Integration Actions
Send public-safe pentest evidence to Sandbox or BrowserOps only when the action has a clear operator purpose and downstream confirmation.
Preview
availableAnyone can preview the exact payload. No downstream call is made and no success is claimed.
Protected Send
server configuredThe server has PLATPHORM_API_KEY for downstream calls. A browser send only needs an explicit operator click; success is still claimed only after downstream confirmation.
Evidence Contract
artifact backedHandoffs include run id, target scope, allowed host, selected evidence routes, trace ids, and a public-safe redaction policy.
Evidence source
Operator authorization
Server `PLATPHORM_API_KEY` is checked before this page renders. When present, protected sends use that backend credential without exposing it to the browser. Add a runtime PlatPhorm key only when the server key is missing or you need a one-action override.
What will be sent
- run id and target scope
- allowed-host validation result
- public-safe run and log artifact links
- trace/request ids
Evidence routes
- https://example.test
- https://pentest.platphormnews.com/runs/pentest-2026-06-14-a39c81cd
- https://pentest.platphormnews.com/api/v1/runs/pentest-2026-06-14-a39c81cd/logs
Expected confirmation
- handoff acceptance id
- schema/scope validation status
- safe replay or dry-run evidence pointer
Server-side `PLATPHORM_API_KEY` is configured. Protected sends are available from this deployment; the key is never rendered and delivery is still confirmed only by the downstream service.
Operator credential controlscollapsed by default
Runtime Credentials
Server credentials are used first. Browser-session keys are optional one-action overrides and are never rendered back.
Used for real-run setup, protected integration previews, downstream PlatPhorm handoff.
Used for model routing checks, future gateway-backed model calls.
Used for future sandbox job creation when server OIDC is unavailable.