Integrations overview
exoCortex connects to the systems you already use: a business application opens tickets through the API, monitoring and security alerts become tickets, your identity provider creates users, your website hosts the support form.
Which integration you need
Section titled “Which integration you need”| You want to… | Use | Guide |
|---|---|---|
| Open and follow tickets from your own system | REST API v1 with an API key | API keys |
| Receive an event when a ticket changes | Outbound webhooks | Outbound webhooks |
| Turn monitoring, DevOps or security alerts into tickets | Inbound webhooks and connectors | Inbound webhooks |
| Synchronise tickets with another ITSM | Integration Center integrations | Inbound webhooks |
| Put a support form on your website | Widget | Widget |
| Create and deactivate users from your identity provider | SCIM 2.0 | SCIM provisioning |
| Import data from an existing system | Import Hub | Integration Hub and import |
For code examples and the reference for each endpoint, see the Developers section.
API address
Section titled “API address”All calls go to https://exocortex-api.ai-exo-cortex.com. Each integration works on a single tenant: the one of the key, token or connector you use.
Security
Section titled “Security”- Every credential is bound to a tenant and cannot see other tenants’ data.
- API keys, webhook secrets and SCIM tokens are shown only once, when you create them: keep them in a secrets manager.
- The events exoCortex sends you are signed, and so must be the ones you send: the signature includes a timestamp and also protects against replayed requests.
- Management functions (API keys, webhooks, SCIM tokens) require an administrator in exoCortex Core: you cannot manage other keys with an API key.
Stability
Section titled “Stability”The current version of the integration API is 1.1.0. Within /api/v1 we make only compatible changes: your client must ignore fields, events and error codes it does not know. A deprecated feature stays active for at least six months after the announcement. The features deprecated today stop working on 30 June 2027:
| Deprecated feature | What to use |
|---|---|
nh_… API keys |
nhk.<keyid>.<secret> keys |
X-NH-Signature signature on outbound webhooks |
X-Exo-Signature with X-Exo-Timestamp |
X-NH-Connector-Signature signature on inbound webhooks |
X-Exo-Signature with X-Exo-Timestamp |
event, timestamp, source fields in the webhook body |
type, created_at, data |