Integration Actions
Send public-safe pentest evidence to Sandbox or BrowserOps only when the action has a clear operator purpose and downstream confirmation.
Preview
availableAnyone can preview the exact payload. No downstream call is made and no success is claimed.
Protected Send
confirmation requiredThe server has PLATPHORM_API_KEY for downstream calls, but browser-triggered sends still need operator auth through an API key header or runtime PlatPhorm session key.
Evidence Contract
artifact backedHandoffs include run id, target scope, allowed host, selected evidence routes, trace ids, and a public-safe redaction policy.
Evidence source
Operator authorization
Server `PLATPHORM_API_KEY` is checked before this page renders and is used only as the downstream credential for protected delivery. Browser-triggered sends still need an operator-authenticated request through a runtime PlatPhorm key or API key header.
What will be sent
- run id and target scope
- allowed-host validation result
- public-safe run and log artifact links
- trace/request ids
Evidence routes
- https://example.test
- https://pentest.platphormnews.com/runs/pentest-2026-06-14-a39c81cd
- https://pentest.platphormnews.com/api/v1/runs/pentest-2026-06-14-a39c81cd/logs
Expected confirmation
- handoff acceptance id
- schema/scope validation status
- safe replay or dry-run evidence pointer
Server-side `PLATPHORM_API_KEY` is configured for downstream delivery. Browser sends still require explicit operator auth; the server key is never rendered and delivery is confirmed only by the downstream service.
Protected sends are disabled until this browser action carries operator auth through a runtime PlatPhorm key or API key header. Use preview for a local, non-delivering payload inspection.
Operator credential controlscollapsed by default
Runtime Credentials
Server credentials are used for downstream calls. A browser-session PlatPhorm key authenticates explicit operator actions when no Authorization header is present.
Downstream PlatPhorm credential is present server-side; browser operator auth is still explicit.
Used for model routing checks, future gateway-backed model calls.
Used for future sandbox job creation when server OIDC is unavailable.