Hybrid integration

Secure an On-Premises API

Keep the private API private. Use an outbound connector or customer-managed gateway to obtain configuration, receive bounded work, validate B5 trust context, invoke the internal API, and return evidence.

Working path

.NET API guideApply request signing, replay defense, authorization, and evidence.Open →Test ModeValidate connector behavior with isolated workloads.Open →Developer ToolsDownload clients and the promotion checklist.Open →Partner APIAdd delegated partner access without moving authority outside B5.Open →

Architecture controls

Outbound-only connectorNo unsolicited inbound access to the private network.Open →Workload identityDistinct identity for each connector deployment.Open →Execution contextProtected tenant, actor, subject, application, project, deployment, and evidence identity.Open →Store-and-forwardBounded encrypted queueing and replay-safe resumption during outages.Open →

Implementation steps

Create a dedicated application and deployment identity for each connector instance or cluster.

Establish outbound TLS to the approved B5 endpoint through the customer egress policy.

Use workload identity or rotated connector credentials held in the customer secret store.

Validate the protected execution context and replay state before invoking the internal API.

Return decision, correlation, latency, and evidence references without exporting unnecessary data.

Test disconnected operation, queue limits, credential revocation, failover, replay, and recovery.

Control details

Outbound

The connector initiates all network sessions. B5 does not require an inbound firewall opening to the private API.

Workload

Every connector deployment receives a bounded workload identity, environment, owner, key lifecycle, and revocation path.

Context

The connector accepts only a protected B5 execution context and must not reconstruct trust from unsigned local headers.

Queue

Queued work must be encrypted, bounded, expiration-aware, idempotent, and replay protected.

Hybrid connector

Keep the private API private

.NET worker registration

builder.Services.AddHttpClient("B5", client =>
{
    client.BaseAddress = new Uri(configuration["B5:BaseUrl"]!);
    client.Timeout = TimeSpan.FromSeconds(30);
});

// Connector initiates outbound TLS only.
// Validate the protected B5 execution context before invoking the private API.
// Queue work only with bounded size, expiry, encryption, idempotency, and replay defense.

C#.NET 10 quick startSDK-style .NET 10 project.Download ↓C#Request signerCanonical HMAC-SHA-256 request signing.Download ↓C#First protected callRunnable console client.Download ↓MDPromotion checklistSecurity, evidence, and release gates.Download ↓

B5 control plane← outbound TLS →Customer connector→Private API

No unsolicited inbound firewall opening.
One bounded workload identity per connector deployment.
Protected execution context for tenant, actor, subject, action, and evidence.
Encrypted, expiring, idempotent store-and-forward behavior.

Developer Relations

Talk to a human.

Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.

Contact Developer Relations Request a demo