Connector types

Each connector type needs a specific set of credentials and scope. The types are a fixed set in code; this page covers the five that can be created for your organization. You provide them to Nexio; Nexio enters them and validates them against your system, and a passing validation activates the connection. This page lists every field, the permission the account needs, and what the validation probe checks. For what a connection is and who operates it, see Connections and data.

​

How secrets are handled

• Secret fields (client secrets, passwords, private keys, tokens, header values) are encrypted per field with AES-256-GCM before they are stored. A PostgreSQL connection URL is encrypted whole.
• For Snowflake, HTTP API and MCP connections, a passing validation stores a short, non-secret summary of what the probe found. For SharePoint it stores the resolved library (drive) ID.
• Every PostgreSQL, Snowflake, HTTP API and MCP address you supply passes a network guard before Nexio connects to it. The guard resolves the host and refuses loopback, private, link-local, multicast and cloud metadata addresses. For HTTP API, MCP and Snowflake connections it also checks the exact address each connection dials, so a DNS change cannot reach an internal address. HTTP API and MCP connections follow no redirects. A SharePoint connection reaches only Microsoft’s own endpoints; its site URL is sent to Microsoft Graph, not dialed.
• An HTTP API or MCP connection that sends a credential must use https.

​

SharePoint document library

Connection type materialize. Nexio replicates the files under the folders you name, then indexes and extracts them. See Indexing and extraction. Permissions. Grant the Entra app application permissions Sites.Read.All, Files.Read.All, or both. Grant nothing else. Read-only, enforced. The platform sends only GET requests to Microsoft Graph. The only POST is the OAuth token exchange with the Microsoft identity endpoint. A CI gate fails any code change that sends a non-GET request to Microsoft Graph. The access token is cached and refreshed 60 seconds before expiry; on a 401 the platform re-authenticates once. Validation. Nexio signs in as the app, resolves the site URL and library to a Microsoft Graph drive, and checks that each crawl root exists and is a folder that is not empty. The whole check runs within 20 seconds. A pass proves the app can authenticate and see that library and those folders.

​

PostgreSQL

Connection type postgres. Queried in place. Permissions. A database user with read access to the tables in scope. Validation. Nexio checks the URL against the SSL and host rules, then connects and runs SELECT 1, within 5 seconds. A pass proves the host is reachable over TLS and the credentials open a session.

​

Snowflake

Connection type snowflake. Queried in place by Records. Permissions. A role with read access to the schemas in scope. Nexio’s warehouse reads pass a statement guard that admits read statements only. Network. An account reachable only through PrivateLink resolves to a private address from Nexio’s network and is refused. Validation. Nexio opens a session, runs SELECT 1, then switches to the role, warehouse, database and schema. All of this runs within 10 seconds. A pass proves the credentials open a session and the role can use that warehouse, database and schema.

​

What Records needs

Records reads a system of record that you replicate into Snowflake. Nexio does not copy the rows to serve these reads: each read queries your warehouse when it is asked. The connection reads two areas of your warehouse. Its user needs read access to each area through the role the connection sets for that area (one role can serve both):

1. A curated dimensional model built from the source system.
2. The current replicated source tables of the source system, grouped by area.

A Snowflake connection serves Records reads only when it is ACTIVE and Nexio has bound the datasets that its system-of-record type requires. Without them, the connection serves no Records reads; see Completeness and errors for the refusal you receive. Nexio sets up the bindings with you during onboarding. You do not configure them. A source area that is missing or unreadable does not fail every read. A read that needs it reports that family as unavailable, as described in Completeness and errors. The data graph lists your connections and the derivations scheduled on them.

​

Generic API

Connection type api. Built, not yet enabled: the connection can be created and validated; no engine reads it at run time yet. Validation. Nexio obtains credentials as configured and sends the test request through the guarded client. Each HTTP call is capped at 10 seconds and the whole probe at 15 seconds. The probe passes when the response status equals the expected status, or is any 2xx when none is set. The stored summary is the status, method and path, for example HTTP 200 from GET /v1/health.

​

MCP server

Connection type mcp_server. Built, not yet enabled: the connection can be created and validated; no engine reads it at run time yet. Validation. Nexio performs the MCP initialize handshake, lists the server’s tools, and lists its resources when the server declares them. Each HTTP call is capped at 10 seconds and the whole probe at 15 seconds. The stored summary is the server name, its version, and the tool and resource counts.

​

Types you do not create

blob_corpus is a retired alias of the SharePoint type. http_enrichment names the enrichment providers Nexio calls during a run, with credentials Nexio holds. Neither is created for a customer, and neither needs anything from you.

​

Validation result

Every probe reports whether it passed and, when it failed, a plain message saying what failed. A pass activates the connection. Snowflake, HTTP API and MCP probes also return a short, non-secret summary on a pass, which Nexio stores on the connection. PostgreSQL and SharePoint probes return no summary. A failed validation sets the connection to PENDING with that message. Nexio corrects the credentials or scope with you and validates again.