> ## Documentation Index > Fetch the complete documentation index at: https://docs.labelbox.com/llms.txt > Use this file to discover all available pages before exploring further. # Change an integration connection's tool allow-list > Replaces the tools the organization's agents may use through this built-in integration connection, validated against the catalog exactly as when the app was added: an empty list, an unknown tool, or a tool the read preset does not admit is refused. The connection's state is unchanged. Every agent using the app inherits the new list at its next credential refresh. A connection that is narrowed at vault-grant time instead is refused with 422. ## OpenAPI ````yaml /recursion/openapi.yaml patch /managed-agents/v1/integrations/connections/{connectionId} openapi: 3.1.0 info: title: Managed Agents API version: 0.15.0 description: >- The Recursion Managed Agents REST API. Authenticate with a Recursion API key as a bearer token. An organization-scoped key acts in its own organization and needs nothing else; a tenant-scoped key must also send `x-organization-id` with an organization id or `default`. Field names follow each operation's published schema. servers: - url: https://api.recursion.labelbox.com security: - bearerAuth: [] paths: /managed-agents/v1/integrations/connections/{connectionId}: patch: tags: - Integrations summary: Change an integration connection's tool allow-list description: >- Replaces the tools the organization's agents may use through this built-in integration connection, validated against the catalog exactly as when the app was added: an empty list, an unknown tool, or a tool the read preset does not admit is refused. The connection's state is unchanged. Every agent using the app inherits the new list at its next credential refresh. A connection that is narrowed at vault-grant time instead is refused with 422. operationId: managedAgentsUpdateIntegrationConnectionSelection parameters: - description: >- Integration connection id (UUID) as returned by managedAgentsListIntegrationConnections. in: path name: connectionId required: true schema: description: >- Integration connection id (UUID) as returned by managedAgentsListIntegrationConnections. format: uuid type: string - $ref: '#/components/parameters/RecursionTenantId' - $ref: '#/components/parameters/RecursionOrganizationId' requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateIntegrationConnectionSelectionRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/IntegrationConnection' description: >- An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it. headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '400': description: Bad Request. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidJson' - $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidRequest' discriminator: propertyName: code mapping: invalid_json: '#/components/schemas/ManagedAgentsApiErrorInvalidJson' invalid_request: '#/components/schemas/ManagedAgentsApiErrorInvalidRequest' x-recursion-error-codes: - invalid_json - invalid_request headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '401': description: Unauthorized. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorUnauthorized' x-recursion-error-codes: - unauthorized headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '403': description: Forbidden. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorForbidden' x-recursion-error-codes: - forbidden headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '404': description: Not Found. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorNotFound' x-recursion-error-codes: - not_found headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '413': description: Payload Too Large. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorPayloadTooLarge' x-recursion-error-codes: - payload_too_large headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '415': description: Unsupported Media Type. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorUnsupportedMediaType' x-recursion-error-codes: - unsupported_media_type headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '422': description: Unprocessable Entity. content: application/json: schema: $ref: >- #/components/schemas/ManagedAgentsApiErrorProviderSelectionUnsupported x-recursion-error-codes: - provider_selection_unsupported headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '429': headers: Retry-After: description: When to retry, as delay seconds or an HTTP date. schema: type: string recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' description: Too Many Requests. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorRateLimitExceeded' x-recursion-error-codes: - rate_limit_exceeded '500': description: Internal Server Error. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorInternalError' x-recursion-error-codes: - internal_error headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '502': description: A dependent service returned an invalid response. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorDependencyFailure' x-recursion-error-codes: - bad_gateway headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '503': description: Service Unavailable. content: application/json: schema: oneOf: - $ref: >- #/components/schemas/ManagedAgentsApiErrorManagedAgentsUnavailable - $ref: >- #/components/schemas/ManagedAgentsApiErrorServiceUnavailable discriminator: propertyName: code mapping: managed_agents_unavailable: >- #/components/schemas/ManagedAgentsApiErrorManagedAgentsUnavailable service_unavailable: >- #/components/schemas/ManagedAgentsApiErrorServiceUnavailable x-recursion-error-codes: - managed_agents_unavailable - service_unavailable headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '504': headers: Retry-After: description: When to retry, as delay seconds or an HTTP date. schema: type: string recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' description: A dependent service timed out. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorDependencyTimeout' x-recursion-error-codes: - gateway_timeout components: parameters: RecursionTenantId: name: x-tenant-id in: header required: false description: >- Optional tenant consistency check. When present, it must name the tenant bound to the API key, including when x-organization-id is `default`. schema: minLength: 1 type: string RecursionOrganizationId: name: x-organization-id in: header required: false description: >- Organization in which to act. Required for a tenant-scoped API key. Optional for an organization-scoped key, where it must name that same organization. The value may be an organization id or `default`. schema: minLength: 1 type: string schemas: UpdateIntegrationConnectionSelectionRequest: description: >- Request body changing the organization tool allow-list of a built-in, GitHub, or Slack integration connection. Validated against the provider's catalog; the connection's state is unchanged and sessions pick the new list up at their next credential refresh. minProperties: 1 properties: permission: description: >- For a built-in integration, the permission preset the selected tools are checked against: read or write; when omitted, the read preset applies. Omit for native GitHub and Slack: GitHub tools determine token permissions; Slack tools do not change OAuth scopes or thread access. type: string writeOnly: true resources: description: >- The app's tools the organization's agents may use, by tool name from the catalog. Replaces the connection's allow-list in full; an empty list is refused. Omit to keep the current allow-list, for example to check a built-in integration's tools against another permission preset. items: type: string maxItems: 200 minItems: 1 type: array writeOnly: true type: object additionalProperties: false IntegrationConnection: description: >- An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it. properties: account_login: description: >- Name of the connected third-party account, e.g. the GitHub org or user login. Cached at install time for display, so no provider call is needed to show it. readOnly: true type: string account_type: description: >- Kind of account that was connected, as the provider reports it, e.g. Organization or User for GitHub and workspace for Slack. readOnly: true type: string connected_by: description: User who completed the install, recorded for audit. readOnly: true type: string connection_id: description: >- Identifier for this connection (UUID). Server-assigned. Cite it when granting an agent access to the integration. readOnly: true type: string created_at: description: RFC 3339 timestamp of when this record was created. Server-assigned. format: date-time readOnly: true type: string external_id: description: >- The provider's own identifier for the link, which token minting addresses. The installation id for GitHub; the composite {api_app_id}:{team_id} for Slack; the customer service-account email for Google Cloud. readOnly: true type: string lastCheck: $ref: '#/components/schemas/IntegrationConnectionCheck' description: >- Latest completed connection check, with the time it began. Historical evidence, not a guarantee of current availability. Absent until a check has been saved. readOnly: true mcpTools: description: >- Native GitHub or Slack MCP tools selected for this organization. A connection with no saved selection gets every supported tool except opt-in tools that delete data, which must be selected explicitly. items: type: string readOnly: true type: array mergeAccountLabel: description: >- Operator-assigned label distinguishing multiple accounts for one built-in vendor. readOnly: true type: string organization_id: description: >- Organization that owns this record. Resolved from the API key; never accepted from the caller. readOnly: true type: string permissions: additionalProperties: type: string description: >- What the provider granted the install, as permission name to access level (e.g. contents: write). Used to narrow a minted token without a provider round trip and to explain why a permission preset is unavailable. readOnly: true type: object provider: description: >- Stable slug of the third-party integration adapter this connection uses. readOnly: true type: string resource_selection: description: >- Whether the install covers all of the account's resources or only chosen ones: all or selected. Informational only; the authoritative list stays at the provider. readOnly: true type: string state: description: >- Lifecycle of the connection: pending was registered directly and waits for provider setup (a trust probe or registered OAuth sign-in activates it), active can mint tokens, suspended is restorable at the provider and resolves to no credential, revoked was uninstalled and must be installed again. readOnly: true type: string updated_at: description: >- RFC 3339 timestamp of the last change to this record. Server-assigned. format: date-time readOnly: true type: string usage: $ref: '#/components/schemas/IntegrationConnectionUsage' description: Runtime usage counts, supplied on the connection list. readOnly: true required: - organization_id - connection_id - provider - external_id - state - created_at - updated_at type: object additionalProperties: false ManagedAgentsApiErrorInvalidJson: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invalid_json message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInvalidRequest: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invalid_request message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorUnauthorized: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - unauthorized message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorForbidden: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - forbidden message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorNotFound: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - not_found message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorPayloadTooLarge: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - payload_too_large message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorUnsupportedMediaType: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - unsupported_media_type message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorProviderSelectionUnsupported: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - provider_selection_unsupported message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorRateLimitExceeded: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - rate_limit_exceeded message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInternalError: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - internal_error message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorDependencyFailure: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - bad_gateway message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorManagedAgentsUnavailable: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - managed_agents_unavailable message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorServiceUnavailable: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - service_unavailable message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorDependencyTimeout: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - gateway_timeout message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. IntegrationConnectionCheck: description: >- The most recent completed health check of one integration connection, retained across page reloads. properties: checkedAt: description: RFC 3339 timestamp when this connection check began. format: date-time readOnly: true type: string failure: description: >- Reason the check failed, bounded to 1024 characters. Absent when the check passed. readOnly: true type: string ok: description: >- Whether the check verified the connection and obtained a usable credential. readOnly: true type: boolean readOnly: true required: - checkedAt - ok type: object additionalProperties: false IntegrationConnectionUsage: description: Current agent usage of a connection. properties: agents: description: Distinct agents whose current version selects this connection. format: int64 type: integer minimum: -9007199254740991 maximum: 9007199254740991 readOnly: true required: - agents type: object additionalProperties: false ManagedAgentsApiErrorDetails: type: object properties: field: description: >- Request field or header responsible for the error, when one can be identified. type: string issues: description: >- Boundary-validation failures as path-prefixed human-readable messages. type: array items: type: string requestId: description: Request correlation identifier for support and log lookup. type: string retryable: description: >- Server advice about failure transience. `true` means transient, `false` means non-transient, and absence gives no advice. Automatic replay is allowed only when this field is not `false` and the operation-specific retry and idempotency contract permits replay. type: boolean additionalProperties: $ref: '#/components/schemas/PlatformSafeJsonValue' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. PlatformSafeJsonValue: description: >- A JSON value whose integer members stay within the exact ECMAScript safe-integer range at every nesting level. oneOf: - type: 'null' - type: boolean - type: string - type: integer minimum: -9007199254740991 maximum: 9007199254740991 - type: number not: type: integer - type: array items: $ref: '#/components/schemas/PlatformSafeJsonValue' - additionalProperties: $ref: '#/components/schemas/PlatformSafeJsonValue' type: object headers: RecursionOrganizationId: description: Organization id resolved for this request. schema: minLength: 1 type: string RecursionTenantId: description: Tenant id resolved for this request. schema: minLength: 1 type: string securitySchemes: bearerAuth: type: http scheme: bearer description: A Recursion API key, created in the console under API keys. ````