Sumeru doesn't replace your tools — it connects them. Every system speaks to every
other system through one runtime, one audit log, one identity layer. Every connection
has explicit directionality: read, write, or both.
REST API for event ingest from any front-end. Outbound webhook subscriptions for autoaction.applied / autoaction.failed events.
OpenAPI spec for client generation
HMAC-SHA256 signed outbound payloads
Per-shop API keys with scope-minimization
Exponential backoff + dead-letter after 4 attempts
02Connection primitives
Built for the failure cases, not the happy path.
Throttle, retry, dead-letter, idempotency, audit. Every connection inherits the same operational primitives.
Throttle
Token bucket per platform
Self-throttling helpers. Routes can't bypass. Cost-aware where the platform exposes cost (Shopify GraphQL).
Retry
Exponential backoff · 4 attempts
Failures retry with jitter. Permanent failures route to dead-letter queue with full payload + traceId.
Idempotency
Keyed inbound + outbound
Webhook duplicates rejected. Outbound mutations carry idempotency keys where the platform supports them.
Audit
365d default retention
Every cross-system action writes a plain-language audit row. Searchable by engine, action, severity, traceId.
Need a connection
that isn't here?
The public REST API + outbound webhook system can connect Sumeru to anything.
Common requests (Klaviyo, Segment, Mixpanel, Snowflake, dbt) are roadmap or already prototyped.