Connect Capture to Partner Tools
Choose PAT or OAuth access, understand Zapier and browser-extension contracts, and review partner imports safely.
Choose PAT or OAuth access, understand Zapier and browser-extension contracts, and review partner imports safely.
Use a personal access token for a script owned by your company. Use OAuth 2.0 when another company's app needs delegated Capture access. Both credentials are bound to one company and one Sandbox or Live environment, and both use the same Capture API scopes.
Capture OAuth uses the Authorization Code flow with mandatory PKCE S256:
Only digests are stored. Suspending the client, removing the authorizing member, or revoking
the credential stops later API calls. Every write also needs an Idempotency-Key; reusing a
key for different input is rejected instead of creating a second record.
Open Settings → Marketplace, then choose Google Business Profile, Meta Business, or LinkedIn. Only an owner or administrator can start or replace the OAuth connection. Finish the provider consent flow, return to JobsiteOn, and choose the exact destination Capture may use:
You must make this choice even when the provider returns only one destination. Capture never silently selects the first account. Destination lists load in bounded pages; continue loading until the intended destination appears. A connection remains Pending and cannot publish until you save an exact destination. The saved connection then shows the selected destination, granted publishing scopes, and Active, Expired, or Error health.
If the provider revokes a token, removes a required permission, or the connected member loses access to that exact destination, Capture holds later posts and asks an owner or administrator to reconnect. Reconnecting does not authorize a different Page, location, or organization: review and save the exact destination again.
The Capture API supports the bounded contracts needed by a Zapier connector and an authenticated photo-picker extension. URL-based photo imports accept only supported images, use HTTPS on the default port, resolve and pin a public network address, re-check every redirect, and enforce time and file-size caps. Private, loopback, link-local, metadata, and reserved destinations are rejected.
The extension may request original or annotated renditions only within the credential's company, environment, project, and scopes. It does not make a private bucket public.
Marketplace or extension-store availability is a separate certification step. Do not install an unpublished connector from an emailed file or assume a setup card means store approval. Use it only after Settings → Capture → Readiness reports the Zapier listing or signed browser distribution as certified.
A company owner or administrator can open Settings → Connected accounts → Partner program to submit a public-HTTPS app profile for review. Sandbox and Live submissions stay separate. The form records the provider, support and privacy links, categories, capabilities, and requested permissions; submitting it does not create an OAuth connection or grant access to company data.
JobsiteOn administrators review each version as Submitted, In review, Approved, or Rejected. A rejection includes a review note. Correct the same rejected submission and resubmit it instead of creating a shadow copy; JobsiteOn keeps each submitted version's details plus every review transition and note. More than one company may submit the same app slug for review, but the first approved listing reserves that slug in its environment; a later competing approval must choose a different slug. An approved app appears on the next Marketplace load only in the matching environment as a non-connectable external listing with safe documentation and website links. Provider certification, credentials, and any later OAuth connection remain separate gates.
Capture uses the company's existing Google Calendar connection rather than storing a second OAuth credential. When calendar sync is enabled on an active project with a start time, Capture creates or updates its Google event. An event added directly to the dedicated JobsiteOn calendar creates one Capture project, and repeating the same provider change does not create a second project. Names, notes, locations, starts, and ends then stay aligned in both directions.
Calendar status distinguishes Sync disabled, Schedule required, Connection required, Two-way sync disabled by rollout, Awaiting next sync, Needs attention, and Linked. It does not treat a connected account by itself as a completed project link. The existing Job calendar integration remains separate, so a Capture project does not need to be linked to a Job for this workflow.
Deleting the Google event disables its Capture link but keeps the project and its evidence. Disabling, archiving, or deleting the Capture project removes the link but keeps the Google event. Re-enabling an intentionally detached project restores its known event instead of creating a duplicate. If the provider event itself was removed, re-enabling creates a new event on a later sync.
EagleView, HOVER, Roofr, and magicplan artifacts can enter the reviewed partner-intake queue by API. Each submission needs a Capture project, downloadable HTTPS PDF or supported image, and a stable idempotency key. It remains Received or Reviewing until a company administrator accepts or rejects it. Acceptance imports one private project asset through Capture's normal scanning and processing path. If processing fails, the accepted record shows the error and can be retried without creating a duplicate. A supplied provider order link opens the provider's site; it does not mean that JobsiteOn placed or completed an order.
Sending a report to the project's Capture email address remains available too. Email attachments use the normal scanned email-in path and show Email in provenance; they do not claim a certified automatic provider connection. Provider credentials, payload certification, and the commercial partner relationship must be complete before a provider-specific automatic importer is described as available.
Community checklist packs use the same reviewed intake. Acceptance creates one editable company library template while preserving an immutable first version and the contributor's name, organization, source link, and license when supplied. Retrying the same submission returns that pack instead of creating another, and never grants the submitter access to another company's templates or projects.
Enterprise owners and administrators can open Settings → Capture → Enterprise controls to create, edit, activate, or deactivate locations; assign company members and Capture projects; manage each location's public label, branding, and service areas; and review complete project, asset, and checklist rollups. Large assignment and template lists load in bounded pages, so choices after the first page remain available without mixing companies or Sandbox and Live data.
The same page manages franchise packs. Creating a pack bundles company checklist templates, project templates, policy defaults, and optional corporate locks. Editing publishes the next version, while existing pinned project and checklist instances keep their recorded versions. Unlocked policy paths remain available for local additions and overrides. Locations and packs stay inside one company; they do not create a parent/child company hierarchy or depend on an external franchise provider.
Capture uses JobsiteOn's platform-wide, company-and-environment-scoped OIDC, SAML, and SCIM 2.0 rail. The Owner configuration console is available for a controlled rollout; a saved connection alone does not mean the production identity provider is certified. Production database and environment rollout, provider credentials and acceptance testing, and canary evidence must still be complete before enforcement. Owners should follow Configure Enterprise SSO and SCIM for domain verification, safe-role, SCIM token, testing, and break-glass guidance.
Did this answer your question?