Connectors now pass through custom headers

A small but useful change to connectors: the security broker that sits between your apps and outside APIs now passes through custom request headers — and a raw request body — from the app.

Why it came up: a user building against Azure DevOps hit a wall. Updating a work item there needs a specific content type (application/json-patch+json) and a body that’s a JSON array, not a plain object. Croft’s standard call — where you pass a set of params and the broker turns them into a query string or a JSON object — couldn’t express that. So the app couldn’t finish the job.

Now it can. When your app calls a connector, it can add two optional fields:

headers — extra headers forwarded to the API, like a specific Content-Type.
body — a raw body sent verbatim, in place of params, for APIs that want something other than a plain object.

The important part is what doesn’t change. The connector’s credential is still held by Croft and attached to the request last — after your headers — so a custom header can never override, replace, or leak the key. The broker still only calls the connector’s own domain. All the security guarantees are intact; there’s just more room to talk to fussy APIs.

Like everything else on Croft, most people never touch this — your assistant writes the connector call for you. It just means a whole class of trickier integrations now works on the first try instead of the third.

The full detail, with the Azure DevOps example, is in the connectors docs.

Stake out your croft.