Community Edition connection slots
Community Edition 0.2.0 allows two saved, unarchived source connections per registry across all connector types. Paused connections still count. This limit applies to the self-hosted Community Edition, not the hosted setup described elsewhere.
To replace a source, an owner chooses Archive connection in Connected registries. The source stops reading and frees its slot; imported records and history remain. Restore connection uses a free slot and leaves the connection paused. Manual records and CSV imports do not use source slots.
1. Prepare source access
Use an account you are authorized to access. Read connector coverage for the supported endpoint, account scope and validation status. Obtain the provider’s read permissions for the intended workspace, project, region or schema.
Hosted connections use credentials entered in CatProof. An AWS profile on your laptop is not available to the hosted service. Prefer temporary provider credentials and include the session token when one is issued.
2. Configure the connection
Open Connectors, select the source and choose Configure connector. Enter a descriptive connection name, the provider origin and the required scope. Use the Authentication fields to enter credentials directly in the app. Registry owner access is required to save or replace credentials.
For an A2A Agent Card, enter the operator-supplied HTTPS origin and put the card path in its separate field. The default card path is /.well-known/agent-card.json. One connection reads one supplied card. Public-card authentication and agent runtime authentication can differ.
3. Preview before import
Choose Save & preview. Preview reads the configured source without changing imported inventory, source health or sync history. It displays up to 50 agent records and 20 related assets with full counts. Check names, source IDs and scope against the provider’s own view.
Check setup is an offline configuration check. It confirms required fields and credential presence; it does not prove provider authorization. A successful source read is the access check.
4. Import and inspect
Choose Import latest inventory. This performs a new read and refreshes the whole connection, so results can differ from the preview. Records absent from the latest successful read become not observed; they are not deleted. Tools, applications and directory identities remain related assets rather than automatically becoming agents.
Open a record to inspect source identity, provenance and observation time. Assign the business owner separately. Use Refresh connections or a saved connection’s sync action for later reads.
5. Maintain credentials
Use Update credentials on the saved connection to replace the complete credential set. Provider OAuth access tokens are accepted where supported, but OAuth sign-in and automatic token renewal are not implemented. Replace expired tokens in the connection.
Remove saved credentials & pause connection pauses discovery and retains previous evidence. It also blocks fallback to older operator-configured credentials for that connection. Revoke the credential at the provider to invalidate it outside CatProof.
Saved credentials are encrypted in PostgreSQL, bound to the registry and connection, and omitted from inventory and exports. They are decrypted in server memory to read the provider. This is application-managed encryption, not zero-knowledge storage.
Troubleshooting
- 401 or 403
- Check credential expiry, provider read permissions and visibility in the configured scope. Saving a credential alone does not establish access.
- Zero records
- Compare the same account, role and scope in the provider. A successful empty read means no visible records in that scope.
- Failed or paused connection
- Previous observations remain available as stale evidence. Fix access and sync again. A failed read does not silently substitute demo records.
- Redirect or endpoint rejected
- Configure the final authorized HTTPS endpoint. Hosted provider reads reject private-address destinations and do not follow redirects.
- Unexpected duplicate
- Review original source IDs and connection names. Explicitly link identities only when evidence establishes the same business agent.
Reviewed against the current product source on October 29, 2026. Provider access must be verified in your authorized account.