1. Scenario Overview
The standard open API and webhooks and event subscriptions cover most integrations. Some customers still need their own page or workflow inside the platform UI — contract approval, or a ticketing system. Plugin integration and open extension points on the SimtoLink IoT Cloud Platform are a controlled way to extend the product: mount an iframe or a micro-frontend on a given route, add items to the sidebar, and open an extra tab on the order detail or SIM detail that loads an external URL with an SSO token. Every extension is limited by a domain allowlist and CSP, which keeps XSS and data leakage in check.
The model follows what Salesforce and DingTalk's open platform already do. Extensions are versioned. An upgrade has to stay compatible. If the extension fails, a fallback leaves the core product usable.
2. Core capabilities
Extension-point catalog
The docs list each extension-point ID, the context it passes (ICCID, order number), and the event callbacks. You pick a point and set the URL.
SSO and tokens
The iframe URL carries a short-lived JWT that states the user, the tenant, and the permissions. Identity lines up with OAuth and SSO.
Automation
After a business event, a webhook can open the extension page or call an external RPA job. Scripted operations continue in the SDK and command-line tool.
Ecosystem
Certified plugins — an e-signature provider, an SMS vendor — can be listed after the platform reviews them, and tenants then choose which ones to turn on.
3. Embedded pages and the brand theme
Embedded pages should follow the tokens in Brand assets and themes so they look like part of the console. A transparent iframe background is the other way to blend in.
4. Where teams use it
- Contract approval on the SIM detail page: An iframe on the SIM activation detail points at the contract system. Staff finish activation and the linked contract review without leaving the page. The SSO token signs them in, so they do not authenticate twice.
- Ticketing next to the order: The order detail loads an external ticket tab. Support reads the ticket and the SIM status in one place, which cuts the copy-paste mistakes that come from hopping between systems.
- ERP and MES after activation: A SIM activation webhook starts an external RPA job that writes the result back into the ERP materials module. The IoT SIM and the production asset record stay in step, and nobody retypes the activation.
5. How to put it in place
Host the extension page on its own highly available deployment so a slow partner page does not drag the platform down. Scan third-party URLs on a schedule, and watch the iframe load-failure rate.
6. What the extension model changes
Plugins and open extension points sit between a standard platform and the processes a large customer already runs — contract approval, tickets, ERP. A published catalog and versions mean a platform upgrade does not break plugins already in use. The sandbox, a domain allowlist plus CSP, draws a clear line around data when a third party is embedded.