Integrations

Accounting system of record — syncs customers, vendors, bills, invoices, projects & accounts, and posts WIP/true-up journal entries.

OAuth tokens stored encrypted in qbo_token (per org); sync cursors in sync_state.

Accounts Payable — bill intake, approval routing, and releasing payments. Being phased onto the native CC AP spine; only money-movement remains Bill.com-unique.

Session/OAuth tokens stored encrypted in billcom_connection (status + last sync tracked there).

Microsoft Teams message extension: right-click (⋯) any Teams message → Apps → 'Send to Task Tracker' → it lands in Admin → Task Tracker with the original text, sender, and a link back (the old Slack→Jira message-action pattern). Who can use it = Teams admin app assignment (Michael · Nadia · Devlin).

Endpoint /api/teams/bot (Bot Framework JWT validated dependency-free; tenant-pinned; v1 needs NO client secret). Setup: docs/teams-task-tracker/SETUP.md. AI-persona replies parked as Task 217a.

Least-privilege (Sites.Selected) file & Excel-workbook I/O — the live Master WIP / GM dashboard / budget / reforecast / billing workbooks. Per-site grants are managed below.

Site registry + read/write + per-site Azure grant is managed inline below (rolled in from the old SharePoint page). Live status = at least one granted site; use each site's Verify for per-site checks.

Watches the jobs@ mailbox (application permissions) to auto-ingest customer work-order emails, and powers the Admin → Mailbox test reader.

Separate Entra app from SharePoint (Mail.Read scope). Webhook signature via GRAPH_WEBHOOK_SECRET.

Reads M365 subscribed SKUs & user license assignments for the Admin → Licensing dashboards.

Payroll + Time & Labor. NextGen API manages JOB CODES (Admin → Paylocity: add/push, deactivate finished jobs so no more time books to them, fix descriptions, migrate wrong codes) — keeping the time-clock job list current as projects open/close each month.

Prod company 359408 · sandbox VALIAPI1 (dc1demogwext). Job codes are immutable (rename = create+deactivate); PUT is full-replacement (client does read-merge-write). T&L cost centers are API-read-only — Omari question open on job-code↔cost-center mirroring. WebLink creds parked (employee/HR endpoints).

Payroll time & attendance — pulls timecards/punches and writes back edits via the TimeWorksPlus REST API. Temporary bridge until Paylocity.

Gated by swipeclockConfigured(). Live status = timecard punches synced. Legacy Playwright/WorkforceHub bridge kept dormant as fallback.

Clearspan's Salesforce RouteTracker — live invoice Approval Status / payment Status / Chatter into AR Watch via Maria's session-riding bookmarklet (Task 203a). Server-to-server Salesforce API access is the nice-to-have, blocked on Clearspan IT.

Bookmarklet install one-liner: lib/routetracker/bookmarklet.install.txt. The token is a shared bearer secret scoped to POST /api/ar/routetracker-ingest only (upserts tracked Clearspan invoices; nothing else).

Field WBS + production reporting — work packages/orders/items, production reports, labor pricing, and invoice tie-out. Short-term front-end; eventually replaced.

Bearer-token REST API. Write-back (VITRUVI_WRITE_ENABLED) gates WBS create/edit. Live status = the field system data mirrored locally.

Clearspan field-service / dispatch data (work orders, technician assignment). Scraped/pulled for the Intake → Clearspan pipeline.

Gated by isRouteTrackerConfigured() (instance URL + client id + secret).

Corporate-card (Amex) expense feed + receipts via the Expensify Integration Server — workspace/policy list and combined report export.

partnerUserID/Secret ride every request (no session step). Probe = read-only policyList.

Fleet telematics / GPS — vehicle & asset live location for the Asset Management map and Safety.

Gated by samsaraConfigured(). Live status = authenticated Samsara API ping (samsaraPing).

Vehicle & equipment asset register (system of record) — synced into the Asset Mgmt asset roster.

Safety & compliance forms — incident/concern responses tied to job-closure compliance.

Gated by kpaConfigured(). Live status = authenticated KPA account.info call.

LLM for email/PDF parsing (Intake), variance commentary, recruitment scoring, and other AI-assisted reads across the platform.

Live status = API key authenticated against the Anthropic models endpoint (no token cost).

Primary database (Drizzle), platform Auth/SSO identity, and file storage (receipts). The app cannot run without it.

Several pillars use their own Supabase project (intake/asset-mgmt/recruitment/safety) in addition to the main DB.

Background job queue — async QBO/Bill.com sync, expense approvals, per-diem, and scheduled crons.

Served at /api/inngest. Keys are managed in the Inngest dashboard / Vercel; no required app env var.

Transactional email — approval/rejection notices, AP/AR alerts, per-diem reminders.

Off-loads heavy Intake document/PDF processing to a separate worker service.

No-ops when unset (local dev); fire-and-forget async hand-off.

Source/commit history for the Admin → Changelog, plus dispatch hooks for async payroll pulls.

Optional — the Changelog degrades gracefully without it.

Hosting/CI-CD — every push to main deploys prod. Deploy history feeds the Admin → Changelog.

Runtime platform; the deploy-history API is optional (token-gated, degrades gracefully).