Add provider evidence

Register at least 1 connected source or upload a supported provider export file. Venturi tenant, connector, federation, and external-ID setup artifacts are generated in-product. Customer-provided provider-account credentials or provider exports are entered in-product. Credentials remain tenant-local and are validated for read-only access wherever the provider offers read-only credentials. See Docs authority & product state.

Execute this step in SaaS guided setup. For self-hosted deployments, use the same /domains/adoption/onboarding path on your own instance host.

Steps

Role: Engineer or Admin with connector settings access.

1. Select a cloud, provider, or provider export upload in guided setup.
2. For a cloud connector, complete steps 1 to 3 of your cloud guide (AWS, Google Cloud, or Azure): generate the configuration, download and extract the pinned Terraform artifact, save the generated values as terraform.tfvars, apply the module, run the local boundary check, and register the Terraform outputs in the same form. This is the only terraform apply in the setup path; Deploy in step 5 activates the connector without applying the module again.
3. For a provider API, enter customer-provided provider-account credentials in-product. Use a dedicated credential for the selected reporting surface. OpenAI organization Admin keys support selectable read permissions: grant Usage: Read for usage and cost reporting, and set Audit Logs Scope to Read when audit logs are selected. Anthropic reporting can use an Admin API credential with wider capability. Venturi independently restricts requests to GET on its endpoint allowlist. See Provider connectors.
4. For a file, select the source type and period, upload the export, and review the detected schema before acceptance.
5. Run automated credential validation or file validation.

Automated credential validation checks identity, scope, trust conditions, reachability and expected reads. Policy simulation or an isolated provider test fixture verifies write refusal for scoped credentials; never issue an administrative write against production data. A reporting credential with wider capability also requires independent negative tests of the connector’s method, endpoint, redirect and destination allowlist. A successful read alone does not establish this boundary. It never accepts a partial credential. Venturi stores provider-account credentials as encrypted credential references. Unlike the federated cloud connectors, they carry no Venturi-set expiry: Venturi uses each credential until you rotate or revoke it, or until the provider expires or revokes it. To rotate, issue the replacement with the provider, update the credential reference in-product, rerun automated credential validation, and revoke the previous credential with the provider only after the replacement validates. See Rotate & offboard.

Success evidence

At least 1 source shows Connected or 1 provider export file shows Accepted, with validation time, source scope, and the 1st readiness probe recorded.

Recovery

Use the exact failed field or provider error. Correct scope or trust settings, rotate uncertain credentials, or replace a malformed export. Do not retry an unchanged credential after an authorization failure. When the provider has expired or revoked a stored credential, each sync of that source fails open and returns no rows until you store a replacement that passes automated credential validation.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details

Docs feedback: Add provider evidence
Page: https://docs.venturi.systems/onboarding/providers/