diff --git a/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundAuth.java b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundAuth.java
new file mode 100644
index 00000000..173e03ee
--- /dev/null
+++ b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundAuth.java
@@ -0,0 +1,24 @@
+package com.cameleer.server.core.outbound;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+
+@JsonTypeInfo(use = JsonTypeInfo.Id.DEDUCTION)
+@JsonSubTypes({
+    @JsonSubTypes.Type(OutboundAuth.None.class),
+    @JsonSubTypes.Type(OutboundAuth.Bearer.class),
+    @JsonSubTypes.Type(OutboundAuth.Basic.class),
+})
+public sealed interface OutboundAuth permits OutboundAuth.None, OutboundAuth.Bearer, OutboundAuth.Basic {
+    OutboundAuthKind kind();
+
+    record None() implements OutboundAuth {
+        public OutboundAuthKind kind() { return OutboundAuthKind.NONE; }
+    }
+    record Bearer(String tokenCiphertext) implements OutboundAuth {
+        public OutboundAuthKind kind() { return OutboundAuthKind.BEARER; }
+    }
+    record Basic(String username, String passwordCiphertext) implements OutboundAuth {
+        public OutboundAuthKind kind() { return OutboundAuthKind.BASIC; }
+    }
+}
diff --git a/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundAuthKind.java b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundAuthKind.java
new file mode 100644
index 00000000..eae12dec
--- /dev/null
+++ b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundAuthKind.java
@@ -0,0 +1,3 @@
+package com.cameleer.server.core.outbound;
+
+public enum OutboundAuthKind { NONE, BEARER, BASIC }
diff --git a/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnection.java b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnection.java
new file mode 100644
index 00000000..1c281634
--- /dev/null
+++ b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnection.java
@@ -0,0 +1,39 @@
+package com.cameleer.server.core.outbound;
+
+import com.cameleer.server.core.http.TrustMode;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+public record OutboundConnection(
+        UUID id,
+        String tenantId,
+        String name,
+        String description,
+        String url,
+        OutboundMethod method,
+        Map<String, String> defaultHeaders,
+        String defaultBodyTmpl,
+        TrustMode tlsTrustMode,
+        List<String> tlsCaPemPaths,
+        String hmacSecretCiphertext,
+        OutboundAuth auth,
+        List<UUID> allowedEnvironmentIds,
+        Instant createdAt,
+        UUID createdBy,
+        Instant updatedAt,
+        UUID updatedBy
+) {
+    public OutboundConnection {
+        defaultHeaders = defaultHeaders == null ? Map.of() : Map.copyOf(defaultHeaders);
+        tlsCaPemPaths = tlsCaPemPaths == null ? List.of() : List.copyOf(tlsCaPemPaths);
+        allowedEnvironmentIds = allowedEnvironmentIds == null ? List.of() : List.copyOf(allowedEnvironmentIds);
+        if (auth == null) auth = new OutboundAuth.None();
+    }
+
+    public boolean isAllowedInEnvironment(UUID environmentId) {
+        return allowedEnvironmentIds.isEmpty() || allowedEnvironmentIds.contains(environmentId);
+    }
+}
diff --git a/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnectionRepository.java b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnectionRepository.java
new file mode 100644
index 00000000..5daac1da
--- /dev/null
+++ b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnectionRepository.java
@@ -0,0 +1,13 @@
+package com.cameleer.server.core.outbound;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+public interface OutboundConnectionRepository {
+    OutboundConnection save(OutboundConnection connection);
+    Optional<OutboundConnection> findById(String tenantId, UUID id);
+    Optional<OutboundConnection> findByName(String tenantId, String name);
+    List<OutboundConnection> listByTenant(String tenantId);
+    void delete(String tenantId, UUID id);
+}
diff --git a/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnectionService.java b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnectionService.java
new file mode 100644
index 00000000..e0e22be6
--- /dev/null
+++ b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundConnectionService.java
@@ -0,0 +1,13 @@
+package com.cameleer.server.core.outbound;
+
+import java.util.List;
+import java.util.UUID;
+
+public interface OutboundConnectionService {
+    OutboundConnection create(OutboundConnection draft, UUID actingUserId);
+    OutboundConnection update(UUID id, OutboundConnection draft, UUID actingUserId);
+    void delete(UUID id, UUID actingUserId);
+    OutboundConnection get(UUID id);
+    List<OutboundConnection> list();
+    List<UUID> rulesReferencing(UUID id);
+}
diff --git a/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundMethod.java b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundMethod.java
new file mode 100644
index 00000000..5909382a
--- /dev/null
+++ b/cameleer-server-core/src/main/java/com/cameleer/server/core/outbound/OutboundMethod.java
@@ -0,0 +1,3 @@
+package com.cameleer.server.core.outbound;
+
+public enum OutboundMethod { POST, PUT, PATCH }