Features
Integrations
Integration is where security models are quietly abandoned. The interface enforces permissions beautifully, and then a shared admin key sits in a CI variable with more access than anyone in the building. This page is mostly about how Rydya avoids that, because the rest is unremarkable and should be.
- Hospital operations
- Quality and compliance
- Clinical engineering
What is the integration platform?
Definition
The Rydya integration platform
The integration platform is the set of ways other systems exchange data with Rydya: signed outbound webhooks for events, a small authenticated read surface reachable by scoped service accounts, and structured imports across seven registers, each subject to the same permission and isolation rules as a human user.
The clause that matters is the last one. An integration is an identity, and an identity that skips the permission model is not an integration, it is a hole with documentation. Every rule that applies to a person, server-side checks, row level security, organisation isolation, audit, applies identically to a machine.
The corollary is worth stating plainly: an integration should be able to do less than a person, not more. In practice it is often the other way round, because machine access is usually built in a hurry for one urgent use case and then never narrowed.
Why integrations become the weak point
Because they are built once under time pressure, scoped generously to avoid a second conversation, and then never revisited by anyone who remembers what they can do.
The story is always the same. A system needs data. An admin key is minted because scoping it properly requires a discussion nobody has time for. It works. It goes into a CI variable, then into a second one, then into a runbook. Three years later it is in four places, nobody knows what would break if it were rotated, and it can do everything.
The second pattern is the silent failure. A webhook stops delivering. Nothing announces it, because the receiving system is not ours and the sending system considers its job done at the point of sending. Everyone believes the integration is running. It stopped in March.
The third is the import that rewrites history. A nightly file lands and overwrites records, including fields that are supposed to be authoritative on the server: status, quarantine, approvals, return to service. The integration has quietly become a way to bypass every gate in the product, and it was built by someone who was only trying to keep two systems in step.
How Rydya handles machine access
Scoped identities, signed and retried delivery, honest reporting, and imports that cannot bypass a gate.
Service accounts, not shared admin keys
A scoped credential with its own location scope and rate limits, revocable independently of any human account. It can do less than a person, and what it can do is visible rather than folklore.
Webhooks are signed
HMAC signed, so a receiver can establish that a payload came from us and was not altered. An unsigned webhook endpoint is an open door that anybody who learns the URL can post to.
Delivery retries, then dead-letters visibly
Failures retry with backoff and then land in a visible failed-deliveries queue that can be replayed. A webhook that silently stopped in March is the failure mode this exists to prevent.
Secrets are shown once and then redacted
Never displayed again, anywhere, including to our own platform console. If it is lost, it is rotated rather than retrieved, which is the only version of secret handling that is actually true.
Imports cannot override server-authoritative fields
Status, quarantine, approvals, return to service, assignment and final cost are decided on the server. An import is not a route around a safety gate, and this is enforced rather than documented.
How events reach your systems
From the same outbox that drives everything else, so a webhook cannot describe something that did not happen.
Events are written to an outbox in the same transaction as the change they describe, and the worker relays them. This ordering is the reason a Rydya webhook can be trusted as a fact rather than as a report: there is no path where the change commits and the event is lost, and no path where the event fires for a change that rolled back.
What you receive is scoped exactly as the subscribing identity is scoped. A webhook subscription is not a way to receive events about parts of the organisation the service account cannot see, which sounds obvious and is the thing that is most often wrong in this category.
What is built, what is not, and what is planned
The honest state of every channel, including the ones that are not there yet. Read this before assuming a name on a list means a working connection.
| Surface | Status today | What that means for you |
|---|---|---|
| Outbound webhooks | Built | HMAC signed, retried, dead-lettered and replayable. Use these today. |
| Service accounts | Built | Scoped credentials with rate limits and revocation, for authenticated reads. |
| Imports, 7 registers | Built | Validate, approve, commit, with column allowlisting. |
| In-app notifications | Built | Delivered to the Inbox and the bell. |
| Read API surface | Two endpoints | Assets and identity only. There is no broad public API and no OpenAPI document. |
| Email, SMS, push | Foundation only | A provider is configurable and nothing is dispatched yet. Do not rely on these. |
| Slack, Microsoft Teams, WhatsApp | Planned, not built | On the roadmap. No adapter exists, so none of these can carry an alert today. |
| EHR, ERP and CMMS connectors | Not planned yet | Build against the webhooks and the read surface instead. |
Integration surfaces by actual status
Why the roadmap is on the page rather than in a sales conversation
Slack, Microsoft Teams and WhatsApp are intended and are not built, and we would rather you read that here than infer availability from a logo. The delay is not engineering: choosing a messaging provider carries data-protection consequences for a healthcare organisation, and that decision is open rather than quietly assumed. When one of these ships, this table changes and the claim will be that it works, because by then it will.
Delivery reporting says what happened, not what we hoped
Delivered, retried, failed and dead-lettered are distinct and reported as such. A green tick that actually means "we attempted a request" is a small dishonesty that costs all its credibility the first time somebody checks, and integrations are exactly the area where somebody eventually checks.
Questions
Do integrations bypass the permission model?
No, and this is the most important thing on the page. A service account is an identity subject to the same server-side permission checks, row level security and organisation isolation as a person, with its own location scope and rate limits. An integration should be able to do less than a person, not more, and it is revocable without touching any human account.
What happens when a webhook delivery fails?
It retries with backoff, and then lands in a visible failed-deliveries queue that you can replay. It does not disappear. A webhook that quietly stopped delivering in March while everyone assumed the integration was running is the exact failure this is built to prevent.
Can an import change a quarantine or a return-to-service status?
No. Status, quarantine, approvals, return to service, assignment and final cost are server authoritative, and an import cannot override them. Otherwise a nightly file becomes a route around every safety gate in the product, built by somebody who was only trying to keep two systems in step.
Do you integrate with Slack, Microsoft Teams or WhatsApp?
Not yet. All three are on the roadmap and none is built, so none of them can carry an alert today. The delay is not engineering effort: choosing a messaging provider has data-protection consequences for a healthcare organisation, and that decision is open rather than quietly assumed. In-app notification is the channel that works now, and webhooks will reach anything that accepts one.
Can we retrieve an API secret we have lost?
No. Secrets are shown once and redacted thereafter, everywhere, including from our own platform console. If it is lost it is rotated rather than recovered. That is inconvenient exactly once, and it is the only version of secret handling that is honestly true rather than merely claimed.
See it on your equipment
Live in an afternoon, useful the same week. A person replies, usually within one working day.
Contact us