Workspace Integrations

Open Workspace → Integrations for the Workspace integration catalog. Google Workspace email, sending domains, and SMTP / IMAP accounts are configured under Workspace → Email; personal Google Calendar connections remain in account settings.

What is here

• Entry points and status for Google Workspace email and SMTP / IMAP accounts
• Bank-account integrations with consent status and renewal actions
• Public API access and API keys
• Payment-provider integrations
• GitHub integration

Bank accounts

• Connected bank accounts show their provider status, linked accounts, last sync, consent expiry, and any stored provider error.
• Connections whose consent has expired or expires within seven days are counted on the Integrations tab and show attention on the bank connection card.
• Use Renew consent to re-authorize an existing connection without losing imported transactions or matches.
• Bank sync errors are stored on the connection immediately. A sync-failed notification is sent only after three consecutive failed sync runs.
• When a provider returns changed account IDs, Einblick reuses matching account rows by IBAN where possible. Accounts no longer returned by the provider are marked inactive instead of deleted.
• Manual bank accounts created from Bank Transactions appear as Manual import connections. They do not use consent renewal and are skipped by provider sync.
• Pending, error, expired, and soon-expiring connections can be retried from the same card. Revoked connections can be deleted.

Public API

• Open Workspace → API when the API feature is enabled for the Workspace.
• API settings follow the api role permission. read controls access to keys, external sites, and the Workspaces and key names shown in the interactive API reference. use allows a signed-in user to test an existing key through a temporary docs credential. create, update, and delete control the matching key and external-site changes.
• For resource reads, API keys can access only the selected CMS collections and supported native endpoints. The current native collection endpoints are buildings, events, festivals, jobs, and products.
• For every endpoint, choose readable fields and optional server-side filters. Filter-only fields can still stay available without being returned in the payload.
• For standard resource writes, grant create, update, and delete per resource. CMS resources support all three actions. Native resource writes currently support buildings, events, and festivals; jobs and products are read-only through the standard resource API.
• Create and update requests accept only fields selected as writable for that resource. CMS writes use /api/v1/cms/{slug}, native writes use /api/v1/{slug}, and update or delete calls add the record identifier to the path. Native deletes archive the building, event, or festival; CMS deletes remove the CMS record.
• When an admin adds a readable field to a CMS collection, Einblick can offer to add that field to active API keys that already read the collection. Revoked or expired keys and keys without a matching collection grant are skipped.
• Resources with a status field default to status = published; jobs and events also default to visibility = public. If a key should expose another status or visibility, add an explicit filter for that endpoint.
• Event resource fields include event metadata plus computed start, end, allDay, relation summaries, cover image data, and slot data based on the event's slots.
• Event payloads expose eventType as an object with id, stable key, reader-facing label, and icon. Integrations should use the type key instead of relying on the former category value.
• Raw API tokens are shown only once after creation. Clients authenticate with Authorization: Bearer api_....
• Open API reference starts a secure sign-in handoff and preselects the current Workspace. Test as API key loads an active key's current grants through a docs-only credential without retrieving or revealing the permanent token. The docs sign-in lasts 30 minutes; a test credential normally lasts 10 minutes and is revoked when it is replaced, cleared, or the page is left.
• Read-only test credentials can run requests immediately. For a key with resource or command writes, the reference loads its schema first and requires a separate confirmation before enabling requests that can change real Workspace data. Successful delegated writes are attributed to the signed-in user.
• Enter key manually remains available without an Einblick sign-in. Use it when you need to test the literal permanent key and its configured browser-origin allowlist; delegated testing uses the trusted docs origin instead.
• Each key can optionally allow only specific browser origins. Requests from other browser origins fail CORS, while server-to-server calls without an Origin header still work.
• Public commands are separate from resource writes. Granted commands are callable at /api/v1/commands/{name}, discoverable at /api/v1/commands/schema, and currently cover public job application commands, newsletter signup, and trusted external sync commands.
• Resource writes and public commands accept an optional Idempotency-Key header up to 200 characters. Reusing the same key for the same route and payload returns the stored result; reusing it with a different payload returns a conflict.
• The page links to the per-key schema at /api/v1/schema, /api/v1/openapi, and /api/v1/openapi.json and includes install commands for @einblick/sdk. The OpenAPI document exposes separate writable-attribute schemas for create and update requests, so updates only need the fields being changed.
• Collection endpoints support limit, cursor, and sort. Use comma-separated field keys and prefix a field with - for descending order. Without an explicit sort, CMS collections follow the manual record order stored in Einblick, and each record exposes that value as sort in record meta.
• Collection, singleton, and record reads accept sparse fieldsets such as fields=title,thumbnail. Only those readable attributes are projected. An unknown field or a field that the key cannot read returns a 400 response instead of being silently omitted.
• For localized native resources, locale can contain one language tag or an ordered, Accept-Language-style preference list. Built-in and translatable custom text fields resolve through that preference, then the Workspace content language and the record's source language. Without locale, reads keep the stored source values.
• Readable CMS relation fields can be expanded with include. Related records are returned in included and only work when the same key also has access to the related collection.
• CMS richtext fields are returned as structured document JSON. Asset payloads include stable URLs, optional width, height, title, copyright, description, tags, and sort for ordered multi-file fields. When a CMS video has a generated web playback variant, the public asset URL serves that browser-compatible MP4 or WebM file instead of the original upload.
• Image asset URLs accept w, h, q, fit, and fmt transformations. Requested values are honored within the delivery limits rather than rounded to a fixed size ladder; see Einblick SDK In-Page Editing for the supported modes, formats, limits, and SDK helpers.
• CMS media fields can enforce upload constraints. Image fields accept images, while file and files fields can set accepted MIME patterns and a max size; generic CMS file fields default to 500 MB and cannot exceed the normal 5 GB per-file limit for signed-in uploads.
• Browser-origin requests for non-transformed asset URLs are proxied with CORS headers and range support. Server-to-server calls without an Origin header can follow short-lived storage redirects instead.
• The same page also manages External Sites for live in-page editing. Each site stores allowed origins, the publishable site key, and an optional relative revalidation path for host caches.
• External-site editing is authorized by the signed-in editor's normal Workspace role permissions, not by API-key resource grants. Keep secret API keys server-side for public API reads and code generation.
• When revalidation is configured, CMS content changes post to the site's revalidation path on every allowed origin. The default path is /api/einblick/revalidate; an optional shared secret is sent as x-einblick-revalidate-secret.
• See Einblick SDK In-Page Editing for framework support and host-cache revalidation guidance.

Payment providers

• Stripe payment connections are managed from the payment-provider area on this page. A connected Stripe account can accept payments and refunds when Stripe reports those capabilities.
• Connected Stripe accounts are also picked up by the hourly accounting sync. Einblick imports Stripe balance transactions and payouts, links payment-session references when possible, and creates journal entries through the Stripe clearing and payment-processor-fee accounts.
• The first accounting sync looks back up to 90 days. Later syncs overlap the previous successful run by two days so late Stripe updates can be refreshed.

Email accounts and mail

• Connect one or more Google Workspace accounts under Workspace → Email → Google Workspace. Each connection exposes separate Gmail sending and incoming-mail capabilities, can be made the default sender, and shows reauthorization or sync errors independently.
• Disconnect revokes Gmail access, disables the sender, and pauses incoming-mail sync while keeping the connection available to reconnect later. Once disconnected, Delete removes the connection from the Workspace permanently; previously sent and imported messages remain available.
• Under Sending domains, add a domain, copy its DNS records, and check verification. Only verified domains can create sender identities; each identity has its own address, sender name, optional Reply-To, and signature, and is disabled automatically if the domain is no longer verified.
• The managed Workspace sender requires a usable Reply-To address. When the issuer organization has a suitable email address, an admin can adopt it here and complete confirmation before using the fallback sender.
• Where these addresses are used shows the current sender for event reservation and timesheet emails, warns when a configured identity is unavailable, and links to the setting that owns each choice. An unset choice falls back to the managed address. Newsletters, invoices, quotes, and payment reminders choose their sender when they are sent, so they have no persistent selection in this overview.
• To connect a provider with server credentials, use Workspace → Email → SMTP / IMAP accounts. Choose an iCloud, Gmail (IMAP), or Outlook.com preset, or Custom; presets fill the server, port, and security settings while SMTP sending and IMAP receiving remain independently configurable and testable.
• iCloud and Gmail require an app-specific password. iCloud server addresses are managed by Einblick, and a saved connection keeps its provider choice when edited.
• Mail separates captured messages into Inbox and queued outgoing messages into Sent. Start a message from the compose button or press C while focus is outside an input.
• The composer supports To, Cc, Bcc, a required subject, formatted content, and files added with the picker, drag and drop, or paste. The From picker can include verified-domain identities, Google Workspace mailboxes, SMTP accounts, and the managed Workspace sender when configured. Press Cmd/Ctrl + Enter to send.
• The queued-delivery path accepts up to 200 recipients and 25 attachments totaling 25 MB. After queueing, Sent shows the recipients, sender, attachments, message body, and delivery state. The detail view can switch between text and rendered HTML.
• Delivery states distinguish queued, sending, provider-accepted, delivered, bounced, spam complaints, suppressed, retrying, failed, cancelled, and acceptance unknown. Suppressed means the provider refused delivery because the recipient is on its suppression list. Temporary failures are retried automatically, with up to three attempts for composer messages. A later provider event can replace an accepted or delivered state with Bounced, Spam complaint, or Suppressed.
• Acceptance unknown means the provider request may have succeeded even though Einblick did not receive confirmation. A later provider event can resolve it automatically. Otherwise, open the message under Sent: Confirm sent applies any linked invoice or offer update, Retry exact email resends the same sender, recipients, content, and attachments after warning about duplicate risk, and Abandon delivery leaves a linked document unsent and editable. Use these actions only after checking the provider's Sent folder or delivery logs.
• Queueing an outgoing message, changing the default sender, adding, updating, or removing an SMTP / IMAP account, deleting a disconnected Google Workspace connection, and a Google sender connection requiring reauthorization are recorded in Workspace activity.
• Gmail and IMAP inbox sources can scan incoming mail for invoices, tasks, inquiries, and purchase tracking. Each scanner is enabled separately; its AI analysis option is available only while that scanner is enabled.
• When AI analysis is enabled, relevant message content and attachments are sent to OpenRouter and the selected model providers. With AI analysis disabled, mail content is not sent to model providers.
• For Gmail, select at least one label, choose whether the first import starts now, at a date, or across all available mail, and set a sync cadence from 5 minutes to 24 hours. The connection card also provides Sync now, pause/resume, next-sync, and error status.
• In Mail, the account picker filters Inbox and Sent to one source. Sync refreshes the selected inbox source, or all sources when no account is selected.
• IMAP sync reads messages without marking them as read in the upstream mailbox.
• IMAP sync errors are stored on the account immediately. An email-sync-failed notification is sent only after three consecutive failed sync runs.
• Shipment tracking detection creates or updates internal shipment records from order confirmations, shipment notices, delivery updates, and tracking messages. Detected messages remain linked in Mail and appear in Shipment Tracking.
• When DMARC monitors are attached to an IMAP-enabled account, the sync also detects matching DMARC aggregate-report attachments for active monitor domains. Those XML, ZIP, or GZIP report files are stored in the protected DMARC Reports system folder and ingested by the DMARC Report Analyzer instead of being treated as normal mail attachments.
• Every captured message remains visible in Mail, where staff can inspect attachments, message text, and created records.
• Mail loads longer inboxes as you scroll and searches subject, sender, recipients, and preview text. You can filter by mailbox; the inbox can also filter to messages with attachments.
• Auto-created inquiries require Workspace defaults for issuer organization and currency. If those are missing, the email is still tracked but inquiry creation is blocked.
• Einblick-origin system emails from @einblick.xyz are suppressed by the intake detector so automated notifications do not create new invoices, tasks, inquiries, or shipment-tracking records.

Personal calendar sync

Google Calendar sync for tasks and event slots is personal, not Workspace-wide. Each user connects accounts, selects calendars and Workspaces, and chooses task or event sync in My Connections.

Related docs: Events, Jobs, My Connections, Workspace Settings