Upstash, MongoDB, and Google Analytics

These connectors use fixed backend providers instead of giving an agent a database client or a general-purpose command surface. Every connector is read-only, and every resource boundary is validated before the integration becomes ready.

Chat and Operator can use all three connected providers. Engineering can also use Upstash and MongoDB, while Growth can also use Google Analytics. Every profile still receives only the resources configured for the organization.

Upstash Redis

Before connecting, open the intended database in Upstash and copy its REST URL and read-only REST token. The exact REST URL identifies the database. The Upstash dashboard URL helps you find the database; it is not used as the runtime endpoint.

1. Enter the root HTTPS REST URL shown by Upstash.
2. Choose All keys only for a dedicated database. Otherwise, enter the permitted key prefixes.
3. Paste the read-only REST token and connect.

Oblive checks key scope before making a network request. The connector supports only bounded reads for key metadata, scalar or hash values, and collection ranges. It does not expose arbitrary Redis commands, scans, writes, scripts, or subscriptions.

Prefixes use literal starts-with matching. tenant:1 also matches tenant:10; prefer a delimiter-terminated namespace such as tenant:1: when the boundary matters.

MongoDB Atlas

Create a dedicated Atlas database user with the read role on one application database. Add the Oblive deployment to the Atlas network access list and keep the Atlas cluster host, database username, password, and application database name available. Do not use an administrator or a user with write roles.

1. Enter the bare Atlas cluster host, such as cluster0.example.mongodb.net, plus the database username, password, and exact application database name.
2. Select Validate connection. Oblive constructs a pathless SRV URI on the backend and loads the authorized collections and bounded field-name samples without returning document values.
3. Choose individual collections, or select Allow all discovered collections and sampled fields to grant the exact displayed snapshot. Collections created later remain blocked until you validate again.
4. Review fields in each dropdown. Nested fields use dotted paths such as customer.id. Add a known dotted path manually when MongoDB’s schemaless sample does not observe it, then connect.

MongoDB’s appName is client metadata, not the Atlas cluster identifier. Oblive fixes it to oblive-integration; the cluster host determines where the driver connects.

Oblive rejects system databases, non-SRV connections, missing authentication, unsafe topology or TLS options, an explicitly mismatched URI database, unlisted collections and fields, unsupported query operators, and query plans that perform a collection scan. Add an appropriate Atlas index before retrying a rejected query.

Agents can run indexed ranges against an allowed ObjectId _id timestamp or an allowed BSON date field such as createdAt. ObjectId timestamps are accurate to the second and reflect creation time only when your application generated the ID when it created the record. Oblive keeps ordinary strings distinct from BSON values and accepts only strict ObjectId and Date literals for these queries.

Google Analytics

In the Google Cloud project that owns Oblive’s OAuth client, enable the Google Analytics Admin API (analyticsadmin.googleapis.com) for property discovery and configuration, and the Google Analytics Data API (analyticsdata.googleapis.com) for reports. The Google identity you connect must have Viewer or higher access to the required GA4 properties.

Google Analytics uses a two-step connection so OAuth identity and GA4 property scope remain separate:

1. Select Connect on the Google Analytics card, continue to Google, and approve the read-only permission.
2. After returning to the management sheet’s Connection section, choose one or more GA4 properties discovered for that identity.
3. Choose a default property and save.

The connector stays disabled until Oblive verifies every selected property against the live Google Admin API. It exposes bounded account, property, Google Ads link, custom-definition, standard-report, and realtime-report reads. It cannot create or change Analytics resources.

Disconnecting Google Analytics clears its selected properties. This prevents a later Google identity from inheriting resource access that was verified for the previous identity.

Readiness and Rotation

Rotating a token or MongoDB credential revalidates the provider and invalidates older execution capabilities. Changing key prefixes, MongoDB allowlists, or GA4 property IDs does the same. Stored credentials are write-only and never returned to the browser or an agent process.

Troubleshooting

• Upstash URL rejected: copy the root database REST URL ending in upstash.io, without a custom port, path, query, or embedded credential.
• Upstash key denied: add the narrow prefix intentionally or use a dedicated database; do not broaden scope just to bypass a typo.
• MongoDB connection rejected: enter only the Atlas SRV host in the host field, without mongodb+srv://, a path, port, or query. Confirm the database username/password, application database name, and Atlas Network Access entry. Oblive encodes the credentials and constructs the URI; do not pre-encode the password.
• MongoDB field missing: field choices come from a bounded indexed sample, not an authoritative schema. Add the known dotted path under Additional field paths.
• MongoDB query rejected as unindexed: create an index that supports the filter and sort, then retry the same bounded query.
• No GA4 properties appear: confirm the Admin API is enabled in the OAuth client’s Cloud project and the connected identity has Viewer or higher access to a GA4 property.
• Google reauthorization remains disabled: reopen configuration and save the property selection so Oblive can verify it with the refreshed credential.

For access behavior shared by every connector, see Access and Consequential Actions.