Connectors and protocols
Connect the systems you already run, under the same governance
One3 plans to reach other systems through five connector lanes, open protocols and India Stack rails. Every connector operation becomes a One3 Action with a risk tier, an approval rule and an audit trail.
Integration that agents can trust
In One3, a system counts as connectable only when a tenant can do three things without One3 engineering:
- Authorise it.
- See its operations as One3 Actions with risk tiers.
- Call at least one of them from an agent or workflow, with full audit.
A logo on a list does not count. Neither does a raw HTTP call or an MCP server nobody has reviewed.
This matters because One3 is not trying to win on raw connector count. It aims to win on governed Actions, approvals and evidence. Breadth exists so that reach is never the reason a buyer says no.
Honest status
The plan's connector catalogue lists routes to systems, not finished connectors. At the time of writing, no system yet meets the connectable definition. Each connector carries its earliest planned wave, and breadth targets will be published only once they are measured.
Five coverage lanes
| Lane | What it is | Built by |
|---|---|---|
| L1 Native | Hand-built on the Connector SDK with full manifest, sync, webhooks and reconciliation | One3 |
| L2 Certified partner | Built on the public SDK and passed through a conformance suite | Partners |
| L3 Generated | Draft connectors generated from public OpenAPI or AsyncAPI descriptions by the Connector Factory, then reviewed and tested | One3 Connector Factory, human-reviewed |
| L4 Curated MCP | Remote MCP servers from the system's own publisher, reviewed once at platform level and inherited by tenants | Publishers, curated by One3 |
| L5 Tenant-private | The OpenAPI and MCP import wizard and custom connectors, visible only to the tenant that made them | Tenants |
Rules every lane follows
All lanes feed one connector registry and one Action contract.
One registry, one contract
Every connector produces a manifest and Actions on the Action Bus. An MCP tool never reaches an agent except as a One3 Action with a risk tier.
Assurance by evidence
The lane is a label, not a privilege. A generated connector that passes conformance tests and has production evidence can be certified.
Depth follows demand
When a generated or MCP connector crosses a usage threshold, it moves to the native or partner queue for triggers, sync and reconciliation.
Licence first
No external connector code, definition or catalogue is used until its licence is recorded in the Fact Register and passes One3's licence rules.
Humans confirm risk tiers
Generated tiers are proposals. A reviewer confirms every R2-and-above tier, and an API or tool description can never lower one.
No invented API calls
Agents call registered Actions only. They never improvise calls against systems without a description.
Examples of planned connectors and earliest waves
| System | Category | Lane | Earliest wave |
|---|---|---|---|
| WhatsApp Business Platform | Messaging | L1 | W1 |
| Slack | Collaboration | L1 | W1 |
| Google Sheets | Collaboration | L1 | W1 |
| HubSpot, GoHighLevel | CRM and sales | L1 | W1 |
| Gmail, Microsoft Graph mail and calendar | Email and calendar | L1 | W2 |
| Meta Marketing API and Lead Ads, Google Ads API | Marketing and ads | L1 | W2 |
| Tally / TallyPrime, Zoho CRM | Finance and CRM | L1 | W2 |
| Salesforce, Odoo, Jira Cloud, GitHub | CRM, ERP and dev tools | L1 | W3 |
Connector Health Center: what agents see
| Band | Health score | What agents may do |
|---|---|---|
| Healthy | 85 or above | Act normally |
| Degraded | 60 to 84 | Read and make R0-R1 changes. R2-and-above Actions using this data need human confirmation. |
| Unhealthy | Below 60, or auth expired | Must not act on this connector's data. Draft-only. |
How health is measured
Every connector is planned to publish a health score from 0 to 100. It combines six signals: freshness, completeness, error rate, auth health, webhook timeliness and reconciliation quality.
Every agent plan step that depends on connector data checks the score first. The check is recorded in the trace.
The Connector Health Center (#199) is designed with three views:
- Tenant view: every connection, its health, freshness, last error, auth expiry and a re-auth button.
- Agency view: health across all client sub-accounts, with bulk re-auth reminders.
- One3 view: provider-wide incidents, a schema-drift quarantine queue and dead-letter redrive.
India Stack rails (through licensed partners)
| Rail | Planned use in One3 | Access model |
|---|---|---|
| UPI | Payment links, collections and payouts | Via licensed payment aggregators, gateways and banks |
| GST e-invoice (IRN) and e-way bill | Invoices, logistics and accounts | Via GSPs / ASPs |
| Account Aggregator | Consent-based financial data for cash-flow insight and reconciliation | Via a regulated entity or partner |
| ONDC | Seller-side listing and order flow | Via a registered network participant |
| DigiLocker | Document verification in HR and onboarding | Requester or partner onboarding |
| Aadhaar eSign / eKYC | Signing and KYC flows | Only via licensed eSign or KYC providers |
| ABDM | Health record exchange for clinic and healthcare editions | Integration certification required |
| Bharat Bill Pay, NACH, e-mandates | Recurring collections and subscriptions | Via banks or payment partners |
Regulated rails need licences
Most India Stack rails require licensed intermediaries, regulatory approval or formal onboarding. One3 plans to integrate through approved partners unless it obtains the relevant licence itself. One3 must not hold customer funds without the right authorisation. These are planning pointers, not legal advice. Verify with counsel.
Open protocols behind One3 abstractions
| Standard | Role in One3 | Planned wave |
|---|---|---|
| MCP | Expose One3 Actions to external AI clients (server); let One3 agents use approved external tools (client) | Server W1, client W2 |
| OpenAPI 3.x | Public API description and generated SDKs | W1 |
| Signed webhooks | Event delivery to developers | W1 |
| CloudEvents | Event envelope for the bus, webhooks and connectors | W0 |
| OpenTelemetry | Traces, including agent traces | W0 |
| OIDC / OAuth 2.x / SAML 2.0 | Human and app auth, enterprise SSO | W0-W2 |
| SCIM 2.0 | User provisioning from enterprise identity providers | W2-W3 |
| C2PA | Provenance for generated media | W2 |
| iCal/CalDAV, IMAP/SMTP, JMAP | Calendar and mail interoperability | W2-W3 |
| A2A | Messaging with external agents for the Agent Network | W4 experiments, W5 production |
| EDI (X12, EDIFACT) | Supply chain integration via EDI provider partners first | W5 |
How a public MCP server gets curated
Reviewing every public MCP server in every tenant does not scale. The plan reviews once at platform level and keeps tenant approval light.
- 1
Discover
The integrations team finds candidates from publisher documentation and public MCP registries, recording licence and terms per source.
- 2
Review
Security checks publisher identity, transport, auth model, data egress region, tool list, tool-description injection and per-tool risk tiers.
- 3
Catalogue
The server is listed with its reviewed tool-list hash, marked actions only, with no triggers.
- 4
Enable
A tenant admin enables it in one click and picks the allowed tools and scopes.
- 5
Watch for change
If the tool list changes, the server drops to Experimental for all tenants and new tools stay hidden until re-reviewed.
The integration plan in numbers
- connector coverage lanes
- 5
- integration tiers: native, certified, community, generic
- 4
- external systems named across the app plans
- 262
- India Stack rails planned via partners
- 8
- connector health bands
- 3
Integration questions
Can I connect a tool One3 has not built a connector for?
The plan includes an OpenAPI and MCP import wizard. It drafts Actions from a documented API, a tenant admin approves the risk tiers, and the result becomes a private connector for your tenant.
Can ChatGPT, Claude or Gemini use One3?
One3 plans to publish an MCP server from W1. External assistants would call One3 Actions under the same policies, approvals and audit as the One3 UI.
What happens when a connector breaks?
Its health score drops. In the degraded band, R2-and-above Actions need human confirmation. In the unhealthy band, agents go draft-only for that connector's data.
Does a listed system mean a partnership?
No. Systems are named as integration targets in the plan. A listing is not a partnership or endorsement, and each connector carries its own planned wave.
Will One3 embed n8n or Airbyte for connector count?
No. The plan rejects source-available engines and ELv2 connectors as hosted components. Individual connectors are allowed only when their own licence permits it.
Tell us which systems you run
Your integration needs help set connector priorities for each wave. Share your stack with our team.