Integrations
Connectors where you can. A builder where you can’t.
Native connectors for the identity and workforce systems mid-market teams already run — Google Workspace, Microsoft Entra ID, Okta, Auth0, Active Directory — and the SaaS around them. For everything else — the internal tool your company actually built, the SaaS your vendor hasn’t heard of — an in-app connector builder you use directly in Owlie.
Configure the connection and add Functions for custom behavior, with AI assistance where useful.
In-app connector builder — entry screen
Full provisioning
Native provisioning connectors.
Sync plus write-back — create, update, disable, revoke, and grant Grants. Headlined by the identity and workforce core, because that’s where lifecycle governance lives: Google Workspace, Microsoft Entra ID, Okta, Auth0, and Active Directory.
Google Workspace
Users, groups, admin roles, org units, domains. Full lifecycle plus group and role grants.
Microsoft Entra ID
Users and groups. Full account lifecycle plus group-membership grants.
Okta
Users, groups, applications, roles. Full account lifecycle.
Auth0
Users, organizations, roles. Full lifecycle plus organization and role grants.
Active Directory
Users, groups, OUs, membership. Full lifecycle, password operations, and incremental sync — through the gateway.
Full provisioning reaches well past identity — Airtable, Asana, Box, Dropbox, Freshdesk, GitHub, HubSpot, Klaviyo, Lever, Linear, Microsoft OneDrive, Microsoft Teams, NetSuite, QuickBooks, Salesforce, SAP HANA, ServiceNow, Slack, Zendesk, Zoho CRM, Zoom all run the same create, update, disable, revoke, and Grant lifecycle.
Systems of record
The sources we read, not write.
We read from systems of record for the signals that drive identity and access. These connectors don’t write back. BambooHR and Workday anchor the workforce graph: who joined, who left, and, for BambooHR, who reports to whom. Alongside them we sync Calendly, Confluence, Jira, Marketo, Microsoft SharePoint, monday.com, Notion, OpenAI, Shopify, Stripe, Xero.
Sync connectors read source data; provisioning connectors also apply changes.
Protocol rails
Speak the standard your system already exposes.
When there’s no named connector, connect over the protocol your system already speaks and supply the mapping. Owlie ships the rails; you point them at your endpoint.
Generic SCIM
Any SCIM 2.0 endpoint, over HTTP or through the gateway. Four presets prefill the config: AWS IAM Identity Center, Databricks, Snowflake, and GitHub Enterprise Managed Users.
Generic LDAP
Any LDAP v3 directory. Configurable account and group schema, membership direction, and optional incremental sync. Runs through the gateway.
Generic SQL
Customer-authored SQL for account and Grant sync and provisioning. Named parameters only. Runs through the gateway.
Flat-file CSV
Drop a CSV. Each upload is one full authoritative snapshot — for the system that exposes no API at all.
The connector gateway
Reach what’s behind the firewall.
Active Directory, LDAP directories, on-prem SQL — plenty of the systems you need to govern never touch the public internet. The Owlie gateway is a small agent you run inside your own network. It executes those connectors locally and brokers each operation over a single outbound connection to Owlie’s edge, so provisioning and sync behave exactly as they do for cloud systems, with the same errors and retries, without opening an inbound port.
- Runs in your network.
- The agent executes connector logic and resolves secrets locally. Owlie’s control plane never sees them.
- Outbound only.
- Every connection originates from the agent. No inbound firewall rules, no exposed ports.
- Single-use enrollment.
- Create a gateway, get a one-time token, run setup. The agent generates its own key pair and authenticates by key after that; the token is consumed.
Connector gateway — enrollment token + live agent status
Admin creates a named gateway, runs the on-prem agent with a single-use token; dashboard shows PENDING → ACTIVE, last-seen, and announced connectors.
For everything else
Connectors you build in the product.
The builder is a web UI you use directly inside the admin dashboard. Configure the connection shape — OAuth 2.0, API key, bearer token, or basic and custom-header auth. Declare the entity schemas you want to sync. Map fields with the Owlie Expression Language. Fill in the behaviors that don’t fit a config field with a Function — a few lines of TypeScript, sandboxed, version-managed. AI assistance accelerates the parts that have public documentation.
- Config-first.
- Most of a typical connector is mapping and lifecycle rules.
- Functions where config ends.
- The behaviors that vary get written in TypeScript.
- AI-assisted where useful.
- Schema inference and handler scaffolding for systems with public docs.
- Versioned releases.
- Draft and edit. Publish to go live. Upgrade installed integrations when you’re ready.
Connector builder — mid-configuration (panels + OXL + Function snippet)
Go deeper.
Standards
SAML 2.0 and OIDC for SSO, SCIM for directory sync.
GraphQL API
A GraphQL API for every platform object.
Sync & import
Scheduled pulls, incremental where the source supports it, full-state reconciliation where it doesn’t.
Custom systems
The builder handles this. Request an integration for systems we haven’t shaped yet.
Connector coverage and validation.
Every native connector is versioned. Provisioning connectors run the create, update, disable, revoke, and grant lifecycle. Sync connectors read the systems of record that drive it. Contract and conformance tests run against each connector’s published API, and newer connectors are validated against a live vendor tenant as they land. Where we don’t ship native coverage, you can use the builder.
Explore the catalog or build a connector for your own systems.
Owlie is built for security-sensitive access work.
Connect the systems you run.
Sign up free and put the builder to work against a real integration. Don’t see the system you need? Tell us. We can help with the builder or add a native connector to the priority list.