corner rounding of the chip Max Width number (px) Auto Maximum width before the label truncates with an ellipsis Disabled condition — Greys the tag and stops On Click and On Dismiss from firing Decorators → Status Dot on/off off A small colored dot before the label, for status indicators Decorators → Dismissible on/off off Adds an X button so users can remove the tag. Required for On Dismiss to fire Decorators → Start Icon icon (bindable, conditional) — Icon at the start (left) of the label Decorators → End Icon icon (bindable, conditional) — Icon at the end (right) of the label Visibility conditions — Show or hide the block Custom CSS / HTML Attributes CSS / attribute map — Advanced options. Appear only once enabled on the block Variant Style Guide Variant Visual Description Typical Use Solid Filled with the color, white text High-emphasis status labels Soft Light tint of the color with a matching light border, colored text General-purpose status pills Subtle Light tint of the color with no border, colored text Low-emphasis markers Clear Page background and a neutral gray border; only the text takes the color Quiet category chips Outlined Page background and a solid border in a dark shade of the color, colored text Neutral or structural labels that still need a clear edge Ghost Page background and a dashed light border in the color, colored text Placeholder or pending states Note: In mobile apps only Solid, Soft and Clear have their own look. Subtle, Outlined and Ghost all show a plain gray-bordered chip with colored text. Tag Events Event Trigger Available When On Click User clicks or taps the tag Always — but does not fire when the tag is disabled On Dismiss User clicks the X button Dismissible is on AND the tag is enabled Tag — Exposed State Binding Type Description {{ id.content.label }} string The tag's label after bindings resolve {{ id.content.tooltip }} string The resolved tooltip text {{ id.appearance.* }} object Color, variant, size, shape, maxWidth, disabled, decorators Tag Behaviors & Gotchas Warning: Disabled tag ignores clicks and dismissal: When the Disabled condition is true, On Click and On Dismiss never fire. The pointer/hover affordance is also dropped. Warning: Dismiss X only shows while Dismissible is on: With Dismissible off, the X button disappears and On Dismiss can never fire (even if a handler is still configured). The On Dismiss row stays visible in the panel when a handler is saved — leave Dismissible on for any tag whose On Dismiss sh

Use the Grafana connector to visualize metrics and operational data. Integrating your application with Grafana lets you use these operations in an automation. It exposes 6 actions, listed below. Add the connector from the Connections area, authenticate, then select its operations in the automation builder. Capabilities: actions. Authentication Before you begin, make sure you have the following information: Connection Name: Choose a meaningful name for your connection. This name helps you identify the connection within your application or integration settings. Authentication Type: The authentication method for this connector is defined in the connection setup. Select the connector in the Connections area to see the fields it requires. Obtaining Your Service Account Token Log in to your Grafana instance and click Administration in the left-hand menu. Go to Users and access , then select Service accounts . Click Add service account . Enter a display name and click Create . Open the service account you just created, then click Add service account token . Enter a name for the token and click Generate token . Copy the generated token and store it securely — Grafana will not show it again. Actions Action Name Description Delete datasource Deletes a datasource in Grafana Delete folder Deletes a folder using UID in Grafana Get cache configuration of data source Gets cache configuration of a data source in Grafana List folders Lists folders in Grafana Update cache for data source Updates cache for a data source in Grafana Update folder Updates a folder using UID in Grafana

Use the Automation Anywhere connector to automate repetitive business processes. Integrating your application with Automation Anywhere lets you use these operations in an automation. It exposes 8 actions, listed below. Add the connector from the Connections area, authenticate, then select its operations in the automation builder. Capabilities: actions. Authentication Before you begin, make sure you have the following information: Connection Name: Choose a meaningful name for your connection. This name helps you identify the connection within your application or integration settings. Authentication Type: Automation Anywhere supports Credentials authentication. Obtaining Your API Key Log in to your Automation Anywhere Control Room. Make sure your user role has the Generate API-Key permission. If it doesn't, have an Admin open Administration , then Roles , enable Generate API-Key under the API section for your role, and assign it to your user. Click your username in the bottom-left corner of the Control Room, then select My Settings . Click Generate API-Key in the top-right corner of the page. If a key already exists, confirm the regeneration prompt. This invalidates the previous key and any integrations using it. Copy the generated API key and store it securely. You'll use it together with your Control Room username to authenticate. Authentication & setup Automation Anywhere provides multiple authentication methods for accessing Control Room APIs, including username/API key and JWT token-based authentication. Username and API Key Authentication The recommended approach for programmatic API requests. Step 1: Get Your Credentials Username: Your Automation Anywhere account username API Key: A 40-character string (available in your account settings) Important: Escape backslashes in the API key by replacing \ with \\ Step 2: Use the Credentials Include your username and API key in your API requests. Avoid using passwords in plain-text format to improve security. Token-Based Authentication Authentication API is used to generate, validate, and manage JSON Web Tokens (JWT) that are required for authorization in all Enterprise Control Room APIs. Refresh Tokens A refresh token allows you to get a new token without needing to collect and authenticate credentials every time a token expires. OAuth Services All API calls must contain either: An authentication token from the Authentication API (generates JWT), or A bearer token from OAuth services Actions Action Name Description Add or update a queue member Adds or updates a queue member in Automation Anywhere Add role as a queue consumer Adds role as a queue consumer in Automation Anywhere Add role as a queue participant Adds role as a queue participant in Automation Anywhere Create a work item model Creates a work item model for processing in a queue in Automation Anywhere Deploy bot Deploys attended or unattended or headless automations in Automation Anywhere Get queue Retrieves a specific queue by ID in Automation Anywhere Get work item model Retrieves a specific work item model by ID in Automation Anywhere Start bot migration Migrates bots (TaskBots and MetaBots) created using the Enterprise Client version 10 and 11 to Automation 360 in Automation Anywhere About the API Automation Anywhere provides the following API categories: Authentication API: Generate and manage JWT tokens Device API: Manage devices and bots Control Room APIs: Enterprise automation and orchestration Cloud Control Room APIs: Cloud-based automation management API Task Real-Time Endpoint: Real-time task execution These APIs enable programmatic automation, bot management, monitoring, and integration with external systems. Official documentation https://docs.automationanywhere.com/bundle/enterprise-v2019/page/auth-api-supported.html

1. Configure Identity Provider in UnifyApps Follow the steps below to establish a Single Sign-On (SSO) connection using OpenID between UnifyApps and Google Cloud Platform STEP 1 · Open Identity Provider Settings Navigate to your specific environment in UnifyApps and go to: Platform Tools → Security → Identity Providers . STEP 2 · Select OpenID & Copy Callback URL Select OpenID from the Identity Provider dropdown menu. Locate the Callback URL generated and copy it to your clipboard. STEP 3 · Configure the Scope and Attribute Mapping Add the required authentication scopes to specify the level of data access granted to UnifyApps. Next, fill out the Default Attribute Mapping to properly pair Azure user claims with UnifyApps user profiles. Scopes - Scopes Select Scope 1 openid Scope 2 profile Scope 3 email Default Attribute Mapping - Field Value Username JSON Path /email Email JSON Path /email 2. Generate Credentials in Google Cloud STEP 4 · Navigate to APIs & Services Log into the Google Cloud Console , select your organization's project, and navigate to the navigation menu: APIs & Services → Credentials . STEP 5 · Create OAuth 2.0 Credentials If you haven't already configured your OAuth consent screen, complete that step first. Then, click Create Credentials at the top of the page and select OAuth client ID . Set the Application type to Web application . STEP 6 · Configure Authorized Redirect URIs Scroll down to the Authorized redirect URIs section. Click Add URI and paste the Callback URL . Click Save . Use the Callback URL shown in your UnifyApps form. It follows this format: https://{your-domain}/auth/sso/OPEN_ID/complete-login 3. Complete Setup in UnifyApps STEP 7 · Link Credentials to UnifyApps A dialog box will appear in Google Cloud displaying your newly created Client ID and Client Secret . Copy the Client Secret value. STEP 8 · Save and Finalize Return to your open UnifyApps Identity Provider setup page. Paste the copied value directly into the Client Secret Key field, fill out any remaining standard Google OpenID endpoints, and save your configurations.

Use the Keka connector to manage HR, payroll, and attendance. Integrating your application with Keka lets you use these operations in an automation. It exposes 158 actions and 11 triggers, listed below. Add the connector from the Connections area, authenticate, then select its operations in the automation builder. Capabilities: actions, triggers. Authentication Before you begin, make sure you have the following information: Connection Name: Choose a meaningful name for your connection. This name helps you identify the connection within your application or integration settings. Authentication Type: Keka supports Client credentials authentication. Obtaining Your API Access Key Log in to Keka as a Global Admin or IT Admin. Click the gear icon next to your organization name to open Global Settings. Go to Integrations and Automation, then select API Access. Click Create New Key. Enter a name for the key, and set an expiry date and permission scope for it. Click Save. Copy the generated Client ID, Client Secret, and API Key and store them securely — they are shown only once. Actions Action Name Description Add a candidate for job Posts a candidate to a specified job in Keka Add a client Adds a new client in Keka Add a praise Adds a praise to employees in Keka Add a WFH request Adds a Work from home request for an employee in Keka Add an expense Adds an expense in Keka Add an expense claim Adds an expense claim in Keka Add assessments Adds assessment results in Keka Add BGV check Adds a BGV check for a vendor in Keka Add BGV request report Adds a BGV request report in Keka Add candidate note Adds a note for a candidate in Keka Add employee salary Adds employee salary in Keka Add employee skills Adds skills to an employee in Keka Add helpdesk ticket Adds a helpdesk ticket in Keka Add OD request Adds an On-duty request for an employee in Keka Add project allocation Adds a new project allocation in Keka Add project task timesheet entries Adds a new project task timesheet entries in Keka Add the adhoc transaction Adds the adhoc transaction in Keka Add time entry to attendance summary Adds a time entry to an employee’s attendance summary in Keka Create a leave request Creates a new leave request for an employee in Keka Create a project Creates a new project in Keka Create a project phase Creates a new project phase in Keka Create a task Creates a new task in Keka Create an employee Creates an employee in Keka Deactivate an employee Deactivates an employee in Keka Declare flexi benefits Declares flexi benefits in Keka Delete assessments Deletes an assessment from Keka Get a client Retrieves a client in Keka Get a project Retrieves a project in Keka Get all advance requests Fetches all advance requests in Keka Get all application fields Retrieves all application fields of a job in Keka Get all asset categories Retrieves all the asset categories from Keka Get all asset conditions Retrieves all the asset conditions from Keka Get all asset types Retrieves all the asset types from Keka Get all assets Retrieves all the assets from Keka Get all attendance records Retrieves attendance data within a date range in Keka Get all badges Retrieves all badges in Keka Get all banks Gets all banks in Keka Get all BGV requests Gets all BGV requests from Keka Get all billing roles Retrieves all billing roles of a client in Keka Get all bonus types Gets all bonus types in Keka Get all capture schemes Retrieves all capture schemes available in Keka Get all checks Retrieves all the BGV workflow checks from Keka Get all clients Retrieves all clients in Keka Get all contingent types Gets all contingent types in Keka Get all currencies Gets all currencies in Keka Get all departments Gets all departments in Keka Get all employee reviews Retrieves all employee reviews in Keka Get all employee salaries Gets all employee salaries in Keka Get all employee skills Retrieves all skills of an employee in Keka Get all exit reasons Gets all exit reasons in Keka Get all expen

Clone Record creates a copy of an existing record in a UnifyApps Storage object while leaving the original unchanged. Overview The Clone Record action duplicates a record identified by its ID. The original record is not modified in any way. By default the copy gets a new generated ID and the same field values. Set New Record ID to choose the ID, use Properties to override to change fields in the same step, and turn on Deep Clone to also copy referenced records. Use Clone Record to duplicate a template record, carry forward a previous entry's full data set, or branch a workflow from a known good state. Input Field Description Required Object The Storage object (table) containing the record to clone. * Record ID Unique identifier of the record to be cloned. * New Record ID Unique identifier for the new record. Leave empty to get a generated ID. Properties to override Properties to override in the new record. Deep Clone If true, all the referenced records will be cloned as well. Off by default. Version Specific version to clone from. Only applicable to objects with versioning enabled. Leave empty to clone the latest record. Deployed If true, clone from the deployed version instead of the saved (draft) version. Only applicable to objects that are deployed. Project ID Project/workspace ID where the cloned record should be created. Output The newly created record, with its record ID and its field values (copied from the original, plus any overrides). Use the returned ID in downstream steps to reference or modify the clone. Notes Keep the following in mind when using Clone Record. By default the cloned record receives a new generated ID; set New Record ID to choose it. The original record's ID is preserved and unchanged. Stored field values are copied from the source, except the fields you set in Properties to override. Turn on Deep Clone to also clone the records this record references. The original record is not modified in any way by a clone operation — it remains exactly as it was. Downstream steps should reference whichever record ID they need — the original or the new clone — explicitly, since both exist after the step runs. To change fields on the copy, use Properties to override in the same step. Alternatively, clone first and then run Update Record on the new record's ID. Either way the original stays intact as a reference or template.

Complete guide to configure Google SAML SSO integration with UnifyApps.

This guide outlines configuring Google as a SAML 2.0 Identity Provider (IDP) for Single Sign-On (SSO) with UnifyApps. You will need administrator access to your Google organization. The configuration process involves three main stages: Step 1: Initial Configuration on UnifyApps In this section, you will start the SAML configuration process on UnifyApps and obtain the necessary URLs that Google will require. 1. Access Identity Provider Settings: Navigate to Platform Tools . Select Security from the platform tools menu. Under the Identity Providers section, click on + New Identity Provider 2. Basic Details & Service Provider Information: Provider Name: Enter a name for this identity provider. Identity Provider: Select Google from the dropdown. Button Text: Enter "Continue with Google." Important: Note the following URLs. You will need these for Google Admin Console in Step 2. Assertion Consumer Service URL (ACS URL): This is the endpoint on UnifyApps where Google will send the SAML assertion. (Format: https://{your-domain}/auth/sso/SAML/complete-login) Service Provider Entity ID (SP Entity ID): This is the unique identifier for UnifyApps as the Service Provider. (Format: https://{your-domain}/sso/saml) 3. Prepare for Metadata & Define Attributes: For "Do you have your identity provider metadata content?", you'll select Yes and paste Google's metadata later (Step 3). Review the Default Attributes section ( emailAttributeStatement , firstNameAttributeStatement , lastNameAttributeStatement , etc.) — these are the attribute names you'll map on the Google side. Note: Keep the UnifyApps configuration page open. You'll return to it after configuring Google. Do not save changes yet. Step 2: Configuring the SAML Application in Google Admin Console 1. Create a New Custom SAML App: Log in to the Google Admin console. Navigate to Apps → Web and mobile apps → Add app → Add custom SAML app. 2. App Details: Name the app as per your requirement (e.g., "Demo App") and click Continue. 3. Google Identity Provider Details: Leave the Google IdP details as default and click Continue. 4. Service Provider Details: Paste the ACS URL and Entity ID (copied from the UnifyApps configuration in Step 1) into the corresponding fields here. Check the Signed response box. Click Continue. 5. Attribute Mapping: Map the following: emailAttributeStatement → Primary email firstNameAttributeStatement → First name lastNameAttributeStatement → Last name Click Finish. 6. Configure User Access: The service status defaults to OFF for everyone . Select ON for everyone and click Save. 7. Obtain Google Identity Provider Metadata: Click Download Metadata to save Google's SAML metadata XML file. Step 3: Finalizing Configuration in UnifyApps 1. Paste Google Metadata: Return to the UnifyApps IDP configuration page. Open the downloaded metadata file, copy its entire contents, and paste it into the Metadata Content field. 2. Enable Provisioning: Turn on JIT Provisioning and click Save. 3. Activate the IDP: Turn on the Google SAML toggle and click Save.

Start or stop real-time GPS location tracking on mobile devices, enabling field worker tracking, delivery status updates, geofenced alerts, and any use case that requires continuous location awareness.

Overview Live location tracking is the Track Live Location option of the Control User Location action. It starts or stops continuous background location tracking on the device. While tracking is on, each location fix is uploaded automatically to the e_live_location_tracking object at the interval set in your app's Location Tracking settings. For a single, one-time location read, use the Update Geolocation option of the same action, described in Mobile & Device Actions . Warning: Mobile apps only. Track Live Location appears in the action picker only in mobile apps whose Location Tracking settings have live tracking turned on with Trigger mode set to Manual . On the web it tracks nothing. When tracking starts, the app asks the user for location permission; if the user denies it, nothing is tracked. Parameters Field Required Description User Action Yes Choose Track Live Location . Operation Yes Start begins tracking. Stop ends it. Track location for Yes (Start only) How long to track before tracking stops on its own: 15 min (default), 1 hour or Custom . With Custom, enter a Duration and choose Hours or Minutes . Note: Tracking stops automatically when the Track location for window ends, or earlier when a Stop action runs. The stop is checked on each new location fix, so it can land a little after the window ends. Where Tracking Settings and Data Live Interval and notification text are app settings. The tracking interval and the Android notification text come from Settings → Advanced Settings → Location Tracking , not from the action. Every Track Live Location action in the app uses them. On iOS, the operating system decides the actual update cadence. Fixes are not returned to the page. The action returns nothing. Each fix is uploaded in the background to the e_live_location_tracking object, where you can query it — for example, from an automation or a data source. Manual sessions don't resume after the app is closed by the system. If the operating system kills the app, the user must open it and start tracking again. Step-by-Step Usage Guide Turn on live tracking: Go to Settings → Advanced Settings → Location Tracking . Turn on Enable Location Tracking and Access Live Location for Better Accuracy . Set Trigger mode to Manual . Set Tracking interval (ms) (default 30000, minimum 5000) and Foreground notification text (Android) . Create a Start Tracking button: Add a Button labelled "Start Tracking". In its event, add a Control User Location action. Set User Action to Track Live Location , Operation to Start , and choose how long to track in Track location for . Stop tracking when done: Add a Stop Tracking button with a Control User Location action set to Track Live Location and Operation Stop . Use the location data: Read the uploaded fixes from the e_live_location_tracking object. Each record in e_live_location_tracking holds one location fix with these fields: Group Fields Position latitude , longitude , timestamp , accuracy , speed , heading , altitude Trust signals isLocationSpoofed , isDeviceRooted , isDevModeEnabled , isBatterySaverEnabled , locationPermission User and device userId , userName , email (when the app has them), deviceId , applicationId Examples Start tracking for a one-hour shift { "actionType": "controlUserLocation", "payload": { "userControlAction": "trackLiveLocation", "liveLocationOperation": "start", "autoStopPreset": "1h" } } Stop tracking { "actionType": "controlUserLocation", "payload": { "userControlAction": "trackLiveLocation", "liveLocationOperation": "stop" } } Tip: Battery optimisation: Keep the tracking interval in Location Tracking settings as long as your use case allows, and choose the shortest Track location for window that covers the task.

Salesforce is a cloud-based software suite for customer relationship management

Using Salesforce streamlines managing customer relationships and sales processes. It helps track customer interactions, manage sales deals, and analyze data for better decisions.Salesforce ensures your customer data is protected with strong security. It's a tool for boosting sales efficiency and keeping customer information organized and safe. Integrating your application with Salesforce allows you to leverage Salesforce's extensive CRM capabilities. Authentication Before you begin, make sure you have the following information: Connection Name : Assign a descriptive name for this connection. This name is essential as it helps identify this specific Salesforce connection within UnifyWorkflow. Domain : This information directs your application to connect to the correct Salesforce instance. If your Salesforce instance URL is https://mycompany.my.salesforce.com , then your domain is mycompany.my.salesforce.com . Authentication Type : There are two options for authenticating the connection to your salesforce account - OAuth & JWT Token . OAuth After entering the Domain of your company, click Authorise . It will redirect you to the login page of Salesforce, from where you can login to your Salesforce account to directly authorize and connect your salesforce account in UnifyApps. Salesforce JWT Token Step 1: Create a Private Key and Digital Cert Authorizing an org with the org login jwt command requires a digital certificate and the private key used to sign the certificate. You can use your own private key and certificate issued by a certification authority. Alternatively, you can use OpenSSL to create a key and a self-signed digital certificate. Using a private key and certificate is optional when you authorize an org by logging into a browser. This process produces two files: server.key —The private key. You specify this file when you authorize an org with the org login jwt command. server.crt —The digital certificate. You upload this file when you create the required connected app. Open a terminal (macOS and Linux) or command prompt (Windows). If necessary, install OpenSSL on your computer. To check whether OpenSSL is installed on your computer, run the which command on macOS or Linux or the where command on Windows. Create a directory for storing the generated files, and change to the directory. Generate a private key, and store it in a file called server.key You can delete the server.pass.key file because you no longer need it. Generate a certificate signing request using the server.key file. Store the certificate signing request in a file called server.csr . Enter information about your company when prompted. Generate a self-signed digital certificate from the server.key and server.csr files. Store the certificate in a file called server.crt . Step 2 : Create a External Client App Salesforce CLI requires a external client app in the org that you're authorizing. A external client app is a framework that enables an external application, in this case Salesforce CLI, to integrate with Salesforce using APIs and standard protocols, such as OAuth. We provide a default external client app when you authorize an org with the org login web command . For extra security, you can create your own external client app in your org using Setup and configure it with the settings of your choice. You're required to create a connected app when authorizing the org with the org login jwt command. Log in to your org. From Setup , enter App Manager in the Quick Find box, then select App Manager . In the top-right corner, click New External Client App . Update the basic information as needed, such as the connected app name and your email address. Select Enable OAuth Settings . For the callback URL, enter http://localhost:1717/OauthRedirect . fIf port 1717 (the default) is already in use on your local machine, specify an available one instead. Then update your sfdx-project.json file by setting the oauthLocalPort property to the new port. For example, if yo