Use this page when you (or an AI assistant helping you) need to change an existing Connected System safely — without guessing fields, skipping repair, or pasting secrets into the wrong place.
What this page is for
AI Fabrix integrations are JSON manifests (Connected System + Business Entities). You can edit them three ways:
| How you edit | Typical tool |
|---|---|
| Files on disk | Editor + Builder CLI (validate, repair, upload) |
| API / agent | Builder API (also available to agents as MCP tools) |
| UI after publish | Dataplane Connected Systems tabs (especially Authentication) |
This page is the shared safe loop for file and API editing. Humans and agents follow the same rules.
Not how to create your first system (Quickstart). Not Enterprise MCP for Role Assistants. Not vendor OAuth setup.
Prerequisites
- Developer workstation setup complete
aifabrix auth statussucceeds- An integration workspace exists (
integration/<systemKey>/), or you edit that system through Builder API - You know which Connected System and Business Entity you are changing
Where it lives
Manifest JSON lives in your integration folder. Builder CLI validates, repairs, tests, and uploads those files. Builder API edits the same workspace one section at a time (authentication, metadata, capabilities, and similar). After upload, live secrets finish in the dataplane Authentication UI.
Tab names ↔ section keys: UI terminology map.
How to set
Read the section → fill missing required inputs → change with a clear reason → repair → validate and test → upload → add secrets in Authentication UI
- Read first — open the section you will change (API: keep the section read token). Never patch blind.
- Ask when required inputs are missing — primary keys and entity types come from a person, not guesswork.
- Change with a clear reason — API patches record intent; use the same discipline in notes or commits when editing files.
- Repair derived sections — after metadata, capabilities, or exposure changes, run
aifabrix repair <systemKey>or named repair hooks. - Validate and test before upload — green schema and integration tests; upload is a separate decision.
- Upload configuration — not secrets — API keys go in Connected Systems → Authentication after upload.
- Re-check with live credentials — then certify when your scope is ready.
If you prefer CLI only
aifabrix validate <systemKey>
aifabrix repair <systemKey>
aifabrix test-integration <systemKey>
aifabrix upload <systemKey> --probe
That is the same loop. Builder API is for agents and automation — not a different product path.
Defaults and examples
Everyday example: add a field mapping → read the section → confirm the vendor field name with the integrator → patch with intent → repair → validate/test → upload → confirm Authentication secrets.
Example intent text when using Builder API (plain language — API wraps this in a patch body):
{
"sectionKey": "datasource.fieldMappings",
"intent": "Map vendor owner id to ownerId for Sales Manager visibility",
"mode": "merge"
}
Builder help topics (API / agents): start with overview and workflow, then section for the area you edit. Also useful: dependencyGraph, repairRules, goldenExample, connectedSystemUi, cipOverview.
Adoption checklist: GitHub integration golden path. Auth detail: Configure authentication.
After upload — Authentication UI
Do not put live vendor secrets in Builder API or workspace env files when UI auth is the path. Upload may pre-fill non-secret values (base URL, header name, token URL). A person opens Authentication, adds only required secrets, then re-runs tests. Agents can use help topic connectedSystemUi for the correct UI path.
Validate
aifabrix auth status
aifabrix validate <systemKey>
aifabrix repair <systemKey>
aifabrix test-integration <systemKey>
aifabrix upload <systemKey> --probe
Done looks like: validate green, repair after structural edits, upload probe OK, Authentication secrets saved.
Common mistakes
| Mistake | Fix |
|---|---|
| Editing without reading | Read (or GET) first |
| Inventing primary keys or entity types | Ask the system owner |
| Skipping repair | Run repair or named hooks |
| Treating upload as part of every patch | Upload is separate |
| Tokens in Builder API / env files | Authentication UI after upload |
| Confusing this with Role Assistant MCP | Runtime comes after certification |
Limits
Builder API does not register vendor apps (GitHub App, CRM private apps, and similar). Channel install and secret rotation stay outside this loop. Role Assistants activate only after certification — see From integrations to Role Assistant.