Procedure
Connections and credentials
Walks through defining a connection to another system and holding the credentials the bridge uses to reach it safely.
This page defines a connection to another system and holds the credentials that reach it safely. A connection is one governed link between Pensieve and an outside system, carrying messages across a controlled boundary.
Two kinds of connection
A connection is one of two kinds, and the kind decides the path a message takes. A system the hospital owns is reached through the orophin bridge. A system the hospital uses without owning is reached directly by the platform, with the hospital's own credentials.
| Kind | Reached by | Examples |
|---|---|---|
| A system the hospital owns | The bridge | Laboratory, information, pharmacy, radiology and billing systems |
| A system the hospital uses | The platform, directly | A national health-data exchange, an insurer, a third-party administrator, another service |
Define a connection
Define a connection in Westron, through a guided wizard. The wizard walks the same shape for both kinds, and it ends by writing the connection and, for a bridge-carried system, pairing it with the agent so inbound messages are authorised.
- 1
Choose the class and category
Pick whether the system is owned and reached through the bridge, or used and reached directly. Then pick its category, the kind of system it is.
- 2
Start from a template
Pick a prebuilt template for a known vendor to prefill the endpoint fields. This step is optional, and you can fill the fields by hand.
- 3
Set the endpoint
Fill the connection's address and settings. Values come from a set of fields, so you choose rather than type free text, and the settings stay well formed.
- 4
Supply the credentials
Enter the credential the connection uses. The platform holds it by reference, as the next section describes.
- 5
Bind any variables
Bind each declared variable to this connection, so a tool that needs the link resolves to the right one.
- 6
Test
Run a real connectivity probe and read the result. The test reaches the system as the live path would, so a green result reflects a real round trip.
- 7
Activate
Write the connection. For a bridge-carried system, activation pairs the connection with the agent, so messages from that system are authorised on arrival.
/connectionsDefine one connection.
How credentials are held
The secret stays out of the record
The connection record holds a pointer to a secret store, and the raw secret stays off the record and off the wire. The console shows the reference alone. The value itself is held per site in a managed secret store and resolved by reference when the bridge or the platform reaches the system.
Because a connection carries only the pointer, a person reading the connection in the console sees where the credential lives, while the credential itself stays sealed.
Switching a connection off
Each connection carries a switch. Switch it off and new calls to that system are refused, in-flight work drains safely, and unrelated systems keep running. For a bridge-carried system, the switch also withdraws the inbound authorisation, so messages from that system stand down.
The consequence is stated before you confirm
A confirm dialog states the exact consequence in plain language before the switch flips. For a bridge-carried system whose inbound authorisation the switch withdraws, the dialog asks you to type to confirm.
/connections/{id}/kill-switchSwitch one connection off or back on.
Removing a connection cleanly
Removing a connection runs as a guided sequence, so a teardown leaves the record whole and holds no leftovers.
| Step | What happens |
|---|---|
| Pause | The switch stops new exchange with the system. |
| Drain | In-flight calls and the queue finish safely. |
| Export | A final forensic record is written and offered for export. |
| Revoke | The agent's inbound authorisation is withdrawn and its registration retired. |
| Delete | The connection and its credential pointer are removed in full, leaving no orphaned parts. |
| Confirm | A final success state records the disconnect. |
Common questions
Does the console ever show the raw credential?
The console shows the reference to the secret store. The raw value stays sealed in the store and reaches the system by reference at call time.
What happens to other systems when I switch one off?
Unrelated systems keep running. New calls to the switched-off system are refused, and the tools that used it degrade softly with a plain notice.
Map the fields of a connection's messages onto the platform in mapping fields.