Portal Downstream Security And Secret Management
Purpose
This functional area configures how the Runtime securely connects to downstream APIs.
It covers target registration, downstream authentication strategies, credential orchestration, secret handling, and outbound call restrictions.
Main Capabilities
- manage target systems
- manage target authentication profiles
- manage tool endpoint authentication bindings
- manage credential workflow definitions
- manage secret stores and secret-store connections
- manage outbound host allowlists
Target Systems
Target systems represent the downstream APIs that the Runtime can call.
Administrators can define:
- system identity
- base URL
- descriptive metadata
- active or inactive status
This creates the execution destination layer for runtime tool calls.
Target Authentication Profiles
Authentication profiles define how a target system should be accessed.
Supported strategy types include:
- none
- passthrough bearer
- API key from secret store
- basic authentication from secret store
- static bearer from secret store
- client credentials template
- token exchange template
- SOAP username token
- SOAP username token digest
- SOAP custom headers
- client certificate (mTLS)
- workflow-based authentication
This gives the platform the flexibility to work with a wide range of downstream security models, including SOAP services that require message-level credentials or custom SOAP header values, and downstream systems that require mutual TLS.
Client Certificate (mTLS) Authentication
For downstream systems that authenticate callers by TLS client certificate, administrators can upload a client certificate (PFX/PKCS#12 file) directly in the auth profile form and select the secret holding its private key password. An optional certificate thumbprint can also be entered to confirm the correct certificate is configured. At runtime, the certificate is presented to the downstream API for both REST/OpenAPI/OData tools and SOAP tools.
Tool Endpoint Authentication Bindings
Bindings connect:
- an exposed tool endpoint
- a downstream target system
- an authentication profile
This is the functional point where publication logic meets execution security.
Credential Workflow Definitions
The Portal supports step-based credential workflows for advanced downstream authentication scenarios.
These workflows can describe controlled sequences such as:
- reading input values
- reading secrets
- reading configuration values
- transforming values
- making HTTP requests
- parsing responses
- building a credential set
This makes the platform capable of handling more than static credential injection.
Secret Management
The platform supports managed secret usage through:
- platform-managed database-backed secret storage
- Azure Key Vault-backed secret storage
- secret store connection administration
- enabled secret store configuration visibility
- managed-secret encryption rotation
From a functional standpoint, this allows operators to configure downstream access without embedding sensitive values in mappings or tool definitions.
Secret values are never returned through the Portal after creation or update. Operators work with secret metadata, backend selection, tenant scope, and connection references rather than retrieving plaintext values later.
Outbound Host Governance
The Portal also manages outbound host allowlists.
This ensures the Runtime can only call approved downstream destinations, which is a key governance and security control for AI-driven execution.
Operational Importance
This area is essential for safe production use because it governs how live credentials and live downstream calls are controlled.