Practice

Building an Integration Inventory (and Why Most Teams Lack One)

Most engineering teams cannot list their integrations. An inventory is the prerequisite for ownership, monitoring and vendor leverage, and it takes less time to build than people expect.

The question most teams cannot answer

Ask an engineering team to list every integration they depend on. You will get the obvious ones: the payment provider, the CRM, the email service. You will not get the automation workflow someone built two years ago, the scheduled script running on a box nobody maintains, or the native connector enabled by a departed administrator.

Those are the ones that fail silently, because they are the ones nobody is watching.

What counts as an integration

Define it broadly or you will rebuild the inventory in six months:

• Outbound API calls to third-party services
• Inbound webhooks you receive
• Native connectors between SaaS products
• Automation platform workflows
• Scheduled imports and exports, including file transfers
• Internal service-to-service calls that cross a team boundary
• Anything authenticated with a credential that can expire

That last line is a useful shortcut: enumerating credentials finds integrations that enumerating code does not.

Nine fields

Resist a richer schema. An inventory that is burdensome stops being updated, and a stale inventory is worse than none because it is trusted.

1. Name and direction: what connects to what, and which way data flows.
2. Owner: a named person, not a team.
3. Criticality: what breaks for customers if it stops. Three levels is plenty.
4. Authentication: method, credential location, expiry and rotation behaviour.
5. Failure mode: does it fail loudly, silently, or partially? This single field determines whether existing monitoring would catch it.
6. Evidence location: where the logs, tickets and vendor correspondence live.
7. Recovery path: is there a replay or backfill mechanism, and what is its window?
8. Vendor contact: the support channel specified by contract, plus any account manager.
9. Last verified: the date someone confirmed this row is still true.

How to build it in a week

1. Enumerate credentials. Every API key, OAuth app and service account in your secret store, your identity provider and your major SaaS admin consoles. This finds more integrations than any other single method.
2. Enumerate outbound destinations. Egress logs or gateway records reveal external hosts you are calling, including ones nobody remembers.
3. Enumerate automation. Open each automation platform and SaaS admin console and list enabled connectors and workflows with their owners.
4. Interview. Ask support, finance and operations what they fix by hand. Each answer points at an integration, usually one that is not in any of the above.
5. Assign owners. The step that converts a document into a practice. An integration with no owner should be a decision to retire it or to adopt it, taken explicitly.

Keeping it alive

Two mechanisms work and the rest do not. Make inventory entry part of the definition of done for shipping an integration, and review the inventory as a recurring agenda item, quarterly is enough, with the only question being which rows have not been verified.

Once the inventory exists, the rest follows: ownership is assignable, the silent-failure backlog is visible, MTTR can be measured per integration, and vendor conversations can be grounded in which connections actually matter. It is also what makes automated correlation useful: Traxivo can tie signals to an integration far more reliably when the integration is something the organisation has named and owned.

A starter template

One row per integration, nine columns, in whatever tool the team will actually open:

• Name and direction, for example "Billing → CRM, outbound nightly".
• Owner, a person.
• Criticality, in three levels, defined by customer impact.
• Auth, method, credential location, expiry and rotation behaviour.
• Failure mode, loud, silent or partial.
• Evidence, where logs, tickets and correspondence live.
• Recovery, replay or backfill mechanism and its window.
• Vendor contact, the contractual channel.
• Last verified, a date.

Begin with credentials rather than with code. Enumerating every API key, OAuth application and service account across your secret store, identity provider and SaaS admin consoles finds more integrations than reading the codebase does, and it finds precisely the ones nobody remembers building.