IndagatePLATFORM System status
PLATFORM ACCESS

Request an invitation

Tell us what you intend to deploy. The Indagate team reviews requests and creates the right shared or dedicated customer instance.
NEW CUSTOMER INSTANCE

Create a workspace

Create an isolated data partition and optionally invite its first administrator.

Required monthly estimate

The initial route uses Amazon Nova Lite on Bedrock. Enter expected usage before creating billable work.

Calculate and review an estimate before creating this instance.
TRIGGERS & WORKFLOWS

Create a governed rule

Start from a device metric, a retained model determination, an OpenCV condition or a visual prompt. Edge workflows can then alert or run a follow-up prompt; physical control remains outside their authority.

Air-quality defaults are demonstration thresholds for trend monitoring, not a life-safety alarm or regulatory determination.

Device metrics: CPU, memory and disk are percentages; temperature is degrees Celsius. Confidence values are 0–1. Model outcome strings are matched case-insensitively.
PRIVATE EDGE CAMERA

Camera snapshot

Latest authenticated tenant snapshot.

Latest available frame · not a safety-rated live view
Private S3 object · short-lived viewing URL · workspace authentication required
WORKSPACE ACCESS

Invite a member

Existing Indagate users are added immediately. New users receive a Cognito invitation email.
NEW EDGE NODE

Enrol a device

Create a 30-minute token, choose the hardware profile, then provision it without sharing your user login.
ONE-TIME TOKEN

Run on your device

This secret is shown once and expires after 30 minutes.
VERIFIED OTA

Deploy an edge release

The device will pull this private release on its next authenticated heartbeat, verify its SHA-256, activate a versioned slot, and automatically roll back if core health checks fail.

Private S3 release · 15-minute device URL · SHA-256 required
AGENT CREDENTIAL

Create a read-only API token

The token can read your fleet, releases, model provenance and hosted status through Indagate MCP. It cannot enrol devices, deploy releases or request plant actions.

READ-ONLY SCOPES devices.readreleases.readmodels.readstatus.readintegrations.readiot.read
SHOWN ONCE

Copy your agent token

Store this credential in your client secret manager. Indagate cannot show it again.

Store the token as ODDESSY_API_TOKEN in the agent or Gateway secret environment before running the setup. The copied command does not include the token.
GUIDED CONNECTION

Add an integration

Choose the tool you recognise. Indagate selects the transport and gives you a testable setup.

Bearer or Basic authentication · secret stored as SHA-256 · TLS only
GUIDED SETUP

Connect and verify

  1. Created
  2. Copy
  3. Test
  4. Ready

Copy the endpoint and credential into the system that will send events.

No production equipment is affected.
SIGNED OUTBOUND EVENTS

Add a destination

Indagate delivers a CloudEvents-style JSON envelope to a public HTTPS endpoint on port 443. Private, local and redirect destinations are blocked.

Events to send
KMS-encrypted signing secret · HMAC-SHA256 · no redirects · bounded SQS retry
SHOWN ONCE

Outbound signing secret

Store this secret in your receiver's secret manager. Indagate encrypts it with AWS KMS and cannot display it again.

Verify every request before parsing it HMAC-SHA256(secret, Webhook-Id + "." + Webhook-Timestamp + "." + rawBody) For endpoint , compare the base64 digest with Webhook-Signature: v1,<base64>, reject stale timestamps, and deduplicate by Webhook-Id.

The safe test event only verifies connectivity and signature handling. It never actuates equipment.
30-DAY AUDIT HISTORY

Outbound deliveries

Each row is the latest state for one delivery. Retrying events move to the dead-letter queue after five failed attempts.