Connections Overview
Connect Horizon to your business tools — authorize an integration, read its status, and repair or remove it.
Connections are the bridges between Horizon and your external business tools. They let agents read data from, write data to, and take actions in third-party platforms.
How Connections Work
Most connections use OAuth 2.0 to authorize Horizon to act on behalf of your organization. When you set one up you are redirected to the provider’s login page, where you grant Horizon the permissions it asks for. Horizon stores the resulting access and refresh tokens encrypted, and renews them on demand — a token is refreshed the next time it is needed, not on a schedule.
Some integrations use credential-based authentication instead, where you enter the provider’s own fields directly in Horizon. Sage Intacct is one: it asks for a sender ID, sender password, Web Services user ID, Web Services user password, and company ID.
Horizon never stores your third-party credentials in plaintext. They are encrypted at rest with AES-256-GCM and transmitted over TLS.
Available Integrations
Your organization may see additional services in the connect list that do not yet have a guide here. The list is built from the services enabled for your environment, so it is the authority on what you can connect — not this page.
Connection Status
A connection card shows its status as a badge. These are the values it can hold:
| Status | Meaning |
|---|---|
active | The connection is working. |
expired | The access token expired and could not be refreshed. |
requires_reconnection | Authorization is no longer usable and must be granted again. |
revoked | Access was withdrawn, usually from the provider’s side. |
error | The last attempt to use the connection failed. |
inactive | The connection exists but is not in use. |
The badge shows these values literally, in lowercase, exactly as written above — Horizon does not translate them into friendlier labels.
Setting Up a New Connection
- Navigate to Workspace > Connections.
- Click Connect Service.
- Choose the integration from the list.
- For OAuth integrations, click Connect and complete the login on the provider’s site. Approve every permission it asks for — see the warning below.
- For credential-based integrations, fill in the fields shown and click Connect. The fields you see come from the service itself, so they differ per integration.
If you untick a permission on the provider’s consent screen, the connection is created but cannot be used. Horizon will tell you so, and the fix is to disconnect it and connect again, approving everything.
Managing Existing Connections
Connections appear as a grid of cards. Each card shows the integration’s name and logo, its status badge, its connection and authorization type, and the date it was last checked. It offers two actions: Check Health and Disconnect.
A connection has no settings of its own. Anything an integration needs beyond authorization is configured where that thing lives, not on the connection. Slack’s channel, for example, is chosen per agent when you deploy it, not on the Slack connection.
Repairing a Connection
Once an integration is connected, it no longer appears in the Connect Service list, whatever its status, so you repair a broken connection by connecting it again:
- Find its card in the connections grid.
- Click Disconnect.
- Click Connect Service and set it up again.
Check Health re-tests a connection and updates its status. It reports; it does not repair.
Removing a Connection
Click Disconnect on the connection’s card and confirm. This deletes Horizon’s stored credentials and detaches the connection from every agent skill that was using it.
The confirmation dialog also offers to pause the agents that depend on this connection. It is off by default, so unless you tick it those agents stay running and will fail when they next try to use the integration.
Disconnecting removes Horizon’s copy of the credentials. It does not revoke Horizon’s access at the provider — to do that, remove Horizon from the provider’s own connected-apps or authorized-apps settings.
Connection Security
- Credentials and tokens are encrypted at rest with AES-256-GCM and sent over TLS.
- Horizon requests the scopes an integration needs. If any were withheld, the connection is marked unusable rather than left to fail later.
- Refresh tokens are rotated when the provider issues a new one.
- Connections can be scoped to a department, so an agent only reaches the integrations its department is entitled to.