> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Shortcut Integration

> Sync findings to Shortcut as stories

Connect Odin to Shortcut to keep security findings in sync with your team's Shortcut workspace.

<Info>
  Shortcut works a little differently from Odin's other trackers: there's no manual **Push to Shortcut** button on a single finding. Stories are created through [auto-ticketing](#auto-ticketing) or a bulk [Sync now](/platform/integrations/overview#syncing-existing-findings) instead.
</Info>

## Connecting

Shortcut has no OAuth, so connecting uses a workspace API token instead of a redirect flow.

<Steps>
  <Step title="Open Integrations">
    Go to **Management > Integrations** in the sidebar.
  </Step>

  <Step title="Generate an API token">
    In Shortcut, go to **Settings > API Tokens** and create a token.
  </Step>

  <Step title="Paste the token into Odin">
    Click **Connect** next to Shortcut and paste the token. Odin validates it against Shortcut before saving it.
  </Step>

  <Step title="Select a workflow">
    Choose the Shortcut workflow where Odin should create stories, and optionally a team to own them. The integration activates once a workflow is selected.
  </Step>
</Steps>

## Auto-ticketing

Auto-ticketing creates Shortcut stories automatically when new findings are reported, without any manual action from your team.

From the integration settings panel:

* **Auto-create tickets**: toggle on to enable. When disabled, stories are only created via [Sync now](/platform/integrations/overview#syncing-existing-findings).
* **Minimum severity**: only findings at or above this severity trigger automatic story creation. Defaults to Medium.

<Tip>
  Set the minimum severity to **High** or **Critical** if you want to keep your Shortcut workflow focused on the most urgent findings.
</Tip>

## Customising synced stories

With a workflow selected, the **Issue customization** panel on the Shortcut card shapes the stories Odin opens. On top of the shared [default assignee and labels](/platform/integrations/overview#customising-synced-issues), Shortcut adds:

* **Initial state**: the workflow state new stories open in, grouped by Unstarted, Started, and Done. Leave it unset to use the workflow's default.

Shortcut doesn't support priority mapping: stories don't carry a priority field.

## Status sync

A finding's status and its linked story's workflow state stay in sync, in both directions.

| Odin status                    | Shortcut story state                                  |
| ------------------------------ | ----------------------------------------------------- |
| Reported                       | Unscheduled (or the workflow's first unstarted state) |
| Mitigating, Needs Revision     | In Progress (or the workflow's first started state)   |
| Open for Retest                | In Review (or the workflow's first started state)     |
| Fixed & Retested, Acknowledged | Done (or the workflow's first done-type state)        |

| Shortcut story state               | Odin status     |
| ---------------------------------- | --------------- |
| In Review                          | Open for Retest |
| In Progress                        | Mitigating      |
| Any other **Unstarted**-type state | Reported        |
| Any other **Started**-type state   | Mitigating      |
| Any other **Done**-type state      | Open for Retest |

<Info>
  Fixed & Retested and Acknowledged both move a story to the workflow's Done state, so there's no way to tell them apart from Shortcut alone. Moving a story back to a Done state always maps to **Open for Retest** in Odin, not Acknowledged. Only Borg can set **Fixed & Retested**, and an inbound change is ignored once a finding already has it.
</Info>

Odin matches by state name first (`In Review`, `In Progress`), then falls back to the state's type (Unstarted, Started, Done) for a customised workflow.

### Enabling status sync from Shortcut

Shortcut has no webhook API of its own, so status changes only flow from Shortcut back into Odin once you set up an outgoing webhook by hand:

<Steps>
  <Step title="Copy the webhook URL">
    On the Shortcut card in **Management > Integrations**, copy the webhook URL shown under **Status sync**.
  </Step>

  <Step title="Create an outgoing webhook in Shortcut">
    In Shortcut, go to **Settings > Integrations > Outgoing Webhook**, paste the URL, and set a signing secret.
  </Step>

  <Step title="Paste the signing secret into Odin">
    Paste the same secret back into the Shortcut card and save. Odin uses it to verify that inbound requests really came from Shortcut.
  </Step>
</Steps>

Until the secret is saved, moving a story in Shortcut has no effect on the linked finding. Outbound status pushes from Odin to Shortcut aren't affected.

## Notes

* Stories are created in the workflow (and team, if selected) you chose during setup. Change either at any time from the Integrations page.
* Multiple issue trackers can be active at the same time. When you connect a second one (for example Shortcut and Linear together), Odin keeps new findings and status changes in sync across all active trackers.