This section covers how partners connect external systems to Neostella — integration users, permissions, and webhooks. Along the way, a hands-on activity and several worked API examples tie these concepts together.
1. Integration User
Integration users let external systems connect to Neostella securely, without relying on a real person's login. Before an external system can call the Neostella API, it needs its own identity — an integration user — along with the credentials (Client ID and Secret) used to authenticate.
This is typically the first thing you'll set up before building any integration.
- Go to: Control Center → Access → Users, then select the Integration User tab at the top.
- View existing integration users, or create a new one.
- Specify the scopes the integration user needs.
- Save to generate a Client ID and Client Secret.
- For an existing user, edit its scopes or generate new credentials as needed.
NOTE: Regenerating credentials immediately invalidates the old Client ID/Secret — anything still using them will stop working.
2. Permissions
An integration user has no access to anything until it's added to a permission set — creating the user alone does not grant access. (See Permission Sets in General Platform for general setup details.)
- Go to the relevant Permission Set.
- Select the Assignee tab.
- In the bottom-left section, assign the integration user to the permission set.
3. Scopes vs. Permission Sets
Integration users are controlled by two separate mechanisms. Here's what each one does:
Scope
- What it controls: Which specific resources or endpoints an integration user can reach.
- Where it applies: Within a single platform area, broken down into smaller pieces. Control Center, for instance, is made up of several distinct resources — Permissions, Groups, Admin, Schema, and more — each with its own scope.
- Example: A scope can grant an integration user access to the Schema resource in Control Center, without granting access to Permissions or Groups.
Permission Set
- What it controls: The actions an integration user can take — create, view, edit, delete.
- Where it applies: Across objects, modules, and contexts, the same way it works for regular users.
- Example: A permission set can grant an integration user Create and Edit access to the Projects object.
The distinction: scopes define which resources are reachable. Permission sets define what actions are available on them.
4. Webhooks
Webhooks allow Neostella to send real-time information to external systems when specific events or actions occur within the platform. Follow the steps below to configure a webhook:
- Go to: Control Center → Account → Webhooks. This opens the Event Catalog, showing the objects (projects, leads, emails, documents, etc.) and actions (created, updated, deleted) you can trigger a webhook from.
- Select the Endpoints tab to manage outbound webhooks.
- Add a new webhook by specifying the endpoint URL and the events that should trigger it.
- Retrieve the signing secret to validate payloads on the receiving end.
- View past delivery attempts for troubleshooting.
Note: A new endpoint is enabled immediately upon creation — there's no draft or staged state before it starts firing.
5. Get Bearer Token Example
WARNING:The examples in this section use Bruno to send API commands to Neostella, authenticated as an Integration User. You'll need Bruno (or a similar API client) installed to follow along.
This example walks through the Auth section of the API documentation to retrieve a bearer token.
- In Bruno, create a new HTTP request.
- Set the method to POST and the URL to https://api.neostella.app/v1/oauth2/token.
- No authorization is required for this request.
- In the Body tab, select raw / JSON, and enter your Client ID and Client Secret:
|
{ "client_id": "XXX", "client_secret": "XXX", "grant_type": "client_credentials" } |
- Send the request.
NOTE: A successful request returns a 200 response containing an access_token. Use this token to authorize all future API calls. The response also includes the token's expiration — by default, tokens expire every 60 minutes.
6. Get Project List through API Example
The examples in this section use Bruno to send API commands to Neostella, authenticated as an Integration User. You'll need Bruno (or a similar API client) installed to follow along.
This example walks through the "List projects (search, filter, pagination)" section of the API documentation.
- First, get an access token as shown in the previous example.
- In Bruno, create a new HTTP request.
- Set the method to POST and the URL to https://api.neostella.app/v1/projects/list.
- Go to the Authorization tab, select Bearer Token as the auth type, and enter the access token.
- In the Body tab, enter:
| {} |
- Send the request.
NOTE: A common error is a 403 Not Authorized to Perform response — if you see this, check that the integration user's permissions include access to Projects.
7. Upload Document through the API to S3
WARNING: The examples in this section use Bruno to send API commands to Neostella, authenticated as an Integration User. You'll need Bruno (or a similar API client) installed to follow along.
Document creation is a two-step process: first creating the document record, then uploading the file itself to the S3 location returned by that first call.
Step 1: Create the Document Record
- In Bruno, create a new HTTP request.
- Set the method to POST and the URL to https://api.neostella.app/v1/documents.
- Go to the Authorization tab, select Bearer Token, and enter the access token.
- In the Body tab, enter a request like:
|
{ "documents": [ { "description": "Test for partner explanation", "external_url": "https://documents.com", "file_size": "200 MB", "file_type": "docx", "instance_kind": "project", "is_external": false, "is_form": false, "name": "Test Doc.docx", "projects": ["1558feef-4007-4320-9567-15cfd31aab00"], "source": "user", "status": "active", "tags": [] } ] } |
- Send the request. A successful response includes a post_url object, similar to:
|
{ "documents": [ { "id": "...", "name": "Test Doc.docx", "post_url": { "url": "https://<bucket>.s3.amazonaws.com/", "fields": { "AWSAccessKeyId": "...", "key": "...", "policy": "...", "signature": "...", "x-amz-security-token": "..." } } } ] } |
NOTE: The values inside post_url.fields are required for the next step, and are generated specifically for this upload — they can't be reused for a different document.
Step 2: Upload the File to S3
- In Bruno, create a new HTTP request.
- Set the method to POST and the URL to the value returned in post_url.url (for example, https://neo-tenant-0fbf5c9d-2276-4d9f-b32c-ee64ee325991.s3.amazonaws.com/).
- Set the body type to multipart/form-data and add the following fields:
| Form Key | Type | Value |
|---|---|---|
| AWSAccessKeyId | Text | post_url.fields.AWSAccessKeyId |
| key | Text | post_url.fields.key |
| policy | Text | post_url.fields.policy |
| signature | Text | post_url.fields.signature |
| x-amz-security-token | Text | post_url.fields.x-amz-security-token |
| file | File | The document you want to upload |
NOTE: All text field values must be copied directly from the response of the first API call — they're generated specifically for that upload request and won't work for a different one.
Step 3: Verify the Upload
Once the upload completes successfully, navigate to the corresponding record in the Neostella UI and confirm the document was created and is available as expected.
8. How to use: Simple Integration
This section brings together many of the concepts covered earlier in this guide to show how they combine into a real integration. We'll walk through a Quick Guide of what's needed within Neostella to support an integration end to end.
The guide in this section uses Bruno to send API commands to Neostella, authenticated as an Integration User. You'll need Bruno (or a similar API client) installed to follow along.
The following json text is needed for a step inside Bruno:
|
json { "fields": { "portal_url": "https://clientportal.example.com/cases/98765" } |
In this scenario, an external client portal needs to stay in sync with new Projects (Cases) created in Neostella. Each time a Project is created, Neostella notifies the portal via webhook. The portal then calls back into Neostella to record its own URL for that case, so staff can jump straight to it in the portal from within Neostella.
Follow this tutorial to apply what you learned in this Quick Integration Guide:
Here's an interactive tutorial