Integration providers and monitoring

This page is for HyoNova's own platform operators. It covers the platform side of the Integration Hub: the applications HyoNova registers once at Google, Microsoft and GitHub so that companies can connect, and the Control Center screen that shows integration health across all companies.

What needs a platform application#

Provider	Platform application	Who connects afterwards
Google Drive	An OAuth client and a Picker key in a Google Cloud project	Each member for their own account, or an administrator for a company account
Microsoft OneDrive	An app registration in Microsoft Entra	Each member, or an administrator
GitHub	A GitHub App	A company administrator installs the app
Slack	None	A company administrator adds an incoming webhook
Microsoft Teams	None	A company administrator adds a workflow webhook

Rules for every provider#

Applications are entered in Control Center › Providers. Configuring needs the provider management permission (providers.manage), a recent step-up sign-in and a reason, and is audited.
Secrets — client secrets, private keys, webhook secrets — go straight to the platform secret store. They are never shown again, logged or audited; Control Center shows only whether each one is configured.
The redirect, callback and webhook addresses to enter at the provider are shown under each provider's Runtime section in Control Center, for the environment you are in. Copy them from there.
After every save, run Test connection. A provider that was saved but not tested is not treated as verified.
These applications are separate from the ones used for signing in with Google and for connecting mailboxes. Each asks only for its own permissions, and none widens another.

Google Drive#

The Drive application asks for access to files a person picks, and nothing else. It cannot reach mail or the rest of a Drive.

Choose a Google Cloud project and note its project number. It is the file picker's application identifier.
Enable the APIs. Under APIs & Services › Library, enable Google Drive API and Google Picker API.
Set up the OAuth consent screen as external, with the scopes openid, email and drive.file only. Publish the consent screen so it is not limited to test users, and complete Google's basic app verification.
Create an OAuth client of type web application. Enter the authorised redirect URI and the authorised JavaScript origin shown in Control Center.
Create an API key. Restrict it to the Google Picker API and to the website addresses shown in Control Center.
Enter it in Control Center. In Providers › Integrations — Google Drive, choose Configure and enter the client ID, the client secret, the Picker key and the project number. Save, then Test connection.

Google classifies drive.file as a non-sensitive scope, so the application needs basic verification only, not a restricted-scope review.

Microsoft OneDrive#

Register an application in the Microsoft Entra admin centre. For supported account types, choose accounts in any organizational directory and personal Microsoft accounts.
Add the web platform under Authentication, with the redirect URI shown in Control Center.
Add delegated Microsoft Graph permissions: User.Read, Files.Read and offline_access. Nothing else, and no application permissions.
Create a client secret and note its expiry date.
Enter it in Control Center. In Providers › Integrations — Microsoft OneDrive, choose Configure, enter the application's ID and secret, and choose the tenant setting that matches the account types you registered. Save, then Test connection.

Two things to know:

Files.Read covers reading the signed-in person's files as a whole. Microsoft has no per-file consent for this kind of connection. HyoNova asks Microsoft only about what the person browses and stores only what they link, and the product says so before anyone connects.
When the client secret expires, every OneDrive connection stops refreshing until a new secret is saved. Put the expiry date in your calendar.

GitHub App#

Create a GitHub App under HyoNova's GitHub organization.
Set the callback URL to the address shown in Control Center, and tick Request user authorization (OAuth) during installation.
Turn the webhook on, with the webhook address shown in Control Center and a random secret of at least 20 characters.
Set repository permissions: Metadata read-only, Issues read-only and Pull requests read-only. No other permission, and no organization or account permissions.
Subscribe to events: issues, pull request, pull request review and repository.
Allow installation on any account.
Generate a private key and a client secret.
Enter it in Control Center. In Providers › Integrations — GitHub App, choose Configure and enter the App ID, the app's address name, the client ID, the client secret, the whole private key file and the webhook secret. Save, then Test connection.

Request user authorization (OAuth) during installation is required, not optional. It is what lets HyoNova confirm with GitHub that the person installing the app really owns the installation; without it, every installation is refused. With it ticked, GitHub sends the browser to the callback URL after installation.

Test connection signs a token with the private key and asks GitHub which app it is.

Slack and Microsoft Teams#

There is nothing to set up on the platform. A company administrator adds a webhook in Company administration › Integrations. HyoNova accepts only:

a Slack incoming webhook address;
the address of a Teams workflow whose trigger is When a Teams webhook request is received. Addresses of the older Office 365 connectors are refused.

See Slack and Teams notifications.

Verify after the first setup#

Test connection proves that an application's own credentials work. It does not prove a person's whole journey. After you configure a provider for the first time, complete one real journey in a test company before telling customers it is ready:

Provider	Check
Google Drive	Connect an account, open Google's file window from a project, pick a file, open it from HyoNova, then disconnect
Microsoft OneDrive	Connect an account, browse and link a file, open it from HyoNova, then disconnect
GitHub	Install the app on a test organization, link a repository to a project and a pull request to a task, change the pull request on GitHub and see the new state in HyoNova

Watch the integrations#

Control Center › Operations › Integrations shows platform health across all companies: "Connections, notification deliveries, inbound webhooks and authorisations across all companies."

It shows counts and health only. "No account names, file names, message text or secrets are available on this screen, and nothing here opens what a company connected."

Providers#

One row per provider, across all companies.

Column	Shows
Platform application	Ready, Not configured (with Configure in Providers), or Not needed for Slack and Teams
Connections, Healthy	How many connections exist and how many are working
Need re-authorisation	Connections whose authorisation the provider no longer accepts
Failing	Connections whose last check or delivery failed
Last success	The most recent successful call or delivery
State	Running, Paused or Needs attention

Delivery queue#

Notifications on their way to Slack and Teams channels: Pending, the Oldest pending (flagged when it has waited longer than 15 minutes), and Accepted, Failed and Skipped in the last 24 hours. Accepted means the provider took the message, not that people read it. Skipped means a paused or inactive channel.

Inbound webhooks#

Events that providers send to HyoNova, today from GitHub: Received and Failed in the last 24 hours, and the time of the last one. A delivery with an invalid signature is refused. No payload is stored.

Authorisations#

Sign-ins at Google, Microsoft and GitHub that people started from HyoNova: Started and Failed in the last 24 hours. A failure can also be a person who cancelled.

Pause a provider#

Each provider row has Pause. A paused provider stops for every company:

companies see Paused by HyoNova on the card;
no new connections, no syncs and no deliveries happen;
notifications that fall due during the pause are skipped, not sent later;
existing connections and their settings are kept.

Resume starts connections, syncs and deliveries again. Notifications skipped during the pause are not sent afterwards.

Pausing and resuming need the operations management permission (operations.manage), a recent step-up sign-in and a written reason, and both are recorded in the platform audit log.

Status#

Feature	Status	Notes
Integration providers and monitoring	Requires setup	Set up HyoNova’s Google Drive, OneDrive and GitHub applications in Control Center, watch integration health and pause a provider.
Google Drive files	Requires setup	Link the Drive files you pick to projects, tasks and customers. Files stay in Google Drive; HyoNova keeps a link, never a copy. HyoNova must set up its Google application before anyone can connect.
Microsoft OneDrive files	Requires setup	Link chosen OneDrive files to projects, tasks and customers. Files stay in OneDrive; HyoNova keeps a link, never a copy. HyoNova must set up its Microsoft application before anyone can connect.
GitHub	Requires setup	Link repositories to projects, and issues and pull requests to tasks, read-only. A merged pull request never closes a task by itself. HyoNova must set up its GitHub App before a company can install it.
Slack notifications	Beta	Send the notifications you choose to Slack channels through incoming webhooks, with a test message, a pause and a delivery log.
Microsoft Teams notifications	Beta	Send the notifications you choose to Teams channels through a Workflows webhook, with a test message, a pause and a delivery log.