Connect a Capture API client

For: Company admins and integration owners
Owner: Integration operations
Outcome: Test, monitor, recover, rotate, and disconnect a Capture API client safely.
Last verified: 2026-08-30
Next review: 2026-11-28
Status: supported

Create one server-side client and capture a synthetic person exactly once. This guide uses the current supported Sakhaa setup surface and keeps provider-owned approval and availability separate.

Prepare the connection

Each client has its own rate limit, source mapping, and active state.

Create one API client for one external integration and copy the secret once.
Store the key and secret in the server-side secret store.
Call the information endpoint, then capture one synthetic person with an idempotency key.

Connect and prove health

Open /app/api-clients in the correct workspace.
Save the x-api-key and one-time x-api-secret only in the protected setup surface.
Call the API information endpoint, then capture one synthetic person with an idempotency key.
Confirm this healthy result: The test person is created once with the expected source, owner, and fields.

Use synthetic data and an approved test identity. Do not use customer traffic only to prove a connection.

Monitor and recover

Monitor: Review client status, rate limit, request statistics, failures, and mappings.
Recover: Correct the request or client settings. Use the same idempotency key only for the same logical request.
Rotate: Regenerate the secret, update the server-side integration, then remove the old secret.
Disconnect: Deactivate the client before deletion and confirm the replacement intake path.
Limits: Each client has its own rate limit, source mapping, and active state.
Fallback: Keep the existing client or a reviewed manual intake path active until the replacement client passes a synthetic request.

Support boundary

Sakhaa supports the published capture contract. Customer code and hosting remain customer owned.

Record the provider, workspace, approximate time, safe error code, expected result, and actual result.
Do not include passwords, access tokens, API secrets, message content, or unnecessary customer data.