What you are building

The same review-and-approve pipeline you already have in front of a database, put in front of an outbound API call. Somebody composes a request against a registered API, AccessFlow scores it, a reviewer approves it, and only then does the call go out — with the response masked according to policy and the whole thing recorded.

This is useful wherever a third-party or internal API is as sensitive as a database: payment providers, HR systems, customer-support tooling, anything that will happily action a request from whoever holds the token.

What can AccessFlow govern besides SQL?

Outbound REST, SOAP, GraphQL and gRPC calls. You register the API once as a connector, load its schema so AccessFlow knows its operations, and grant people access to it the same way you grant access to a datasource.

You need the connector-manage permission, which admins hold. Work through your first governed query first if you have not — the review machinery is shared, and this guide assumes you have met it.

1. Register the API

Sidebar → API Connectors → New connector. Give it a name, choose the Protocol — REST, SOAP, GraphQL or gRPC — and set the Base URL.

Then Auth method. AccessFlow holds the credential so callers never do, which is much of the point: people get to make governed calls without ever holding the token themselves.

Only OAuth 2.0 client credentials can be entered in the form today. Picking OAuth2 Client Credentials reveals the fields you would expect — token endpoint, grant type, client authentication, client id and secret, scopes, audience. The other secret-bearing methods (API key, bearer token, basic, custom header) are supported by the engine but the settings screen does not render an input for their secret, so it has to be supplied through the connector REST API. Choose OAuth 2.0 where your API offers it.

mTLS is selectable but not yet wired. Choosing it does not attach a client certificate — the call goes out without one and a warning is logged. Do not rely on it as an authentication method.

Default headers are merged into every governed call, which is a tidy place for a version header or a tenant id. Timeout and Max response bytes bound what a single call can cost you.

Use Test connection before going further. It checks the API is reachable and, for OAuth 2.0 connectors, that a token can actually be fetched — which is where a wrong client secret shows up.

2. Load its schema

A connector without a schema can still be called free-form, but loading one is what makes the rest work: an operation catalog to grant against, read/write classification, better AI analysis, and plain-English request drafting.

On the Schema tab, supply it one of three ways — Paste, Upload file, or From URL, which AccessFlow fetches server-side. Five formats are understood: OpenAPI, WSDL, GraphQL SDL, gRPC proto, and a Postman Collection export. Files are capped at 5 MB.

Large APIs import better with an Import filter: exclude paths, keep only certain paths, drop verbs, operation ids or tags, and skip deprecated operations. The Preview tells you how many of the total operations survive before you commit to the import.

The parsed result lands on the Operations tab, one row per operation with its verb, path, and whether AccessFlow classified it as a Read or a Write. That classification drives review: a connector can require review for writes but not reads, exactly as a datasource can.

Postman collections are examples, not schemas. AccessFlow will infer operations from one, and says so on screen, but the result is only as complete as the requests somebody happened to save. Any credentials in the export are ignored. Prefer a real OpenAPI document where one exists.

3. Grant access

On the Permissions tab, grant to a user or a group. The fields are deliberately close to a datasource grant:

Read and Write — matched against each operation's classification.
Allowed operations — leave empty for all of them, or name a subset. This is the tightest and most useful control on the form.
Masked response fields — dot-paths masked for this person specifically, on top of any connector-wide masking.
Expires — as with datasources, access that removes itself.
Break-glass and Override variables — leave both off unless somebody has a concrete need.

Without a grant, a connector simply does not appear in the editor. That is the intended behaviour, and the editor says so rather than showing an empty dropdown.

4. Mask what comes back

Governing the request is only half of it — the response is where the sensitive data actually is. The Masking tab defines policies over response fields, applied before the response is stored.

Each policy matches a field one of four ways:

Schema field — by name, against the loaded schema.
JSON path — for JSON responses, e.g. data.ssn.
XML path (XPath) — for SOAP.
Regex — the fallback when structure does not help.

Then a strategy: full mask, partial with a visible suffix, SHA-256 hash, email-preserving, or format-preserving. A Reveal to list names the roles, groups or people who see the real value; leave it empty and it is masked for everyone.

The Classification tab is the shortcut worth knowing about. Tag response fields as PII, PCI, PHI, GDPR, Financial or Sensitive, switch on Auto-apply masking, and AccessFlow derives sensible policies for you — partial masking for PII, GDPR and financial data, full masking for card and health data, hashing for anything merely sensitive. The same tags raise the AI risk score for calls that touch those operations, so a reviewer sees the stakes without having to know the schema.

5. Make a governed call

Sidebar → API Editor. Pick the connector, then either choose an operation from the catalog or compose a free-form call. Fill in query parameters, headers and a body across the tabs; connector default headers are shown read-only so you can see what will be sent alongside yours.

Add a Justification, optionally use Analyze risk to see the AI verdict before committing, and Submit for review. You land on the request's own page and can follow it from there.

Text-to-API. With a schema loaded and the feature switched on for the connector, you can describe the call in plain English and have AccessFlow draft it. It produces a draft you review and edit — it does not submit anything, and the draft goes through exactly the same approval path as one you typed yourself.

Reviewers work the queue at API Reviews, with the same approve and reject controls as queries, and the same rule that nobody decides their own request. Approved calls execute and the response — masked — appears on the request page. Everyone's own requests are listed under API Requests.

Worth knowing

Scheduled calls work as they do for queries: set a time and the call runs after approval rather than immediately.
Break-glass for API calls exists in the engine and is gated on a per-connector grant, but there is no button for it in the editor — it can only be exercised through the REST API today. Executions still land in the break-glass log for retrospective review.
Request and response size caps are configurable with ACCESSFLOW_APIGOV_MAX_REQUEST_BODY_BYTES and ACCESSFLOW_APIGOV_MAX_RESPONSE_BYTES; review timeout with ACCESSFLOW_APIGOV_REVIEW_TIMEOUT.
Chaining a call to a query — grouped requests bundle ordered members into one approval. Note there is no distributed rollback: if a later member fails, the earlier ones have already happened.

Connector fields, schema parsing detail and the full masking reference: API connectors.