Integration Topology
What this screen is for
The topology is a map of what your installation is connected to and whether any of it needs attention. AnkaSecure sits at the centre, inside its platform boundary, and seven integration surfaces orbit it, each reached by one spoke: HSM / Cloud KMS, Timestamping (TSA), Identity Federation, Workload Identity Federation, Email & Notifications, SIEM / XDR Forwarding and Observability Export. Colour on the map means status and nothing else; a node and its spoke are painted from the same verdict.
The screen computes no status. Every verdict is one the server stated for that surface, and the console adds only the two states the server cannot hold: Unknown, where no answer arrived, and Restricted, where an answer exists that you may not read. The map changes nothing by itself; every action on it is a link into the settings screen that holds the binding.
Four integrations are deliberately not on the map: the licence server, geolocation, the RapidAPI gateway and platform alerts, which carries no external system of its own and rides the email transport that is already drawn.
What must exist first
This is a platform screen, reached in the platform context. Its sidebar entry is shown to every platform role, because every read behind it degrades in place. Each surface is read under its own platform permission for that integration, and the deployment plane and the fleet half of a surface are read separately, so a permission you lack marks only the half it protects as Restricted, never as unconfigured. One tenant additionally needs the permission to list tenants, for the selector; when that list cannot be read the scope says so and offers no selector.
Decisions you make here
Choosing the scope
Deployment is the landing scope: the defaults you operate and how much of the fleet departs from them. One tenant asks what a single tenant is effectively bound to and where each binding came from, and needs a tenant chosen from the selector before it draws anything. The scope survives opening a surface and returning, and is kept for your account in this browser.
Reading a node
A node's status is one of Active, at least one backend is configured, as the deployment default or in a tenant; Attention, configured but not operational, declared and awaiting bind, mid-change or disabled; Not configured, nothing is declared, so the integration sends nothing; Not applicable, the server states the plane does not exist on this install; plus Restricted and Unknown.
In Deployment scope the node shows the server's own composition over both planes: Attention if either plane needs it, otherwise Active if either plane has a backend, otherwise Not configured. So a healthy default over a tenant binding that needs attention reads Attention, and the panel says which plane is unhappy; a surface configured only on tenants reads Active with no deployment default beside it. In One tenant scope the node shows the deployment plane's verdict and a note gives the tenant's own binding.
Around each node in Deployment scope, a coverage ring partitions the whole tenant population into Run your default, Have their own and Outside their Edition; the panel beside the map adds Suspended or closed, and the four counts always sum to the tenant count.
A suspended or closed tenant is reported as such whatever it configured, and a tenant with a live binding of its own is reported as diverging even when its Edition no longer entitles a new one. On a customer-operated install every tenant is entitled to every surface, so Outside their Edition is always empty here. The summary line above the map totals the bands across surfaces, and the chips emphasise the surfaces that hold each band.
Opening a surface
Selecting a node re-centres the map on that surface: it takes the middle, its binding classes become the satellites, and a ghost satellite offers the next step, Change the backend on a plane that holds exactly one, Add another binding on a plane that holds a list. Esc and All integrations return to the overview. The panel beside it states how the surface's planes combine, what the loss of the integration costs, and one card per binding with a link to its Deployment settings or Per-tenant settings.
The composition rule is a property of the surface: a tenant's own key-protection backend (always a cloud key service) or timestamping backend replaces the deployment default; a tenant's own trusted issuers are trusted alongside the deployment's; email providers form an ordered chain per plane, where the next takes over when the first fails; forwarding destinations are the deployment's plus the tenant's own, and a tenant cannot remove a deployment destination; observability backends are added to the deployment's, up to five per tenant.
Identity federation is drawn as deployment-wide, with no tenant plane, so a tenant's own identity-provider connection, configured in its Settings, is not on this map.
The loss cost is one of two postures. The operation stops for the key-protection backend, timestamping and both identity surfaces: while the backend is unreachable, the operations that need it fail. Only the record waits for email, security event forwarding and observability export: every operation still succeeds and what stalls is the outbound copy.
A surface whose reads were refused opens as Restricted, never as a ring with nothing on it.
Reading one tenant
With a tenant chosen, each node carries its provenance: Tenant's own, Tenant's own, added, Inherited from the deployment, or Deployment-wide for identity federation; Not read yet while a read is pending.
The panel lists the same, and warns on a binding inherited from your default that editing that default changes it for every tenant still on it. Give this tenant its own opens Platform Settings on that surface's per-tenant tab, as every Per-tenant settings link on this map does. The message that a per-tenant binding is available only on a higher Edition is a SaaS and dedicated SaaS control and is not shown on a customer-operated install.
How it relates to other screens
The tenants counted in the bands and offered in the selector are those of the Tenants screen:
Every link on the map opens Platform Settings, on the deployment tab or the per-tenant tab of that surface. Where you have delegated a family to a tenant, its administrator manages the same binding, and the identity-provider connection this map does not draw, on the tenant's Settings screen:
The Exchange Topology is a different map, of one tenant's business relationships rather than of the installation's integrations:
Whether the platform's own services are up is answered on System Health, the internal half of the same question: