Multimodal RAG Platform · View 09 of 16
Integration Architecture
Every inbound and outbound interface, with protocol, cadence and direction.
Copy
PNG
PDF
⋯
Editable source
SVG
draw.io
All views
Inbound — who calls us
Inbound — who calls us
Web Application
Web Application
Enterprise Search
Enterprise Search
Teams / Slack Bot
Teams / Slack Bot
SharePoint Connector
SharePoint Connector
Object Store Drop
Object Store Drop
Multimodal RAG Platform
Multimodal RAG Platform
API Gateway
OIDC, quota, schema
API Gateway...
Query API
OpenAPI 3.1, SSE
Query API...
Ingestion API
presigned upload
Ingestion API...
Outbound — what we call
Outbound — what we call
Claude API
Claude API
Embedding API
Embedding API
Speech-to-Text
Speech-to-Text
Identity Provider
Identity Provider
SIEM
SIEM
HTTPS + OIDC
HTTPS + OIDC
REST /v1/query
REST /v1/query
signed webhook
signed webhook
delta crawl, 15 min
delta crawl, 15 min
event on upload
event on upload
generation + vision
generation + vision
batched embed
batched embed
async job + callback
async job + callback
OIDC discovery, JWKS
OIDC discovery, JWKS
audit stream
audit stream
Integration Architecture — Every Interface
Integration Architecture — Every Interface
Application we own
Application we own
External / third party
External / third party
Interface / broker
Interface / broker
synchronous
synchronous
batch
batch
event / async
event / async
Every outbound call leaves through the model gateway or the egress proxy. No direct SDK calls from services.
Every outbound call leaves through the model gateway or the egress proxy. No direct SDK calls from services.
v 1.0 · owner Integration Architecture
v 1.0 · owner Integration Architecture
Text is not SVG - cannot display
Inbound
Web application over HTTPS with OIDC
Enterprise search calling REST /v1/query
Teams and Slack via signed webhook
SharePoint delta crawl every 15 minutes; object-store drop on upload
Outbound
Claude API for generation and vision
Embedding API, batched
Speech-to-text as an async job with callback
IdP discovery and JWKS; audit stream to SIEM
Rule
Every outbound call leaves through the model gateway or egress proxy
No service holds a provider SDK credential directly
One place to enforce allow-lists, budgets, retries and redaction
