Security Integrations

28 entities and 106 agent-callable operations in integrations. Each operation is addressed as {mega_tool}/integrations/{entity}/{operation} and carries the same permission check over MCP and REST.

`alert_route`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a chat alert route (it runs as you).
`delete`	`entity_crud`	Delete a chat alert route and its Event Spine subscription.
`list`	`entity_crud`	List the organization's chat alert routes (topics, condition, recipients, providers, active).
`preview`	`smart_action`	Preview a chat alert route against a sample event: {route_id, topic, contract_id, approval_id?}.
`read`	`entity_crud`	Read one chat alert route.
`update`	`entity_crud`	Update a chat alert route (name, topics, condition, recipients, providers, is_active).

`chat`

Operation	Mega-tool	What it does
`get`	`config_manage`	Read the organization's chat settings: chat-approval switch and value ceiling, the Slack workspace connection (team, status) and which providers (slack…
`slack_connect`	`config_manage`	Connect the organization's Slack workspace with the four values from the customer-created app (bot_token xoxb-…, signing_secret, client_id, client_secret).
`slack_manifest`	`config_manage`	The Slack app manifest (JSON and YAML) the customer's Slack admin uses to create A4's app in their own workspace: bot scopes, interactivity URL and the Sign…
`test`	`config_manage`	Test the Slack connection (auth.test with the stored bot token; checks the team matches and that the signing secret and OIDC client are present).
`update`	`config_manage`	Update chat approval settings: allow_chat_approvals (default false), chat_approval_max_value (approvals above it must be decided in A4) and approval_currency…

`chat_channel_target`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Register a chat channel target: provider=slack with external_channel_id, or provider=teams_webhook with webhook_url (Teams Workflows hosts only).
`delete`	`entity_crud`	Delete a chat channel target (refused while an active alert route posts to it).
`list`	`entity_crud`	List the organization's chat channel targets (Slack channels, Teams webhooks).
`read`	`entity_crud`	Read one chat channel target.
`update`	`entity_crud`	Update a chat channel target (label, channel id, webhook URL, shared-channel switch, default purposes).

`chat_delivery`

Operation	Mega-tool	What it does
`list`	`report_query`	List chat deliveries (Slack/Teams sends) with status, skip reason and error code.

`clm_import`

Operation	Mega-tool	What it does
`dry_run`	`smart_action`	Preview an other-CLM import job: parses the job's files and calls CLM's import_contracts(dry_run=True).
`run`	`smart_action`	Queue an other-CLM import job for real (respects the job's own dry_run flag, default True).
`status`	`smart_action`	The current status and result of an other-CLM import job.

`connectors`

Operation	Mega-tool	What it does
`audit_chain`	`integration_call`	Read a connector's hash-chained run-audit ledger: one entry per terminal sync / promote / un-promote / reverse run, in chain order (sequence ascending).
`audit_verify`	`integration_call`	Verify the integrity of a connector's hash-chained run-audit ledger.
`create`	`integration_call`	Create an integration connector for the organization.
`delete`	`integration_call`	Delete an integration connector.
`dlq_list`	`integration_call`	List a connector's per-record promotion failures (the dead-letter queue).
`dlq_replay`	`integration_call`	Replay a connector's pending promotion dead-letters: re-drive the failed staged records through the normal promote path.
`field_schema`	`integration_call`	Discover the field-mapping schema for a connector's external source: the available source fields and how they map to normalized record columns.
`get`	`integration_call`	Retrieve one integration connector (full config + has_credentials bool + recent sync logs).
`list`	`integration_call`	List the organization's integration connectors (summary view: name, type, status, sync direction/interval, last-sync time/status).
`logs`	`integration_call`	Read the recent sync-activity log for an integration connector (records received/created/updated/failed, status, timestamps, duration).
`record_preview`	`integration_call`	Preview a sample of external records for a connector WITHOUT running a sync (no records are persisted).
`reverse_sync`	`integration_call`	Trigger reverse-ETL write-back for a connector: push the org's native rows OUT to the external system per the connector's field_mapping['reverse'].
`staged_records`	`integration_call`	Browse the staged ExternalRecord rows a connector ingested (the staging buffer before promotion to native rows).
`stream_state`	`integration_call`	List a connector's per-stream incremental cursors.
`sync`	`integration_call`	Trigger an async sync for an integration connector.
`sync_history`	`integration_call`	Retrieve the sync history (audit trail) for a connector: per-run records received/created/updated/failed counts, status, timestamps, duration, and error…
`test`	`integration_call`	Test the connection for an integration connector.
`update`	`integration_call`	Partially update an integration connector.

`content_principal`

Operation	Mega-tool	What it does
`confirm`	`integration_call`	Confirm proposed principal rows (email matches) so they start granting.
`import_csv`	`integration_call`	Import principal mappings from CSV text with columns external_principal_id, user_email [, status manual\|ignored\|unmapped].
`list`	`integration_call`	List a content source's principal map (DMS users and groups → A4 users) with status proposed / confirmed / manual / unmapped / ignored.
`map`	`integration_call`	Map a DMS user principal to an A4 user of this tenant (status manual), or set it unmapped or ignored.

`content_source`

Operation	Mega-tool	What it does
`bind_matter`	`integration_call`	Bind a selection to a matter (walls then apply to its documents).
`confirm_matter`	`integration_call`	Confirm a proposed matter (from the workspace profile) for a selection.
`create`	`integration_call`	Create a content source on an existing connector of this organization (the connector holds the service credentials).
`find_contracts`	`smart_action`	Add a content source's mirrored documents to the organization's contract repository review table and propose Contract records for each document-only row (dry…
`list`	`integration_call`	List the organization's content sources (iManage, NetDocuments, Box, Egnyte, Datasite, Intralinks): provider, status, phase, counts, settings, selections and…
`pause`	`integration_call`	Pause a content source (crawls and deltas stop; mirrored access is unchanged).
`read`	`integration_call`	Read one content source with its selections (matter binding state included; a walled proposed matter is never shown).
`reread_acls`	`integration_call`	Re-read every item's permissions now (applies a narrowing immediately; otherwise the next ACL sweep does).
`resume`	`integration_call`	Resume a paused content source (unfinished crawls continue from their cursors).
`retry_item`	`integration_call`	Retry the ingest of one failed or parked item (by SourceRecord id).
`select_scope`	`integration_call`	Select (or disable) workspaces / rooms / saved searches to index: selections = [{external_id, kind?, name?, enabled?}].
`start`	`integration_call`	Start indexing the enabled selections (crawl on the content_sync worker).
`status`	`integration_call`	Status card of a content source: phase, counts (listed, queued, ingested, skipped by reason incl.
`test`	`integration_call`	Probe the provider with the service grant (lists libraries).
`unbind_matter`	`integration_call`	Remove a selection's matter binding.
`update`	`integration_call`	Update a content source's settings (partial) or name.

`contract_writeback`

Operation	Mega-tool	What it does
`get`	`config_manage`	Read a CRM connector's contract write-back settings: enabled (off by default), targets (which CRM fields each contract field goes to), events, the run-as…
`update`	`config_manage`	Update a contract write-back.

`crm`

Operation	Mega-tool	What it does
`launch_contract`	`integration_call`	Generate the contract for one Salesforce or HubSpot deal (once).
`writeback_preview`	`integration_call`	Show the exact payload a write-back would send for one contract, per target (opportunity, account), without sending anything.
`writeback_run`	`integration_call`	Push one contract to its CRM record(s) now, as you.

`crm_user_map`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List the CRM user to A4 user map of a Salesforce or HubSpot connector (status: proposed, confirmed, manual, unmapped).
`update`	`entity_crud`	Change the CRM user map: action 'refresh' (rebuild email-match proposals), 'unmap' (id), or - person only - 'confirm' (id) / 'manual' (id, user).

`dms`

Operation	Mega-tool	What it does
`folders`	`integration_call`	List sub-folders of a DMS workspace/folder with the caller's delegated grant, for picking a save-back destination.
`search`	`integration_call`	Search a DMS (iManage / NetDocuments) in place with the caller's own delegated sign-in, so results are exactly what the DMS lets that user see.
`sign_in_url`	`integration_call`	The per-user OAuth authorize URL for a content source's DMS (search/save-back require the caller's own delegated sign-in, §4.5).

`dropbox`

Operation	Mega-tool	What it does
`authorize_url`	`integration_call`	Start connecting Dropbox (read-only: files.metadata.read, files.content.read, account_info.read; PKCE; offline refresh).
`disconnect`	`integration_call`	Disconnect Dropbox: revoke the token at Dropbox (best effort) and delete the encrypted credentials from the platform; documents already loaded stay.
`list_folders`	`integration_call`	List the sub-folders of a Dropbox path (metadata only, depth ≤ 2) so a human can choose which folders the platform may read.
`select_folders`	`integration_call`	Set the Dropbox folders the platform may read (allowed roots).
`status`	`integration_call`	Dropbox (read-only) connector status: {id, status, configured, account_display, allowed_roots, last_sync_at, last_sync_status, counts:{staged, cleared, held…
`sync`	`integration_call`	Sync the selected Dropbox folders into documents: every file is triaged on its NAME and folder path before download (a blocked consumer report is never…

`erp_link`

Operation	Mega-tool	What it does
`propose`	`smart_action`	Run the ERP link proposer (vendor matching + PO/invoice spend linking) for one connector, or every active ERP connector of the org when connector_id is omitted.

`export_dataset`

Operation	Mega-tool	What it does
`read`	`report_query`	List the registered export datasets (contracts, contract_parties, obligations, approvals, contract_activity, review_cells_verified when review_tables is…

`export_destination`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Propose a warehouse export destination (S3 Parquet or Snowflake).
`delete`	`entity_crud`	Delete an export destination.
`list`	`entity_crud`	List this organization's warehouse export destinations (S3 Parquet, Snowflake).
`read`	`entity_crud`	Read one export destination.
`run_now`	`smart_action`	Trigger an immediate warehouse run for this destination's active warehouse_datasets schedule (AC-088-2 on-demand refresh).
`test`	`smart_action`	Probe the destination: S3 Parquet uploads+deletes a tiny object; Snowflake runs a no-op SELECT 1 through the SQL API.
`update`	`entity_crud`	Update an export destination (partial).

`export_run`

Operation	Mega-tool	What it does
`list`	`report_query`	List warehouse export runs for this organization.

`external_record`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List external_records with filtering and pagination
`read`	`entity_crud`	Get detailed external record information
`search`	`entity_crud`	Search external_records with fuzzy matching

`google_docs`

Operation	Mega-tool	What it does
`checkin`	`smart_action`	Export the checked-out Google Doc back to DOCX bytes (base64) for OFF to apply as a new document version.
`checkout`	`smart_action`	Check a document out to Google Docs for collaborative editing (I-CON-9): uploads with conversion using the caller's own Google account.

`mcp_bridge`

Operation	Mega-tool	What it does
`connect_url`	`integration_call`	Start connecting the caller's own account to an external MCP server (OAuth 2.1 + PKCE + dynamic client registration).
`disconnect`	`integration_call`	Delete the caller's own connection to an external MCP server.
`list_resources`	`integration_call`	List one page of an external MCP server's resources through the caller's own connection (pass next_cursor as cursor for more).

`mcp_bridge_trust`

Operation	Mega-tool	What it does
`list`	`config_manage`	List this organization's federation trusts with their MCP file-bridge switches: allow_user_connections (members may connect their own account) and…
`update`	`config_manage`	Switch the MCP file bridge for one of this organization's federation trusts.

`mcp_export_target`

Operation	Mega-tool	What it does
`create`	`config_manage`	Declare an export target (a remote tool plus a fixed argument map) on one of this organization's federation trusts.
`delete`	`config_manage`	Delete an export target.
`list`	`config_manage`	List the export targets declared on one of this organization's federation trusts (the only remote tools a member can send a document to, with their fixed…
`update`	`config_manage`	Change an export target's tool, argument map, size limit or active flag.

`mcp_profile`

Operation	Mega-tool	What it does
`get`	`config_manage`	Read the organization's legal-assistant MCP profile: tool group id, the coordinates a new client is allowed, the search/fetch alias switch, the catalog and…
`update`	`config_manage`	Narrow the legal-assistant profile's allowed coordinates and/or switch the search/fetch aliases.

`slack`

Operation	Mega-tool	What it does
`send`	`notification_send`	Send a Slack message from the organization's own Slack app: a DM to linked A4 users and/or a post to a registered channel target.

`teams`

Operation	Mega-tool	What it does
`send`	`notification_send`	Send a Microsoft Teams message: a card DM to A4 users linked through the A4 Teams app and/or a post to a registered Teams Workflows webhook target.

`time_entry`

Operation	Mega-tool	What it does
`test_push`	`integration_call`	Check whether a time-entry connector (Clio/Aderant/Elite 3E) can push for a given matter/timekeeper pair: reports the id-mapping errors and a connectivity…

`vdr`

Operation	Mega-tool	What it does
`import_to_review_table`	`smart_action`	Import already-ingested content-source documents (matched by their provider file id) into a review table — an existing one or a new one by name.

`vendor_access`

Operation	Mega-tool	What it does
`list`	`integration_call`	List every HTF-089 vendor programme gate and its current status (pending/open/closed).
`record`	`smart_action`	Record a vendor programme access decision (HTF-089: netdocuments, datasite, intralinks, everlaw, intapp_walls, intapp_time).

Parameter schemas and permission codenames are in the full reference — sign in — or call prism_introspect(dimension="capability_search", query="…") with your key.

In the full reference this application appears under config_manage, entity_crud, integration_call, notification_send, report_query, smart_action.