Every enterprise API the appliance can reach. Each connector owns its secret in the on-box vault — credentials are entered by the tenant admin, never pasted into prompts or agent config.