Manifest
Declare name, version, scopes, one auth strategy, and every outbound endpoint. The manifest is the review contract — undeclared access is refused.
CONNECTOR SDK
The Ruzzler Connector SDK turns an external service into a certified connector: a declared manifest, one authentication strategy, a deterministic test harness, signed packaging, and a certification review pinned to the version you ship.
Every connector moves through the same lifecycle. The manifest is the contract; certification is the receipt.
Declare name, version, scopes, one auth strategy, and every outbound endpoint. The manifest is the review contract — undeclared access is refused.
Pick one strategy: OAuth 2.0, vault-held API key, or signed webhooks. Credentials never touch your connector's client-side bundle.
Run the SDK harness against a sandbox tenant with deterministic fixtures: manifest validation, auth flow, endpoint allow-list, and evidence attachment.
Ship a signed tarball with the manifest, lockfile, and checksum manifest. Unsigned or mutated packages fail installation.
Ruzzler reviews the pinned version for scope discipline, evidence quality, and honest status reporting before it is listed as certified.
Manifest
The manifest is the review contract between you and Ruzzler. Scopes, auth, and outbound endpoints are declared up front — anything undeclared is refused at review time and blocked at runtime.
{
"name": "acme-support-desk",
"version": "1.4.0",
"display_name": "Acme Support Desk",
"scopes": ["requests:read", "receipts:read"],
"auth": {
"strategy": "oauth2",
"authorization_url": "https://acme.example/oauth/authorize",
"token_url": "https://acme.example/oauth/token"
},
"endpoints": ["api.acme.example"],
"evidence": { "attach_receipts": true }
}| Field | Required | Description |
|---|---|---|
| name | Required | Lowercase, hyphenated connector identifier shown in the directory. |
| version | Required | Semantic version; certification pins reviews to this exact value. |
| scopes | Required | Least-privilege list of Ruzzler resources the connector may read or write. |
| auth | Required | One declared authentication strategy — oauth2, api_key, or webhook_signature. |
| endpoints | Required | Declared outbound hosts; anything else is blocked at review and at runtime. |
| evidence | Optional | Opt in to attaching routing receipts and verification status to connector runs. |
Credentials are brokered and held by Ruzzler — never by your connector's client-side bundle.
The recommended strategy. Ruzzler brokers the authorization-code flow, stores refresh tokens encrypted, and rotates them automatically.
For services without OAuth. Keys are collected in the Ruzzler vault during installation and never returned to the browser after save.
For inbound events. Declare the signing algorithm and Ruzzler verifies every delivery before your connector code runs.
Testing
The SDK harness runs your connector against a sandbox tenant with fixed fixtures. Certification re-runs the same suite, so green locally means green in review.
npx ruzzler-connector test ✓ manifest parses and declares least-privilege scopes ✓ oauth2 strategy completes against the sandbox tenant ✓ outbound calls limited to declared endpoints ✓ receipt attachment matches rate-card version rc_2025-11 4 passed · sandbox tenant tnt_dev_01
Packaging & certification
Ship a signed tarball with the manifest and a checksum manifest. Certification pins the review to that exact version — a mutated package fails installation, and honest failure reporting is part of the review.
Start from the quickstart, then bring your service to the marketplace with evidence attached.