Integration Actions
Send public-safe pentest evidence to Sandbox or BrowserOps only when the action has a clear operator purpose and downstream confirmation.
Preview
availableAnyone can preview the exact payload. No downstream call is made and no success is claimed.
Protected Send
operator checkpointThe server has PLATPHORM_API_KEY for downstream calls, but the browser action still needs an operator session key or Authorization header.
Evidence Contract
artifact backedHandoffs include run id, target scope, allowed host, selected evidence routes, trace ids, and a public-safe redaction policy.
Evidence source
Operator authorization
Server `PLATPHORM_API_KEY` lets the backend call PlatPhorm services after an operator-authorized request. It does not make this public page a free mutation endpoint. Add a runtime PlatPhorm key below to enable protected sends from this browser session.
What will be sent
- run id and target scope
- allowed-host validation result
- public-safe run and log artifact links
- trace/request ids
Evidence routes
- https://example.test
- https://pentest.platphormnews.com/runs/pentest-2026-06-14-a39c81cd
- https://pentest.platphormnews.com/api/v1/runs/pentest-2026-06-14-a39c81cd/logs
Expected confirmation
- handoff acceptance id
- schema/scope validation status
- safe replay or dry-run evidence pointer
Protected sends are disabled until this browser session has an operator PlatPhorm key. Preview remains available and shows exactly what would be sent.
Operator credential controlscollapsed by default
Runtime Credentials
Server credentials are used first. Browser-session keys are optional one-action overrides and are never rendered back.
Used for real-run setup, protected integration previews, downstream PlatPhorm handoff.
Used for model routing checks, future gateway-backed model calls.
Used for future sandbox job creation when server OIDC is unavailable.