Skip to main content Announcing Tool Policies: AI agent permissions down to the field Read the announcement

AI agent integrations for SaaS. Give your agent every system your customers use.

StackOne connects your agent to each customer's own Workday, Salesforce or ServiceNow: 570+ connectors and 35,000+ actions, with auth, webhooks and logs handled for every account.

Your product Assistant
Alex Morgan

Book Jamie Lewis's final interview for Thursday and tell the panel.

Your agent

Tool search 3 actions selected
  • smartrecruiters_get_candidate Read
  • smartrecruiters_create_interview Done
  • slack_send_message Sent

Jamie's final interview is booked for Thursday at 2pm, and the panel has the brief in Slack.

Actions run on StackOne 85% fewer input tokens 7.0k vs 47.7k · SmartRecruiters connector benchmark

"StackOne powers the majority of Screenloop's ATS integrations. Time to release dropped significantly."
Rodrigo SantosCTO, Screenloop

How embedded integrations work. Six steps from your code to your customers' systems.

Scroll to explore, or choose a step

  1. Your admin picks the connectors in the StackOne dashboard and sets up a connector profile (opens in a new tab) for each one: how it signs in and which actions your agent may use.

    Workday

    Workday

    + Link Account Use in Agent

    Workday is a cloud-based enterprise platform for human capital management, financial management, analytics, and workforce planning.

    LibraryExplore all the actions & events available on the Workday connector.
    ActionDescriptionTypeEnabled
    Search Workers Finds workers by name or employee ID and returns a compact record with the worker WID, person ID and current job. Search
    Get Worker Retrieves staffing details for a specific worker by Workday ID. Read
    List Worker Time Off Entries Retrieves all time off entries for a specific worker. Read
    Create Time Off Request (SOAP) Submits a time off request for a worker via the Absence Management SOAP web service. Write
    Update Time Off Request Corrects or deletes existing time off entries for a worker by initiating the Correct Time Off business process via the Absence Management REST API. Write
    Create Termination (SOAP) Terminate an employee with reason codes, last day of work, rehire eligibility, regrettable flag, and close-position handling using the Workday Staffing SOAP Terminate_Employee business process. Write

    156 more actions

  2. Embed the StackOne Hub (opens in a new tab) as a React or web component in your colours, or send an auth link. StackOne stores each credential and refreshes it.

    Your product Integrations

    IntegrationsConnect the tools your team uses. Your agent works in the accounts you link here.

    • WorkdayHRIS Connected
    • Oracle Fusion HCMHRIS Connected
    • BambooHRHRIS Connected
    • PersonioHRIS Connected
    • GreenhouseRecruiting Connected
    • HubSpotCRM Connected
    • JiraProject management Connected
    • SlackMessaging Connected
    IntegrationsPage.tsx
    import { StackOneHub } from "@stackone/hub";
    
    <StackOneHub
      token={connectSessionToken}
      theme={{ colors: { secondary: { background: "#0f766e", foreground: "#ffffff" } } }}
      onSuccess={({ id, provider }) => saveAccount(customerId, id, provider)}
    />
  3. Build your agent's tools menu from the connectors and actions endpoints (opens in a new tab), so each customer sees what their linked systems offer.

    tools-menu.sh
    curl
    # The systems your customers can connect
    curl "https://api.stackone.com/v2/connectors?key=workday,okta" \
      -u "$STACKONE_API_KEY:"
    
    # The actions behind one customer's linked accounts
    curl --globoff "https://api.stackone.com/actions?filter[connectors]=workday,okta&filter[account_ids]=<account id>" \
      -u "$STACKONE_API_KEY:"
  4. Use the AI SDK (opens in a new tab) with your agent framework. Scope tool search and every action to your customer's linked account. The agent finds the tools and runs the task.

    agent.ts
    Imports and customer account6 lines
    import { anthropic } from "@ai-sdk/anthropic";
    import { ToolLoopAgent } from "ai";
    import { StackOneToolSet } from "@stackone/ai";
    
    // Look up this connection from your authenticated customer's session.
    if (!customerAccountId) throw new Error("Connect Workday first");
    // Tool search: the agent finds and runs actions in this customer's account only
    const toolset = new StackOneToolSet({
      accountId: customerAccountId,
      toolMode: "search_execute",
    });
    const tools = await toolset.fetchTools();
    
    const agent = new ToolLoopAgent({
      model: anthropic("claude-sonnet-5-5"),
      instructions: "Find the tools you need. Ask for any missing details.",
      tools: await tools.toAISDK(),
    });
    const { text } = await agent.generate({
      prompt: "Submit Dana Reyes's leave request for 23 October 2026.",
    });
  5. Native webhooks and synthetic events arrive at one endpoint, including from systems with no webhooks of their own.

    webhooks.ts
    TypeScript
    Signature check10 lines
    import { createHmac, timingSafeEqual } from "node:crypto";
    
    // x-stackone-signature: HMAC-SHA256 of the raw body with your signing secret, base64url.
    function isSignatureValid(signature: string | undefined, rawBody: Buffer, secret: string) {
      if (!signature) return false;
      const expected = Buffer.from(createHmac("sha256", secret).update(rawBody).digest("base64url"));
      const given = Buffer.from(signature);
      return expected.length === given.length && timingSafeEqual(expected, given);
    }
    
    // Register this route before any app.use(express.json()), which would consume the raw body.
    app.post("/webhooks/stackone", express.raw({ type: "application/json" }), (req, res) => {
      if (!isSignatureValid(req.get("x-stackone-signature"), req.body, SIGNING_SECRET)) {
        return res.sendStatus(401);
      }
      const { event, account_id, record_id, event_data } = JSON.parse(req.body.toString());
    
      if (event === "workday_list_workers.updated") {
        startLeaverCheck(account_id, record_id, event_data);
      }
      res.sendStatus(200);
    });
  6. Every action call lands in the StackOne dashboard's logs, filtered by customer and linked account. To show the same activity in your own product, pull it from the Logs API (opens in a new tab).

Connectors and actions. Cover every system your customers run.

Start from connectors StackOne builds and maintains. When a customer runs something else, build the connector, or change one of ours to fit their setup.

570+connectors

35,000+actions

Plus any remote MCP server you add as a connector. Every connector runs on the Agent Execution Engine.

Every action is tested by our QA team against hand-curated synthetic data, before it ships and after every change.

Platform benchmark: 399 business tasks across 15 connectors, the same model on every platform. Other platforms is the average of other connector SDKs and MCP servers.
  • Build a connector that doesn't exist yet

    The AI Connector Builder researches the API, writes the connector and tests it against a real account.

  • Change one that does

    Pull any StackOne connector, add a customer's custom objects or a new action, and push your version. Your customers get it, nobody else does.

npm install -g @stackone/cli
stackone init  # saves a profile with your API key

# Start from StackOne's Workday connector
stackone pull --connector workday --profile production

# Add the customer's custom fields, then check and try them
cd connectors/workday
stackone validate .
stackone run --profile production \
  --connector workday.connector.s1.yaml \
  --account-id <customer account> --action-id <action id>

stackone push . --profile production

Webhooks and synthetic events. Events from every system, with or without webhooks.

Where a system has webhooks, StackOne sets them up in each customer's account. Where it doesn't, StackOne creates synthetic events from synced data. Your agent hears about every change at one endpoint.

  • Webhook setup in every customer's account

    When a customer connects, StackOne registers the subscription in their system wherever the system allows it.

  • Polling and diffing for systems without webhooks

    Turn on Data Sync for a list action and StackOne compares each run with the last, then sends created, updated and deleted events.

  • Signing and retries

    Every delivery is signed with HMAC-SHA256. Failed deliveries retry up to 20 times, backing off from 5 seconds to every 10 minutes.

  • One endpoint for every customer

    Each event carries the customer's account ID, so one handler serves every customer and every system.

Your endpoint POST /webhooks/stackone
  • ServiceNow · Incident CreatedNorthwind Native 09:14:02
  • workday_list_workers.updatedCastell Health Synthetic 09:15:00
  • Jira · Issue CreatedMeridian Bank Native 09:15:21
  • greenhouse_list_applications.createdNorthwind Synthetic 09:15:40
  • Salesforce · Account UpdatedCastell Health Native 09:16:08
  • netsuite_list_invoices.deletedMeridian Bank Synthetic 09:30:00

Tool discovery, prompt injection defense and Deep Query. Agents that stay accurate as you add tools, and get better over time.

Tool search keeps the right actions in front of your agent however many tools and use cases you add, and its accuracy improves with use. Turn on Defender and PII redaction to screen tool results and strip personal data.

Defender and PII redaction

Defender, StackOne's prompt injection defense, catches instructions hidden in tool results before your agent reads them. Add a Redact PII rule and PII redaction removes personal data from tool results; turn on Advanced Logs to keep it out of logs as well.

+79% vs next best

GraySwan IPI Arena · attacks in tool results caught

Deep Query answers in one call

Deep Query filters and counts every synced record in one call, with nothing paged through your agent's context.

workday_list_workers_s1query

aggs: headcount by department

  • Engineering 412
  • Sales 268
  • Finance 96
  • People 54

Integrations from your backend. The same actions, without an agent.

Keep your own database in sync with each customer's systems, even ones with no webhooks, and call any action from your backend over RPC.

How a backend keeps its own data in sync through StackOne. Each customer links their own accounting system, for example Northwind on NetSuite, Castell Health on Xero and Meridian Bank on FreshBooks. StackOne runs Data Sync on the netsuite_list_invoices action as often as every 15 minutes, compares each run with the last, and sends events such as netsuite_list_invoices.updated; systems that send their own webhooks pass them through. Your webhook endpoint receives each event, signed with HMAC-SHA256, retried on failure and carrying the customer's account ID, and your backend writes the change to your database keyed by account. Your product reads its own database to show Northwind's invoices. Separately, your backend sends action requests to StackOne over POST /actions/rpc to read or write data on demand, for example netsuite_list_invoices or netsuite_update_invoice, using Northwind's linked account. Each action result returns in the response; signed change events arrive separately at your webhook endpoint.

Customer story. Drata went from its first integration in 10 days to one a day.

"StackOne's platform and team made it possible to move at a pace we'd never seen before."
Faraz YaghoutiSenior Director of Product, Drata
Read the Drata story
  • 100+integrations deployed
  • 10 daysto the first integration
  • 1 a daysustained pace
Drata's user access review product

Security and deployment. Your brand, your controls, your cloud.

A connector profile per customer

Choose the actions each customer's agent can use, the sign-in it uses and what syncs, in the dashboard or through the connector profiles API (opens in a new tab). Tool Policies can restrict fields and mask data on top.

Your brand, not ours

Theme the Hub in your colours and hide StackOne's links. Use your own OAuth app (opens in a new tab) so the consent screen shows your name, or let each customer's tenant admin set up theirs.

Credentials StackOne manages

StackOne stores each credential, refreshes it, and signs every request, so your agent never handles one. Bring your own key on Enterprise. See agent authentication.

  • TLS 1.2 or later on every call out
  • Credentials stored encrypted
  • Refreshed before they expire
  • Never sent to an agent

Run it where your customers need it

Pick the region per project, move to a single-tenant dedicated account, or host StackOne in your own cloud. See deployment options.

Customers. What SaaS teams say about StackOne.

  • "Direct integrations are central to our UAR product. The challenge was how to scale by providing the most integration options."
    Faraz YaghoutiSenior Director of Product, Drata
  • "StackOne is a game-changer — we launched 6 enterprise HRIS integrations in a few weeks."
    Anthony PetaneDirector of Product, Localyze
  • "We've seen major improvements in data quality since migrating to StackOne from another platform."
    Alex SantosCTO, Reachdesk

Recognized for performance. Loved for simplicity.

G2 High PerformerG2 Easiest To Do Business WithG2 LeaderG2 Users Love UsG2 Users Most Likely To RecommendG2 Easiest Admin

Recognized for performance. Loved for simplicity.

FAQ. Questions about embedded AI agent integrations

Ship your agent with the integrations your customers ask for.

Start free on OEM Core, or talk to us about your product and your customers' systems.