Skip to main content
The Malbek integration connects your Malbek Contract Lifecycle Management (CLM) tenant to Aperium so agents can search and read contracts, templates, and clickwrap agreements, and — with approval — create and update contracts and move them through their lifecycle. Malbek is a tenant-wide connection. An admin configures it once with a server-to-server OAuth 2.0 client-credentials app; there is no per-user linking. Every user reaches Malbek through the single shared connection, subject to your access-control policies. On the user side the tile shows Managed by your admin.

​
What agents can do

Read

  • Contracts — search contracts, read contract detail, read live dropdown (list-of-values) observations
  • Templates — list templates and read a template’s full field/section schema
  • Clickwrap — search clickwrap templates and agreements, read a signed clickwrap document
  • Datatables — list configured datatables

Write — approval-gated

  • Author — create contracts and amendments, update contract fields, add sections and associations
  • Lifecycle — promote or demote a contract’s stage (demotion is destructive)
  • Access — grant contract access to users
  • Datatables — bulk-import datatable rows
  • Payments — record contract payments (config-gated writeback)
Every write tool is approval-gated. Create / update / lifecycle writes run as asynchronous BoundJobs: Aperium shows the exact change for a human to approve, submits it, and returns a request handle the agent polls until the operation completes or fails. Reads run directly, without a prompt.

​
What you’ll need

Before configuring the connection, your Malbek tenant admin should have:
1

A registered Malbek API client

An API client in your Malbek tenant with the OAuth 2.0 client-credentials grant enabled, which issues a Client ID and Client Secret pair. Aperium uses server-to-server credentials — there is no interactive Malbek login.
2

A requester username

A Malbek user that acts as the originator of write requests. The create_contract and create_contract_amendment tools require a requester, so this is needed for the authoring surface.
Malbek issues API clients and requester users through your Malbek tenant administration. If you don’t have these yet, request them from your Malbek administrator or Malbek support before continuing.

​
Setup

1

Open the Malbek setup form

In Aperium, go to the admin onboarding flow (first sign-in) or the Admin Console’s MCP Servers tab (any time after), open the Contract Management category, and choose Malbek. The Connect Malbek form opens.
2

Fill in the connection details

Enter the values from your Malbek API client:
  • Malbek Base URL. Scheme and host of your Malbek tenant, with no trailing slash (for example https://acme.malbekcloud.com). Every API call and the OAuth token request is issued against this host.
  • Requester Username. The Malbek user who acts as the originator of write requests (for example api-user@acme.com).
  • Grant Type. Leave as client_credentials unless Malbek support directs otherwise.
  • Client ID. The client ID issued by Malbek for this integration.
  • Client Secret. The matching client secret.
  • Token Endpoint. The path of the OAuth token endpoint, joined onto the Base URL. The Malbek default is /restapi/oauth2/token.
3

Enable the connection

Click Enable. Aperium requests a token from the Malbek token endpoint to confirm the credentials, then makes the connection available to your users under your access-control policies.

​
What users see

Because Malbek is tenant-wide, users do not link a personal account. The Malbek tile on the Connect your tools / Integrations page shows Managed by your admin, and the contract tools become available to any user your policies allow.

​
Notes

  • Two ready-made agents. Malbek ships a read-only CLM analyst agent and a full read-and-write CLM author agent, so you can grant analysis-only access separately from authoring.
  • Approvals are required for every write. The manifest declares approval on every write capability; the host’s approval prompt gates each write before it is submitted to Malbek. Stage demotion is marked destructive.
  • Payments writeback is config-gated. The record_contract_payment surface stays off until your Malbek admin confirms the payment storage model, so it won’t appear until it’s configured.