Platform Documentation

Integrations

Integrations connect NEQTO.ai to external APIs and brokers. NEQTO.ai opens the connection using the service URL and credentials you provide. A pull integration brings data into NEQTO.ai, while a push integration sends data out. Custom integrations support TLS-secured HTTPS, WSS, and MQTTS connections.

Integration or Device Endpoint? Use a Device Endpoint when your hardware or software connects to NEQTO.ai. Use an Integration when NEQTO.ai must connect to the external service. Data pulled through an Integration can be mapped to Devices and Attributes, then used in dashboards, alerts, analytics, and maps.
Diagram: NEQTO.ai connects out to your external service using your credentials. On a schedule the integration pulls a JSON payload in; from a pulled sample the AI proposes fields which you confirm to create a device labeled Integration, whose readings feed dashboards and alerts. In the other direction the integration pushes JSON payloads out to the service.
NEQTO.ai connects to the external service, pulls or pushes JSON, and maps pulled readings to devices after you confirm a sample.

Where to find integrations

Open Integrations from the account navigation or from an application’s sidebar. The default application shows every integration in the account. A non-default application shows only the integrations linked to it. You also need the appropriate View Integrations permission for that account or application.

The Integrations screen showing a table of integrations with name, protocol, direction, status, and an Actions column.
The Integrations screen lists every connector with its protocol, direction, and status.

Create a custom integration

The wizard walks four screens: Type, Protocol, Credentials, and Settings. A Custom integration is the one you configure yourself, and it lands in Draft status until you turn it on.

  • 1
    Open Integrations and select the + (Add Integration) button. On the Type screen, choose Custom to enter your own service URL and credentials. For a service listed on its own card, use the instructions under Prebuilt connectors instead.
    Wizard step 1 (Type), headed Choose an integration type. A Weather card sits above a Custom card, and Custom is selected with a check mark.
    Step 1, Type: choose the integration type.
  • 2
    On the Protocol screen, choose the TLS transport: HTTPS, WSS, or MQTTS.
    Wizard step 2 (Protocol) listing HTTPS, WSS, and MQTTS.
    Step 2, Protocol: pick how NEQTO.ai connects.
  • 3
    On the Credentials screen, set the direction (Pull, Push, or Pull & Push), enter the pull and/or push URL, optionally add custom headers, then pick an authentication method and enter its credentials. Pull and Push use separate URLs when you choose both directions. See the table below for the fields required by each authentication method.
    Wizard step 3 (Credentials) with direction, pull URL, headers, and the API key authentication method.
    Step 3, Credentials: direction, endpoints, and authentication. Saved credentials are encrypted and are not displayed again.
  • 4
    On the Settings screen, give the integration a name and an optional description, then finish. Integration names must be unique within the account. The new integration starts in Draft status. You can pull a manual sample while it is a draft, but scheduled pulls and pushes do not run until you turn it on.
    Wizard step 4 (Settings) with the name and description fields.
    Step 4, Settings: name and describe the integration.

Authentication methods

Six methods are available. The choice changes what you enter and how NEQTO.ai sends it, and every secret is encrypted on save and never shown again.

Method What you enter How it is sent
API key Your API key. An X-API-Key header on every request.
Bearer token Your token. An Authorization: Bearer header on every request.
Basic auth Username and password. An Authorization: Basic header on every request.
OAuth2 (client credentials) Client ID, client secret, and the provider’s token URL. NEQTO.ai obtains an access token from the provider automatically and refreshes it as it expires. No sign-in is required.
OAuth2 (authorization code) Client ID, client secret, token URL, and the provider’s authorization URL. After creating the integration, choose Connect on its row and sign in at your provider once. NEQTO.ai then manages and refreshes the tokens automatically.
Mutual TLS (mTLS) In the wizard, a Certificate URL that NEQTO.ai fetches the service’s CA certificate from. After creating the integration, add your client certificate and private key (PEM) through the row’s Edit credentials action, in the Credentials (JSON) field, as clientCertPem and clientKeyPem (optionally caPem, which overrides the fetched CA). The integration cannot connect until these are set. The client certificate authenticates the TLS connection itself.
Credentials are write-only. NEQTO.ai encrypts saved credentials and does not display them again. In Edit credentials, leave the Credentials (JSON) field blank to keep the saved secret, or enter a complete replacement JSON object. Custom headers take precedence over headers generated by the selected authentication method. For example, a custom Authorization header replaces the Bearer or Basic header.

MQTT username for token-based authentication

Over MQTTS, the broker asks for a username when the connection opens. A token can serve as the password, but not the username. So when the protocol is MQTTS and the authentication method is API key, Bearer token, OAuth2 (client credentials) or OAuth2 (authorization code), the Credentials screen adds an MQTT username field. Enter the username the broker expects. The token becomes the password. The field is required, and it appears both in the create wizard and in the row’s Edit credentials action, so you can add one to an existing integration without rebuilding it.

The Credentials step of the Add integration wizard for an MQTTS integration. Direction is Pull, the pull URL is an mqtts:// broker address, the authentication method is API key, and between them an MQTT username field holds the broker username. The API key field below it is masked.
Over MQTTS, a token-based method also asks for the MQTT username the broker expects. The token itself becomes the password.

Basic auth is unaffected: it already collects a username and password, and those are what the broker receives. Mutual TLS (mTLS) authenticates the connection itself and asks for no username.

Private certificate authorities: open Edit credentials and set an HTTPS Certificate URL that returns the CA in PEM format. You can instead put caPem in Credentials (JSON), but that field replaces the complete saved secret. Include the authentication method’s other required fields in the same object. For OAuth2 authorization code, replacing the secret also removes its tokens, so use Connect again afterward. Integrations can reach only publicly resolvable hosts; private and internal network addresses are blocked.

Prebuilt connectors

A prebuilt connector appears on the Type screen as its own card. NEQTO.ai supplies its protocol, request format, and platform credentials. The wizard asks only for the account, authorization, or location that the provider needs.

The available prebuilt connectors are ENERGY STAR Portfolio Manager and Weather. Use Custom for other services.

ENERGY STAR Portfolio Manager

This connector pulls annual ENERGY STAR scores, energy, emissions, and water metrics for properties shared from your Portfolio Manager account. NEQTO.ai uses a platform-managed Portfolio Manager account, so you do not enter that account’s username or password in the integration.

  • 1
    On the Type screen, choose ENERGY STAR Portfolio Manager. The Connect step displays a one-use connection code and its expiration time.
  • 2
    Follow the link to your own Portfolio Manager account. Open Contacts, choose Add New Contacts/Connections, search for the platform account named in the wizard, and select Connect. Paste the code into the Neqto Connection Code field and send the request. The wizard detects and accepts the connection automatically. If the code expires, generate a new one.
  • 3
    If your organization has already verified more than one Portfolio Manager account, select the account whose properties you want. You can also choose Connect another account. A Portfolio Manager account can belong to only one NEQTO.ai organization.
  • 4
    On Settings, name the integration and choose properties. Leaving every property unchecked includes every property this account shares now or later. You can select up to 200 specific properties instead. If no property has been shared yet, you can still create the integration. It waits until the property owner shares one with the platform account, and NEQTO.ai accepts the share automatically.
  • 5
    Choose at least one metric, select US customary (EPA) or Metric units, and set the sync interval in whole minutes. The default is 1,440 minutes. Your plan may require a longer interval. Each reported value keeps the unit supplied by ENERGY STAR.
  • 6
    Create the integration. From its actions menu, choose Create device(s) from sample. NEQTO.ai proposes one device per property. Review and confirm each proposal, then turn on the integration. Its first successful pull changes Pending activation to Active.

The connector can pull these eight metrics:

  • ENERGY STAR score
  • Site and source energy use intensity (EUI)
  • Site energy total and source energy total
  • Total location-based greenhouse gas emissions and emissions intensity
  • Water use total
Metric period: each sync requests one annual value per selected metric for the trailing 12 months, ending with the latest complete UTC month. A metric with no value is left out of the sample rather than recorded as zero.

Weather

The Weather connector pulls current conditions for one location on a schedule and creates a device for them. Weather readings can then be used beside your own data in dashboards, alerts, analytics, and maps.

  • 1
    On the Type screen, choose Weather. The wizard goes straight to Settings. There is no protocol to pick and no credential to supply.
  • 2
    Name the integration, then set the location. Latitude runs from −90 to 90 and Longitude from −180 to 180. Location name is optional and is only a label. Conditions are fetched by coordinates, so the name never changes what is observed.
  • 3
    Set the Sync interval in minutes (your plan sets the shortest one allowed), then choose Test. It fetches the current conditions for those coordinates and lists them, so you can confirm you have the right place before saving.
    The Settings step for a Weather integration. Name reads New York Weather. Under Location are Latitude 40.7128 and Longitude -74.0060, an optional location name of New York, NY, and a sync interval of 180 minutes. Below a Test button a preview lists the eight fetched variables with their values and units, and a note says that creating the integration also creates its weather device and that it must be activated from the table to start scheduled updates.
    Weather’s Settings step. Test fetches the current conditions for those coordinates before you save.
  • 4
    Choose Create. Along with the integration, NEQTO.ai creates its weather device, with the standard weather attributes already mapped.
  • 5
    Back on the Integrations list, turn on the new integration. It shows Pending activation until the first scheduled pull succeeds, then changes to Active. Scheduled updates do not start while the integration is a draft.
The Attributes tab of the device a Weather integration created, headed Attributes (8). The rows are temperature_2m in degrees Celsius, relative_humidity_2m as a percentage, apparent_temperature in degrees Celsius, precipitation in millimetres, wind_speed_10m in kilometres per hour, wind_direction_10m in degrees, surface_pressure in hectopascals, and cloud_cover as a percentage.
The weather device and its eight attributes. Units arrive from the provider with each reading, so they are not something you configure.

Every scheduled sync brings in the same eight variables:

  • Temperature and apparent temperature (what it feels like)
  • Relative humidity
  • Precipitation
  • Wind speed and wind direction
  • Surface pressure
  • Cloud cover
No provider account is required. NEQTO.ai manages the weather-service connection, so there is no account to create and no key to enter. The connector card credits Open-Meteo under its CC BY 4.0 license.

If the automatic device setup does not complete, the integration is still created. Open its actions menu and choose Create device(s) from sample to finish the job by hand.

Pull data and create devices

For a Custom pull integration, Create device(s) from sample makes an immediate request to the external service. HTTPS uses GET. WSS waits for the first message after the connection opens. MQTTS subscribes to the topic in the URL path, or to all topics when the URL has no path. In every case, the first payload must be a single JSON object no larger than 1 MB.

From a sample to a device

  • 1
    Open the integration’s actions menu, choose Create device(s) from sample, then choose Pull sample. For a Custom integration, the AI inspects the JSON structure and proposes fields. Prebuilt connectors use their known provider fields instead.
  • 2
    Review the proposed device name and fields. You can include or exclude fields, rename them, and correct their units. Changes are saved with the proposal, so you can close the dialog and return later. Select the trash button to reject a proposal without creating a device.
  • 3
    Select Create device for each proposal you want. NEQTO.ai creates the device and its selected Attributes, and links it to the same applications as the integration. Devices created this way are labeled Integration in Devices & Data.
Pulling a new sample replaces pending work. If proposals already exist, Pull new sample discards those proposals and any edits, then builds a fresh set. Devices you already confirmed are not deleted.

A Custom integration without a device identifier creates one device from its sample. When the account’s metadata mapping defines an identifier field, that value becomes the Device’s external ID. Later payloads must carry the same identifier value to reach that Device. NEQTO.ai freezes the identifier path when you confirm the first Device, so changing the account metadata mapping later does not reroute that integration.

Custom pull schedules: your plan sets the shortest allowed interval, not the interval itself. A recurring Custom pull runs only when its integration configuration contains a pull interval. The current add and edit screens do not expose that interval, so Custom integrations created entirely in the UI support manual samples but do not start recurring pulls on their own. Prebuilt connectors set their own interval in the wizard or use their documented default.

Push data to an integration

A Custom integration set to Push or Pull & Push sends a JSON payload to your service. The protocol you picked decides what happens on the wire.

A Custom integration with direction Push or Pull & Push can send a JSON payload to the external service. The serialized payload can be up to 64 KiB. NEQTO.ai applies the integration’s saved authentication and custom headers.

Protocol Push behavior
HTTPS Sends a POST request with a JSON body and Content-Type: application/json.
WSS Opens the WebSocket, sends the serialized JSON, then closes the connection.
MQTTS Publishes to the configured topic or the topic in the URL path. The topic must be concrete. Publish wildcards such as # and + are not allowed.

An alert’s Payload push action can target an HTTPS or MQTTS integration that supports push and is Active or Pending activation. Alert payload push does not support WSS. See the Alerts guide for payload templates and target rules.

Scheduled auto-push: if an auto-push message and interval are present in the integration configuration, NEQTO.ai sends that message on the schedule. Your plan sets the shortest allowed interval. The current add and edit screens do not expose auto-push settings.

Integration status

A new integration starts as Draft. Turning it on changes the status to Pending activation. Its first successful pull or push changes the status to Active. A connection test does not activate the integration because it sends no data.

Situation What happens
A scheduled pull or push gets 401, 403, or another non-retryable 4xx response. HTTP 408 and 429 are treated as retryable. The integration changes to Disabled. Fix the credentials, URL, or request expected by the service, then turn it on again.
A scheduled pull is rate-limited (429) The integration stays enabled. NEQTO.ai waits for the service’s Retry-After period when one is provided, or tries again at the next interval. Rate limits do not count toward the five-failure cutoff below.
A scheduled pull gets 408, a 5xx response, or a network error NEQTO.ai tries again at the next interval. Five consecutive scheduled pull failures change the integration to Disabled. A successful scheduled pull clears the failure count.
A scheduled push gets 408, 429, a 5xx response, or a network error The integration stays enabled and the push is tried again at its next interval.
A manual sample pull fails The dialog reports the error, but the failure does not disable the integration.
A prebuilt connector is waiting for authorization or a property share The integration stays enabled and displays the waiting reason. This does not count as a failed pull.

Read the Status column

A status that needs explaining carries an icon next to its switch. Hover it for the sentence. A Disabled row shows the reason NEQTO.ai recorded when it was deactivated, so you know what to check. A Pending activation row explains that it activates on the next successful pull or push.

Two rows of the Integrations table. The first, Facilities API, has its switch off, a red alert icon and the status Disabled, with an open tooltip reading: The external service rejected the push request. The second, Plant Telemetry, has its switch off, an hourglass icon and the status Pending activation.
A deactivated integration names the reason on its row. A pending one explains what it is waiting for.

Test connection

Test connection on a Custom integration’s actions menu opens a connection with the stored credentials but does not pull or push data. Prebuilt connectors do not offer this action because NEQTO.ai manages their endpoints and credentials. For HTTPS, any response other than 401 or 403 passes the reachability test. Even a 404 passes, although it may mean the URL points to the wrong resource. WSS and MQTTS must complete their protocol handshakes. For an integration with both directions, this initial test uses the pull URL.

After a successful connection test, NEQTO.ai probes the configured endpoint or endpoints with a deliberately invalid version of the credential. This checks whether the selected authentication method changes the response. Other controls, such as custom headers or network access rules, may still protect the service. The test has four possible outcomes:

What you see What it means
Connection successful The endpoint answered, accepted your credential, and refused the wrong one. No action is needed.
Connection successful, with The endpoint credential check could not be completed this time The connection works, but the credential check reached no verdict because the endpoint timed out, returned an error, or responded inconclusively. Try again later if you want a verdict.
The endpoint rejected the stored credential The endpoint is reachable but will not accept what is stored. Update the credentials through Edit credentials and test again.
The endpoint accepted an invalid credential The endpoint accepted the deliberately altered credential. The configured authentication method may not be enforced for this endpoint, although another access control may still apply. See the warning below.
A green notification reading Connection successful.
A clean result: the endpoint accepted the stored credential and rejected the altered one.
Treat an accepted invalid credential as a warning. The test could not show that the configured authentication method protects this endpoint. Check the service’s authentication settings, including any custom headers or network rules, before you rely on the connection.
A red notification reading: The endpoint accepted an invalid credential. The connection works, but this endpoint doesn't appear to verify credentials. Its data may be publicly accessible.
The altered credential was accepted. Check whether another access control protects the endpoint or whether it is publicly accessible.

Edit and delete integrations

Both start from a row’s actions menu. Editing credentials replaces only the secrets you type, and deleting is permanent.

Open a row’s actions menu to change its name and description. Custom integrations also let you change direction. Edit credentials is available for Custom integrations and replaces only the secret values you enter. Prebuilt connectors keep their provider credentials under platform control.

Deleting an integration is permanent. Deletion stops its pull and auto-push schedules, removes its application links, and removes its links to the Devices created from it. Those Devices and their stored readings remain in NEQTO.ai, but the deleted integration can no longer send them new data. Delete the Devices separately if you no longer need them.

Permissions

Task Required permission
Open the list and view saved proposals View Integrations
Create an integration Create Integrations
Edit, connect, test, change status, or pull a sample Edit Integrations
Open the sample action and confirm a proposal as a Device Edit Integrations and Create Devices
Delete an integration Delete Integrations

NEQTO.ai checks account permissions on the account-level page and application permissions inside an application. A missing permission may hide the control or reject the request.

Example: pull from your own service

Use a service you control when testing the Custom pull flow so you can inspect its response and repeat the request.

  • 1
    Expose one HTTPS URL that returns a single JSON object of current readings. A flat response makes the proposed fields easier to review, although nested fields are supported.
    {
      "meter_id": "MTR-114",
      "power_kw": 8.4,
      "energy_kwh": 15230.7,
      "temperature_c": 41.2
    }
  • 2
    Create the integration: type Custom, protocol HTTPS, direction Pull, that URL, and whichever authentication method your service expects. Then run Test connection to check reachability. A conclusive credential result also confirms whether the endpoint accepts the stored credential and rejects the altered one.
  • 3
    Open Create device(s) from sample, pull a sample, and confirm the proposed fields. That creates the device. Later manual samples use the same endpoint. Recurring pulls require a pull interval in the integration configuration, as explained above.
Looking for weather? Use the Weather connector rather than a custom pull. It needs no API key of yours and creates its device for you.

Troubleshooting

Each message below names what NEQTO.ai could not do and what to change before you try again.

Message Meaning
Failed to pull data from the external service The service could not be reached, timed out, or returned an error status. Check the URL and that the service is up, then pull again.
The external service did not return a JSON object The response was not a single JSON object (for example, plain text, HTML, or a bare array). Point the URL at an endpoint that returns a JSON object.
The external service rejected the integration credentials The service answered with an authentication error (401 or 403). Update the credentials in the integration’s settings.
OAuth connection required. Please connect this integration again. The stored OAuth session can no longer be refreshed (for example, access was revoked at the provider). Choose Connect on the integration’s row and sign in again.
Waiting for ENERGY STAR properties to be shared with the platform account The Portfolio Manager account connection is verified, but it has not shared a property yet. Share the property with the platform account. NEQTO.ai accepts the share automatically and tries again on the next sync.
The provider has not published values for this record yet A prebuilt connector found the source record, but it had no usable metric values. Pull a new sample after the provider publishes data.
No object in the sample had a usable device identifier The identifier field configured in the account’s metadata mapping is missing, blank, or not a string, number, or boolean in the sample. Correct the response or the mapping, then pull a new sample.
A device with this identifier already exists for this account Another Device already owns the proposed external ID. Use the existing Device or change the source identifier. A disabled Device still reserves its external ID until it is permanently deleted.
The external service rejected the push request The service answered a push with an error status other than an authentication error. Check the push URL and the payload format the service expects.
The pull interval is shorter than your plan allows / The auto-push interval is shorter than your plan allows Increase the interval, or upgrade your plan for faster cadences.
The MQTT push topic must be a concrete topic without # or + wildcards Replace the wildcard with the exact topic the payload should be published to.
Failed to fetch a PEM certificate from certificateUrl The Certificate URL could not be fetched or did not return a PEM certificate. Check the URL, or paste the CA directly as caPem via Edit credentials.

Limits and security

The caps and network rules that apply to every integration.

Item Limit
Connection security TLS only: HTTPS, WSS, and MQTTS. Plain HTTP, WS, and MQTT are not supported.
Reachable hosts Public hosts only. Private and internal network addresses are blocked.
Connection timeout 15 seconds for HTTPS, WSS, and MQTTS connection work.
Custom pull response Up to 1 MB, and the response must be one JSON object.
Push payload Up to 64 KiB after JSON serialization.
Pull and auto-push intervals Minimum intervals depend on your plan.
Integration count Your plan limits how many integrations the account and its subaccounts can create.
Name and description Name: 100 characters and unique within the account. Description: 500 characters.
Proposed fields Up to 50 fields per Device proposal.
ENERGY STAR properties Up to 200 explicit selections. No selection means all shared properties.
Certificate URL HTTPS only, up to 2,048 characters. The PEM fetch times out after 10 seconds and accepts up to 64 KiB.
Custom headers Enter a JSON object. Only string and numeric values are sent as headers.
Saved credentials Encrypted at rest, write-only, and never returned after saving.