Aderant Expert (on-prem) → Clio Operate / Sharedo (cloud). Aderant Expert has no OAuth (NTLM only), so a proxy/agent must sit on the client network — that is why the client-side install exists.
Client env On-premise install
We install on the client network · outbound-only
Aderant Expert
The firm's practice-management system. SQL Server database + REST APIs behind NTLM (no OAuth → cannot be called from the cloud directly). The source of truth we read matters, clients and employees from.
Aderant SQL API agent read
Queries the Aderant SQL Server (clients, matters, employees, dynamic table/view reads). Ships as an MSI / Windows service (WinSW) or Docker. This is the read engine behind every lookup and duplicate-check.
Aderant REST / CRUD proxy write
NTLM proxy that wraps Aderant Expert's REST APIs so the cloud can call them as the right account. Needed for write-back (create/update in Aderant) and richer record fetches.
Outbound tunnel
Outbound-only connection that lets the hosted proxy reach the on-prem agent — no inbound firewall holes.
Alterspective Hosted services
We host and run · Coolify / shared platform
API Proxy / Orchestrator readwrite
The brain. Single backend the portal and Sharedo call. Resolves per-org config, talks to the on-prem SQL agent (via tunnel), writes matters/parties into Sharedo, runs reconcile and the embed JWT handoff. Serves /api/v1/*.
Import Portal
The human UI — search a matter, preview, map work-types and participant roles, resolve duplicates, import, history, per-org settings. Calls only the API Proxy for Aderant/Sharedo data.
Keystone — identity
Login and org resolution for the portal; OAuth for the backend MCP surfaces. Fails closed.
Supabase — config and history
Stores each org's connection config (tunnel URL/keys, Sharedo creds, mappings) and the import audit history.
Synapse — AI mapping
In-house GPU inference for AI mapping authoring. Optional; off when no key.
Into the client tenant
We deploy config + widgets into Sharedo / Clio
PMS Sync embed widget
Hosts the Import Portal inside Sharedo via iframe with signed-JWT SSO — runs as the logged-in Sharedo user. Brokers portal⇄Sharedo API calls through the proxy convention.
Linked Services
Sharedo's outbound connectors (shared-secret) that point at our hosted proxy and the on-prem agent. Inject the API key server-side; secrets never reach the browser.
Import page + widgets
The import surface (embed + PMS Matter Import action) plus ops/diagnostic widgets: Monitor, DB Logs, Name and Client Search.
Imported records created here
Aderant matters land as Sharedo work items with mapped clients, parties, case team, work-type and stored Aderant IDs for future two-way sync.
x-correlation-id Portal → Proxy → SQL API
Request flow — importing a matter
- Login. Sharedo user opens the PMS Import page; the embed widget mints a short-lived JWT via the API Proxy's
/api/embed/handoffand iframes the Portal (SSO, no second login). - Find. User types an Aderant matter number. Portal →
GET /api/import/matters/searchon the API Proxy. - Reach on-prem. The Proxy calls the SQL API agent across the Azure Relay / ngrok tunnel, which reads the live Aderant SQL Server.
- Preview and map.
POST /api/import/matter/{uno}/preview→ mapped work-type, participants, duplicate warnings, field mappings. User fixes and the mapping is remembered.
- Import.
POST /api/import/matter/{uno}→ the Proxy writes the matter + ODS parties into Sharedo via the Sharedo API (as the user). - Write-back (Phase 2). For create/update into Aderant, the Proxy calls the on-prem REST/CRUD proxy (NTLM).
- History and reconcile. Import logged to Supabase; scheduled
/api/import/reconcileclose-syncs Aderant status → Sharedo phase. - Config. Per-org connection + mappings live in Supabase; auth throughout is Keystone OIDC.