Integrations
Integrations connect NEQTO.ai to external APIs and brokers. NEQTO.ai opens the connection using the service URL and credentials you provide. A pull integration brings data into NEQTO.ai, while a push integration sends data out. Custom integrations support TLS-secured HTTPS, WSS, and MQTTS connections.
Where to find integrations
Open Integrations from the account navigation or from an application’s sidebar. The default application shows every integration in the account. A non-default application shows only the integrations linked to it. You also need the appropriate View Integrations permission for that account or application.
Create a custom integration
The wizard walks four screens: Type, Protocol, Credentials, and Settings. A Custom integration is the one you configure yourself, and it lands in Draft status until you turn it on.
-
1Open Integrations and select the + (Add Integration) button. On the Type screen, choose Custom to enter your own service URL and credentials. For a service listed on its own card, use the instructions under Prebuilt connectors instead.
Step 1, Type: choose the integration type. -
2On the Protocol screen, choose the TLS transport: HTTPS, WSS, or MQTTS.
Step 2, Protocol: pick how NEQTO.ai connects. -
3On the Credentials screen, set the direction (Pull, Push, or Pull & Push), enter the pull and/or push URL, optionally add custom headers, then pick an authentication method and enter its credentials. Pull and Push use separate URLs when you choose both directions. See the table below for the fields required by each authentication method.
Step 3, Credentials: direction, endpoints, and authentication. Saved credentials are encrypted and are not displayed again. -
4On the Settings screen, give the integration a name and an optional description, then finish. Integration names must be unique within the account. The new integration starts in Draft status. You can pull a manual sample while it is a draft, but scheduled pulls and pushes do not run until you turn it on.
Step 4, Settings: name and describe the integration.
Authentication methods
Six methods are available. The choice changes what you enter and how NEQTO.ai sends it, and every secret is encrypted on save and never shown again.
| Method | What you enter | How it is sent |
|---|---|---|
| API key | Your API key. | An X-API-Key header on every request. |
| Bearer token | Your token. | An Authorization: Bearer header on every request. |
| Basic auth | Username and password. | An Authorization: Basic header on every request. |
| OAuth2 (client credentials) | Client ID, client secret, and the provider’s token URL. | NEQTO.ai obtains an access token from the provider automatically and refreshes it as it expires. No sign-in is required. |
| OAuth2 (authorization code) | Client ID, client secret, token URL, and the provider’s authorization URL. | After creating the integration, choose Connect on its row and sign in at your provider once. NEQTO.ai then manages and refreshes the tokens automatically. |
| Mutual TLS (mTLS) |
In the wizard, a Certificate URL that NEQTO.ai fetches the service’s CA
certificate from. After creating the integration, add your client certificate and
private key (PEM) through the row’s Edit credentials action, in the
Credentials (JSON) field, as clientCertPem and
clientKeyPem (optionally caPem, which overrides the fetched
CA). The integration cannot connect until these are set.
|
The client certificate authenticates the TLS connection itself. |
Authorization header replaces the Bearer or Basic header.
MQTT username for token-based authentication
Over MQTTS, the broker asks for a username when the connection opens. A token can serve as the password, but not the username. So when the protocol is MQTTS and the authentication method is API key, Bearer token, OAuth2 (client credentials) or OAuth2 (authorization code), the Credentials screen adds an MQTT username field. Enter the username the broker expects. The token becomes the password. The field is required, and it appears both in the create wizard and in the row’s Edit credentials action, so you can add one to an existing integration without rebuilding it.
Basic auth is unaffected: it already collects a username and password, and those are what the broker receives. Mutual TLS (mTLS) authenticates the connection itself and asks for no username.
caPem in Credentials (JSON), but that field replaces the complete
saved secret. Include the authentication method’s other required fields in the same object. For
OAuth2 authorization code, replacing the secret also removes its tokens, so use
Connect again afterward. Integrations can reach only publicly resolvable hosts;
private and internal network addresses are blocked.
Prebuilt connectors
A prebuilt connector appears on the Type screen as its own card. NEQTO.ai supplies its protocol, request format, and platform credentials. The wizard asks only for the account, authorization, or location that the provider needs.
The available prebuilt connectors are ENERGY STAR Portfolio Manager and Weather. Use Custom for other services.
ENERGY STAR Portfolio Manager
This connector pulls annual ENERGY STAR scores, energy, emissions, and water metrics for properties shared from your Portfolio Manager account. NEQTO.ai uses a platform-managed Portfolio Manager account, so you do not enter that account’s username or password in the integration.
-
1On the Type screen, choose ENERGY STAR Portfolio Manager. The Connect step displays a one-use connection code and its expiration time.
-
2Follow the link to your own Portfolio Manager account. Open Contacts, choose Add New Contacts/Connections, search for the platform account named in the wizard, and select Connect. Paste the code into the Neqto Connection Code field and send the request. The wizard detects and accepts the connection automatically. If the code expires, generate a new one.
-
3If your organization has already verified more than one Portfolio Manager account, select the account whose properties you want. You can also choose Connect another account. A Portfolio Manager account can belong to only one NEQTO.ai organization.
-
4On Settings, name the integration and choose properties. Leaving every property unchecked includes every property this account shares now or later. You can select up to 200 specific properties instead. If no property has been shared yet, you can still create the integration. It waits until the property owner shares one with the platform account, and NEQTO.ai accepts the share automatically.
-
5Choose at least one metric, select US customary (EPA) or Metric units, and set the sync interval in whole minutes. The default is 1,440 minutes. Your plan may require a longer interval. Each reported value keeps the unit supplied by ENERGY STAR.
-
6Create the integration. From its actions menu, choose Create device(s) from sample. NEQTO.ai proposes one device per property. Review and confirm each proposal, then turn on the integration. Its first successful pull changes Pending activation to Active.
The connector can pull these eight metrics:
- ENERGY STAR score
- Site and source energy use intensity (EUI)
- Site energy total and source energy total
- Total location-based greenhouse gas emissions and emissions intensity
- Water use total
Weather
The Weather connector pulls current conditions for one location on a schedule and creates a device for them. Weather readings can then be used beside your own data in dashboards, alerts, analytics, and maps.
-
1On the Type screen, choose Weather. The wizard goes straight to Settings. There is no protocol to pick and no credential to supply.
-
2Name the integration, then set the location. Latitude runs from −90 to 90 and Longitude from −180 to 180. Location name is optional and is only a label. Conditions are fetched by coordinates, so the name never changes what is observed.
-
3Set the Sync interval in minutes (your plan sets the shortest one allowed), then choose Test. It fetches the current conditions for those coordinates and lists them, so you can confirm you have the right place before saving.
Weather’s Settings step. Test fetches the current conditions for those coordinates before you save. -
4Choose Create. Along with the integration, NEQTO.ai creates its weather device, with the standard weather attributes already mapped.
-
5Back on the Integrations list, turn on the new integration. It shows Pending activation until the first scheduled pull succeeds, then changes to Active. Scheduled updates do not start while the integration is a draft.
Every scheduled sync brings in the same eight variables:
- Temperature and apparent temperature (what it feels like)
- Relative humidity
- Precipitation
- Wind speed and wind direction
- Surface pressure
- Cloud cover
If the automatic device setup does not complete, the integration is still created. Open its actions menu and choose Create device(s) from sample to finish the job by hand.
Pull data and create devices
For a Custom pull integration, Create device(s) from sample makes an immediate request to the external service. HTTPS uses GET. WSS waits for the first message after the connection opens. MQTTS subscribes to the topic in the URL path, or to all topics when the URL has no path. In every case, the first payload must be a single JSON object no larger than 1 MB.
From a sample to a device
-
1Open the integration’s actions menu, choose Create device(s) from sample, then choose Pull sample. For a Custom integration, the AI inspects the JSON structure and proposes fields. Prebuilt connectors use their known provider fields instead.
-
2Review the proposed device name and fields. You can include or exclude fields, rename them, and correct their units. Changes are saved with the proposal, so you can close the dialog and return later. Select the trash button to reject a proposal without creating a device.
-
3Select Create device for each proposal you want. NEQTO.ai creates the device and its selected Attributes, and links it to the same applications as the integration. Devices created this way are labeled Integration in Devices & Data.
A Custom integration without a device identifier creates one device from its sample. When the account’s metadata mapping defines an identifier field, that value becomes the Device’s external ID. Later payloads must carry the same identifier value to reach that Device. NEQTO.ai freezes the identifier path when you confirm the first Device, so changing the account metadata mapping later does not reroute that integration.
Push data to an integration
A Custom integration set to Push or Pull & Push sends a JSON payload to your service. The protocol you picked decides what happens on the wire.
A Custom integration with direction Push or Pull & Push can send a JSON payload to the external service. The serialized payload can be up to 64 KiB. NEQTO.ai applies the integration’s saved authentication and custom headers.
| Protocol | Push behavior |
|---|---|
| HTTPS |
Sends a POST request with a JSON body and
Content-Type: application/json.
|
| WSS | Opens the WebSocket, sends the serialized JSON, then closes the connection. |
| MQTTS |
Publishes to the configured topic or the topic in the URL path. The topic must be
concrete. Publish wildcards such as # and + are not allowed.
|
An alert’s Payload push action can target an HTTPS or MQTTS integration that supports push and is Active or Pending activation. Alert payload push does not support WSS. See the Alerts guide for payload templates and target rules.
Integration status
A new integration starts as Draft. Turning it on changes the status to Pending activation. Its first successful pull or push changes the status to Active. A connection test does not activate the integration because it sends no data.
| Situation | What happens |
|---|---|
| A scheduled pull or push gets 401, 403, or another non-retryable 4xx response. HTTP 408 and 429 are treated as retryable. | The integration changes to Disabled. Fix the credentials, URL, or request expected by the service, then turn it on again. |
| A scheduled pull is rate-limited (429) |
The integration stays enabled. NEQTO.ai waits for the service’s Retry-After
period when one is provided, or tries again at the next interval. Rate limits do not
count toward the five-failure cutoff below.
|
| A scheduled pull gets 408, a 5xx response, or a network error | NEQTO.ai tries again at the next interval. Five consecutive scheduled pull failures change the integration to Disabled. A successful scheduled pull clears the failure count. |
| A scheduled push gets 408, 429, a 5xx response, or a network error | The integration stays enabled and the push is tried again at its next interval. |
| A manual sample pull fails | The dialog reports the error, but the failure does not disable the integration. |
| A prebuilt connector is waiting for authorization or a property share | The integration stays enabled and displays the waiting reason. This does not count as a failed pull. |
Read the Status column
A status that needs explaining carries an icon next to its switch. Hover it for the sentence. A Disabled row shows the reason NEQTO.ai recorded when it was deactivated, so you know what to check. A Pending activation row explains that it activates on the next successful pull or push.
Test connection
Test connection on a Custom integration’s actions menu opens a connection with the stored credentials but does not pull or push data. Prebuilt connectors do not offer this action because NEQTO.ai manages their endpoints and credentials. For HTTPS, any response other than 401 or 403 passes the reachability test. Even a 404 passes, although it may mean the URL points to the wrong resource. WSS and MQTTS must complete their protocol handshakes. For an integration with both directions, this initial test uses the pull URL.
After a successful connection test, NEQTO.ai probes the configured endpoint or endpoints with a deliberately invalid version of the credential. This checks whether the selected authentication method changes the response. Other controls, such as custom headers or network access rules, may still protect the service. The test has four possible outcomes:
| What you see | What it means |
|---|---|
| Connection successful | The endpoint answered, accepted your credential, and refused the wrong one. No action is needed. |
| Connection successful, with The endpoint credential check could not be completed this time | The connection works, but the credential check reached no verdict because the endpoint timed out, returned an error, or responded inconclusively. Try again later if you want a verdict. |
| The endpoint rejected the stored credential | The endpoint is reachable but will not accept what is stored. Update the credentials through Edit credentials and test again. |
| The endpoint accepted an invalid credential | The endpoint accepted the deliberately altered credential. The configured authentication method may not be enforced for this endpoint, although another access control may still apply. See the warning below. |
Edit and delete integrations
Both start from a row’s actions menu. Editing credentials replaces only the secrets you type, and deleting is permanent.
Open a row’s actions menu to change its name and description. Custom integrations also let you change direction. Edit credentials is available for Custom integrations and replaces only the secret values you enter. Prebuilt connectors keep their provider credentials under platform control.
Permissions
| Task | Required permission |
|---|---|
| Open the list and view saved proposals | View Integrations |
| Create an integration | Create Integrations |
| Edit, connect, test, change status, or pull a sample | Edit Integrations |
| Open the sample action and confirm a proposal as a Device | Edit Integrations and Create Devices |
| Delete an integration | Delete Integrations |
NEQTO.ai checks account permissions on the account-level page and application permissions inside an application. A missing permission may hide the control or reject the request.
Example: pull from your own service
Use a service you control when testing the Custom pull flow so you can inspect its response and repeat the request.
-
1Expose one HTTPS URL that returns a single JSON object of current readings. A flat response makes the proposed fields easier to review, although nested fields are supported.
{ "meter_id": "MTR-114", "power_kw": 8.4, "energy_kwh": 15230.7, "temperature_c": 41.2 } -
2Create the integration: type Custom, protocol HTTPS, direction Pull, that URL, and whichever authentication method your service expects. Then run Test connection to check reachability. A conclusive credential result also confirms whether the endpoint accepts the stored credential and rejects the altered one.
-
3Open Create device(s) from sample, pull a sample, and confirm the proposed fields. That creates the device. Later manual samples use the same endpoint. Recurring pulls require a pull interval in the integration configuration, as explained above.
Troubleshooting
Each message below names what NEQTO.ai could not do and what to change before you try again.
| Message | Meaning |
|---|---|
| Failed to pull data from the external service | The service could not be reached, timed out, or returned an error status. Check the URL and that the service is up, then pull again. |
| The external service did not return a JSON object | The response was not a single JSON object (for example, plain text, HTML, or a bare array). Point the URL at an endpoint that returns a JSON object. |
| The external service rejected the integration credentials | The service answered with an authentication error (401 or 403). Update the credentials in the integration’s settings. |
| OAuth connection required. Please connect this integration again. | The stored OAuth session can no longer be refreshed (for example, access was revoked at the provider). Choose Connect on the integration’s row and sign in again. |
| Waiting for ENERGY STAR properties to be shared with the platform account | The Portfolio Manager account connection is verified, but it has not shared a property yet. Share the property with the platform account. NEQTO.ai accepts the share automatically and tries again on the next sync. |
| The provider has not published values for this record yet | A prebuilt connector found the source record, but it had no usable metric values. Pull a new sample after the provider publishes data. |
| No object in the sample had a usable device identifier | The identifier field configured in the account’s metadata mapping is missing, blank, or not a string, number, or boolean in the sample. Correct the response or the mapping, then pull a new sample. |
| A device with this identifier already exists for this account | Another Device already owns the proposed external ID. Use the existing Device or change the source identifier. A disabled Device still reserves its external ID until it is permanently deleted. |
| The external service rejected the push request | The service answered a push with an error status other than an authentication error. Check the push URL and the payload format the service expects. |
| The pull interval is shorter than your plan allows / The auto-push interval is shorter than your plan allows | Increase the interval, or upgrade your plan for faster cadences. |
| The MQTT push topic must be a concrete topic without # or + wildcards | Replace the wildcard with the exact topic the payload should be published to. |
| Failed to fetch a PEM certificate from certificateUrl |
The Certificate URL could not be fetched or did not return a PEM certificate. Check the
URL, or paste the CA directly as caPem via
Edit credentials.
|
Limits and security
The caps and network rules that apply to every integration.
| Item | Limit |
|---|---|
| Connection security | TLS only: HTTPS, WSS, and MQTTS. Plain HTTP, WS, and MQTT are not supported. |
| Reachable hosts | Public hosts only. Private and internal network addresses are blocked. |
| Connection timeout | 15 seconds for HTTPS, WSS, and MQTTS connection work. |
| Custom pull response | Up to 1 MB, and the response must be one JSON object. |
| Push payload | Up to 64 KiB after JSON serialization. |
| Pull and auto-push intervals | Minimum intervals depend on your plan. |
| Integration count | Your plan limits how many integrations the account and its subaccounts can create. |
| Name and description | Name: 100 characters and unique within the account. Description: 500 characters. |
| Proposed fields | Up to 50 fields per Device proposal. |
| ENERGY STAR properties | Up to 200 explicit selections. No selection means all shared properties. |
| Certificate URL | HTTPS only, up to 2,048 characters. The PEM fetch times out after 10 seconds and accepts up to 64 KiB. |
| Custom headers | Enter a JSON object. Only string and numeric values are sent as headers. |
| Saved credentials | Encrypted at rest, write-only, and never returned after saving. |