Connector Types and Capabilities
Use this page to decide what a DFS Lite connector can do today. The matrix reflects the connector implementations on the current product runtime, not every action that a wizard or connector detail page might display.
The backend capability contract is authoritative for connector actions. The wizard and connector detail page consume the selected type and mode from that contract and fail closed when a capability response is missing or malformed. This matrix explains the same contract for operators.
How to read the matrix
- Yes means the current connector implementation performs the operation.
- Limited means the operation exists with the stated boundary.
- No means the operation is unsupported, returns no data, or is a no-op in the current runtime.
- Preview means
POST /api/v1/dfslite/connectors/{id}/preview. It is separate from a poll read and from DFS Pro dataset preview. - On-demand sync requires a running connector and enabled mapping source paths. It invokes the connector's poll-read path; it does not consume subscription events.
Current DFS Lite capability matrix
| Connector | Test / configuration validation | Browse | Poll read | Subscribe | Preview | On-demand sync | Writeback | Authentication | Health semantics | Known limits |
|---|---|---|---|---|---|---|---|---|---|---|
| OPC UA | Validates the exact policy, message-security mode, and user-token combination before connecting, then measures a server handshake. | Yes. Browses from Objects with configured recursion depth. | Yes. Reads configured node IDs. | Yes. Uses monitored items. | No. Connector preview is not implemented. | Yes. Reads configured nodes when the connector is running and mappings exist. | Yes. Subject to server node permissions and the writeback safety path. | None uses no message security with anonymous or username/password auth. Basic256Sha256 uses SignAndEncrypt with anonymous, username/password, or X.509 user authentication; all secured connections also require a client application certificate and server trust list. | HEALTHY when the Milo client reports connected; otherwise degraded or unhealthy. | Basic256 and other policies are unsupported and fail closed. Certificate material is resolved from tenant-scoped operator mounts by secret:// reference; connector JSON never contains private keys. Browse depth is capped at 10; large node lists are not batch-chunked. |
| BACnet | Opens BACnet/IP and performs Who-Is/I-Am discovery. The test can pass when other devices reply even if the configured device ID is missing. | Limited. Lists discovered devices and configured object-type groups, not a complete object inventory. | Yes. Reads present value for requested objects. | Yes. Requests COV and also uses a polling fallback. | No. Connector preview is not implemented. | Yes. Poll-reads mapped objects. | Limited. Writes output/value objects; input objects are rejected as read-only. | No authentication fields in the DFS BACnet/IP connector. Control access remains a network and device policy responsibility. | Target device found is healthy; other/no discoveries are degraded; disconnect or discovery error is unhealthy. | BACnet/IP only. Validate device ID after a passing test and confirm COV reachability to the runtime's UDP port. |
| Modbus | Tests TCP socket reachability only; it does not validate the unit ID or register map. | Limited. Shows the configured register ranges. | Yes. Reads configured holding/input registers, coils, and discrete inputs. | Limited. Scheduled polling is exposed through the subscribe interface; it is not a device-pushed subscription. | No. Connector preview is not implemented. | Yes. Poll-reads mapped registers. | Limited. Single coil and single holding-register writes; input and discrete points are rejected. | No protocol authentication fields. Use network isolation and the writeback safety path. | Healthy only when connected and the first configured range can be read; a read failure is degraded; disconnect is unhealthy. | DFS Modbus is Modbus TCP only. Serial RTU is unsupported. Protocol Gateway can separately use RTU-over-TCP, but that is not a DFS Modbus transport mode. |
| MQTT | Connects to the broker. It does not validate that configured topics produce messages or that payloads parse. | No. Topics are configured manually. | No. read() returns an empty list. | Yes. Inbound subscription with configured topics and QoS. | No. | No. Manual sync is rejected before poll read because subscription events are not a poll source. | No. Publish is not implemented. | Anonymous or username/password; tcp:// or ssl:// broker URL. No connector fields for client-certificate authentication. | Healthy only while the MQTT client reports connected; otherwise unhealthy. | MQTT is inbound subscribe-only today: no browse, poll read, on-demand preview/sync, or publish. PM-547 is future outbound publish work. |
| REST | Requires a base URL. The test tries HEAD, then GET after an HTTP response error. | No. Response fields are configured manually. | Yes. Executes the configured HTTP method and parses JSONPath output. | No. | No. Connector preview is not implemented. | Yes. Poll-reads the configured endpoint. | No. There is no DFS writeback implementation; a configured HTTP method is part of inbound retrieval, not writeback. | None, Basic, bearer token, or OAuth 2.0 client credentials. | A successful authenticated GET is healthy; request failure is unhealthy. | Pagination supports the configured offset/page pattern only. Read and parse failures can produce an empty result, so inspect logs and sync counts. |
| CSV / Excel | Loaded-data readiness. Test fails while the in-memory file buffer is empty and succeeds after CSV/Excel data has been parsed. | No. | Limited. Returns the last file already parsed into the connector's in-memory buffer; it does not poll a file location. | No. | No. Connector preview is not implemented. | Limited. A running connector with loaded data and mappings can run on-demand sync. It does not watch a file location. | No. | None. File access is controlled by the upload/import path and tenant permissions. | Degraded while no data is loaded; healthy after a file has been parsed into the connector buffer. | CSV is a file import, not a watched or always-connected source. Validate the actual file, headers, encoding, timestamps, and row counts during import. Loaded data is runtime memory and must be reloaded after connector restart. |
| JDBC | Initialization parses exactly one read-only SELECT or read-only CTE before opening the pool; the connection test then runs bounded SELECT 1. | Yes. Uses bounded JDBC metadata reads for tables, views, and columns. | Yes. Executes the configured query with read-only JDBC transaction settings and supports lastSync, from, and to parameters. | No. | No. Connector preview is not implemented. | Yes. Executes the same bounded poll-read path. | No. | Username/password must be provided through connector credential fields, not the JDBC URL. Use a dedicated SELECT-only database account. | Healthy when the bounded SELECT 1 probe succeeds; otherwise unhealthy. | Shipped drivers are PostgreSQL and Microsoft SQL Server. MySQL is excluded from the template catalog and direct use of its unavailable template is rejected. Administrator ceilings enforce timeout, rows, fetch size, columns, cells, per-cell bytes, total bytes, query length, and parser time; tenant values can only lower them. Diagnostics collapse database paths and URL parameters. Database grants remain the final read-only boundary, especially for SQL Server. |
| Fabric — OneLake | Uses a client-secret service principal and tests by listing the workspace root. | Yes. Lists OneLake paths. | Limited. Returns .parquet file inventory as parquet-file-ref points. | No. Pull-only. | No. OneLake mode returns no decoded-row preview. | No. Manual sync is rejected; file inventory is available only through the connector read/browse contract. | No. | Microsoft Entra tenant ID, client ID, and client secret. | Healthy when the workspace path-list probe succeeds; otherwise unhealthy. | OneLake mode is file inventory/reference discovery. Tabular rows and on-demand sync require Fabric SQL endpoint mode or a separate export/materialization pipeline. |
| Fabric — SQL endpoint | Validates that the driver is packaged and that the table and allowlisted column identifiers are configured; test reads one row. | Yes. Shows the configured table and allowlisted columns. | Yes. Reads allowlisted tabular columns. | No. Pull-only. | Yes. Returns up to 25 tabular rows from the configured SQL endpoint. | Yes. Reads tabular values through the SQL endpoint. | No. | JDBC URL plus SQL endpoint username/password; the Microsoft SQL Server driver is the default. | Healthy when an SQL SELECT 1 probe succeeds; otherwise unhealthy. | Default read cap is 1,000 rows and hard cap is 10,000; query timeout defaults to 30 seconds and is capped at 300 seconds. Only configured identifiers and columns are queried. |
Connector-specific preparation
| Connector | Prepare before configuration |
|---|---|
| OPC UA | Endpoint, supported policy/auth combination, application URI, tenant-scoped certificate references for secured connections, node IDs, and browse depth. |
| BACnet | BACnet/IP host/port, device instance, object types, COV lifetime, and network route. |
| Modbus | TCP host/port, unit ID, register ranges/types, timeout, poll interval, and approved writable points. |
| MQTT | Broker URL, optional username/password, topics, QoS, payload format, and TLS requirement. |
| REST | Base URL, HTTP method/path, auth mode, JSONPath fields, pagination, and source rate limits. |
| CSV / Excel | Actual file, delimiter, encoding, header and skipped-row rules, timestamp column, and date format. |
| JDBC | PostgreSQL or Microsoft SQL Server URL, least-privilege credentials, configured query, timestamp/incremental columns, and expected volume. |
| Fabric — OneLake | tenantId, clientId, clientSecret, workspaceId, and deltaPath for the files to inventory. |
| Fabric — SQL endpoint | sqlEndpointJdbcUrl, SQL endpoint credentials, sqlEndpointTable, sqlEndpointColumns, optional schema/timestamp column, row limit, and query timeout. |
Adjacent integration boundaries
OPC UA security material
For Basic256Sha256, set applicationUri, applicationIdentityRef, and trustListRef. X.509 user authentication also requires userIdentityRef. Application and user identities must be different unless an operator explicitly enables allowIdentityReuse. An optional revocationListRef enables CRL validation.
References use secret://<name>. The runtime resolves them below the configured factverse.dfs.opcua.security-root as follows:
<security-root>/<tenant-id>/<name>.p12
<security-root>/<tenant-id>/<name>.password
<security-root>/<tenant-id>/<name>.crl # revocation references only
Identity and trust stores use PKCS#12. The .p12 and .password files must be owner-only, the root is mounted read-only into the backend, and symlinks or paths outside the tenant directory are rejected. The client application certificate URI must match applicationUri. Missing, expired, mismatched, untrusted, or revoked material fails the connection without falling back to an insecure endpoint.
SNMP and Modbus RTU-over-TCP
SNMP is managed through Protocol Gateway. It is not a DFS ConnectorType, so do not create or document an SNMP DFS connector. PM-1734 tracks a unified product entry; until that ships, Protocol Gateway remains the management boundary.
Protocol Gateway also has a separate Modbus RTU-over-TCP adapter. This carries RTU frames over a TCP socket. It is not serial RTU and it is not the DFS Modbus connector, which remains TCP-only.
ECM inbound connectors
ECM inbound connector drivers currently exist for LOCAL_STAGING and S3. Historical tenant-owned DCS_COMPAT rows remain visible through list/get for migration and audit. Creation, update or reclassification, probe, mount create/update, preview, and sync are rejected; an explicitly authorized deletion remains available. No legacy DCS runtime or driver is reachable.
The ECM CMIS API exposes FactVerse content to CMIS clients. It is not an inbound CMIS connector driver. Do not claim that FactVerse can currently create a CMIS source connector and import from another CMIS repository.
Remaining planned work
| Planned work | Not available today |
|---|---|
| PM-547 | MQTT outbound publish/writeback. |
| PM-1729 | BACnet interoperability evidence and library decision. |
| PM-1734 | Unified SNMP product entry without the current Protocol Gateway/Data Integration navigation split. |
Do not describe planned work as a current connector capability.
Next step
Use Connector Configuration to prepare the fields for a supported connector, then use Browse and Preview only for the operations marked available above.