> ## Documentation Index > Fetch the complete documentation index at: https://docs.labelbox.com/llms.txt > Use this file to discover all available pages before exploring further. # Finish connecting provider accounts after the authorization redirect > Finishes an authorization begun by managedAgentsStartIntegrationInstall. It returns either connected accounts or provider-neutral account/action options that continue through managedAgentsStartIntegrationInstall. The provider and organization come from the authenticated caller and single-use state nonce, never from callback parameters or browser-local storage. An expected provider failure after state consumption returns 409 integration_install_restart_required with details.provider; begin a new install. Resource and permission selection happens later when granting a vault. Do not automatically retry an ambiguous transport failure: list connections to determine whether completion committed; if it did not, begin a new install because the state is single-use. ## OpenAPI ````yaml /recursion/openapi.yaml post /managed-agents/v1/integrations/install/complete openapi: 3.1.0 info: title: Managed Agents API version: 0.14.0 description: >- The Recursion Managed Agents REST API. Authenticate with a Recursion API key as a bearer token. An organization-scoped key acts in its own organization and needs nothing else; a tenant-scoped key must also send `x-organization-id` with an organization id or `default`. Field names follow each operation's published schema. servers: - url: https://api.recursion.labelbox.com security: - bearerAuth: [] paths: /managed-agents/v1/integrations/install/complete: post: tags: - Integrations summary: Finish connecting provider accounts after the authorization redirect description: >- Finishes an authorization begun by managedAgentsStartIntegrationInstall. It returns either connected accounts or provider-neutral account/action options that continue through managedAgentsStartIntegrationInstall. The provider and organization come from the authenticated caller and single-use state nonce, never from callback parameters or browser-local storage. An expected provider failure after state consumption returns 409 integration_install_restart_required with details.provider; begin a new install. Resource and permission selection happens later when granting a vault. Do not automatically retry an ambiguous transport failure: list connections to determine whether completion committed; if it did not, begin a new install because the state is single-use. operationId: managedAgentsCompleteIntegrationInstall parameters: - $ref: '#/components/parameters/RecursionTenantId' - $ref: '#/components/parameters/RecursionOrganizationId' requestBody: content: application/json: schema: $ref: '#/components/schemas/CompleteIntegrationInstallRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/InstallComplete' description: >- The completed integration authorization. Connections contains the accounts established by this callback; when the provider needs the operator to choose an account or action first, connections is empty and options contains those provider-defined continuations. headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '400': description: Bad Request. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidJson' - $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidRequest' discriminator: propertyName: code mapping: invalid_json: '#/components/schemas/ManagedAgentsApiErrorInvalidJson' invalid_request: '#/components/schemas/ManagedAgentsApiErrorInvalidRequest' x-recursion-error-codes: - invalid_json - invalid_request headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '401': description: Unauthorized. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorUnauthorized' x-recursion-error-codes: - unauthorized headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '403': description: Forbidden. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorForbidden' x-recursion-error-codes: - forbidden headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '404': description: Not Found. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorNotFound' x-recursion-error-codes: - not_found headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '409': description: Conflict. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ManagedAgentsApiErrorConflict' - $ref: >- #/components/schemas/ManagedAgentsApiErrorIntegrationInstallRestartRequired discriminator: propertyName: code mapping: conflict: '#/components/schemas/ManagedAgentsApiErrorConflict' integration_install_restart_required: >- #/components/schemas/ManagedAgentsApiErrorIntegrationInstallRestartRequired x-recursion-error-codes: - conflict - integration_install_restart_required headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '413': description: Payload Too Large. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorPayloadTooLarge' x-recursion-error-codes: - payload_too_large headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '415': description: Unsupported Media Type. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorUnsupportedMediaType' x-recursion-error-codes: - unsupported_media_type headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '429': headers: Retry-After: description: When to retry, as delay seconds or an HTTP date. schema: type: string recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' description: Too Many Requests. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorRateLimitExceeded' x-recursion-error-codes: - rate_limit_exceeded '500': description: Internal Server Error. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorInternalError' x-recursion-error-codes: - internal_error headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '502': description: A dependent service returned an invalid response. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorDependencyFailure' x-recursion-error-codes: - bad_gateway headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '503': description: Service Unavailable. content: application/json: schema: oneOf: - $ref: >- #/components/schemas/ManagedAgentsApiErrorCredentialEncryptionUnconfigured - $ref: >- #/components/schemas/ManagedAgentsApiErrorManagedAgentsUnavailable - $ref: >- #/components/schemas/ManagedAgentsApiErrorServiceUnavailable discriminator: propertyName: code mapping: credential_encryption_unconfigured: >- #/components/schemas/ManagedAgentsApiErrorCredentialEncryptionUnconfigured managed_agents_unavailable: >- #/components/schemas/ManagedAgentsApiErrorManagedAgentsUnavailable service_unavailable: >- #/components/schemas/ManagedAgentsApiErrorServiceUnavailable x-recursion-error-codes: - credential_encryption_unconfigured - managed_agents_unavailable - service_unavailable headers: recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' '504': headers: Retry-After: description: When to retry, as delay seconds or an HTTP date. schema: type: string recursion-organization-id: $ref: '#/components/headers/RecursionOrganizationId' recursion-tenant-id: $ref: '#/components/headers/RecursionTenantId' description: A dependent service timed out. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorDependencyTimeout' x-recursion-error-codes: - gateway_timeout components: parameters: RecursionTenantId: name: x-tenant-id in: header required: false description: >- Optional tenant consistency check. When present, it must name the tenant bound to the API key, including when x-organization-id is `default`. schema: type: string minLength: 1 RecursionOrganizationId: name: x-organization-id in: header required: false description: >- Organization in which to act. Required for a tenant-scoped API key. Optional for an organization-scoped key, where it must name that same organization. The value may be an organization id or `default`. schema: type: string minLength: 1 schemas: CompleteIntegrationInstallRequest: description: >- Request body completing integration authorization after the provider redirects the user back. Sent from an authenticated session so the provider and organization come from the single-use state record rather than from callback parameters or browser-local storage. properties: code: description: >- Provider authorization code, proving which user authorized this connection. Required by OAuth providers (GitHub, Jira, Confluence, Loom), which refuse a completion without one. A built-in integration's sign-in page also returns a single-use code, verified before the connection activates, so a completion without it fails. type: string selection: description: >- Which account the operator chose on the provider's own page, in the opaque form that provider returned. Providers with an account chooser may require it; GitHub returns an installation id. A selector only: the server verifies the choice against the accounts the authorizing user can reach and refuses one they cannot. type: string state: description: >- The nonce returned when authorization was started. Single-use and short-lived. type: string required: - state type: object additionalProperties: false InstallComplete: description: >- The completed integration authorization. Connections contains the accounts established by this callback; when the provider needs the operator to choose an account or action first, connections is empty and options contains those provider-defined continuations. properties: connections: description: >- Connections created by this callback. Empty when the provider needs an option selected first. items: $ref: '#/components/schemas/IntegrationConnection' type: array options: description: >- Provider-defined accounts or actions the operator can choose to continue authorization. items: $ref: '#/components/schemas/AuthorizationOption' type: array provider: description: Provider whose authorization is being completed. type: string required: - provider - connections type: object additionalProperties: false ManagedAgentsApiErrorInvalidJson: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invalid_json message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInvalidRequest: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invalid_request message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorUnauthorized: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - unauthorized message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorForbidden: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - forbidden message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorNotFound: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - not_found message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorConflict: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - conflict message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorIntegrationInstallRestartRequired: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - integration_install_restart_required message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorPayloadTooLarge: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - payload_too_large message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorUnsupportedMediaType: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - unsupported_media_type message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorRateLimitExceeded: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - rate_limit_exceeded message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInternalError: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - internal_error message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorDependencyFailure: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - bad_gateway message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorCredentialEncryptionUnconfigured: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - credential_encryption_unconfigured message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorManagedAgentsUnavailable: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - managed_agents_unavailable message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorServiceUnavailable: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - service_unavailable message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorDependencyTimeout: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - gateway_timeout message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. IntegrationConnection: description: >- An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it. properties: account_login: description: >- Name of the connected third-party account, e.g. the GitHub org or user login. Cached at install time for display, so no provider call is needed to show it. readOnly: true type: string account_type: description: >- Kind of account that was connected, as the provider reports it, e.g. Organization or User for GitHub and workspace for Slack. readOnly: true type: string connected_by: description: User who completed the install, recorded for audit. readOnly: true type: string connection_id: description: >- Identifier for this connection (UUID). Server-assigned. Cite it when granting an agent access to the integration. readOnly: true type: string created_at: description: RFC 3339 timestamp of when this record was created. Server-assigned. format: date-time readOnly: true type: string external_id: description: >- The provider's own identifier for the link, which token minting addresses. The installation id for GitHub; the composite {api_app_id}:{team_id} for Slack; the customer service-account email for Google Cloud. readOnly: true type: string mcpTools: description: >- Native GitHub or Slack MCP tools selected for this organization. Existing connections default to every supported tool. items: type: string readOnly: true type: array mergeAccountLabel: description: >- Operator-assigned label distinguishing multiple accounts for one built-in vendor. readOnly: true type: string organization_id: description: >- Organization that owns this record. Resolved from the API key; never accepted from the caller. readOnly: true type: string permissions: additionalProperties: type: string description: >- What the provider granted the install, as permission name to access level (e.g. contents: write). Used to narrow a minted token without a provider round trip and to explain why a permission preset is unavailable. readOnly: true type: object provider: description: >- Stable slug of the third-party integration adapter this connection uses. readOnly: true type: string resource_selection: description: >- Whether the install covers all of the account's resources or only chosen ones: all or selected. Informational only; the authoritative list stays at the provider. readOnly: true type: string state: description: >- Lifecycle of the connection: pending was registered directly and waits for the customer to grant trust at the provider (a successful probe activates it), active can mint tokens, suspended is restorable at the provider and resolves to no credential, revoked was uninstalled and must be installed again. readOnly: true type: string updated_at: description: >- RFC 3339 timestamp of the last change to this record. Server-assigned. format: date-time readOnly: true type: string usage: $ref: '#/components/schemas/IntegrationConnectionUsage' description: Runtime usage counts, supplied on the connection list. readOnly: true required: - organization_id - connection_id - provider - external_id - state - created_at - updated_at type: object additionalProperties: false AuthorizationOption: description: >- One provider-defined account or authorization action the operator may choose to continue an integration install. Its value is opaque and is accepted only through a fresh, single-use install state. properties: description: description: >- Optional explanation of the account or action represented by this option. type: string label: description: Operator-facing name for this account or authorization action. type: string value: description: >- Short opaque provider option value to pass back when continuing this authorization flow. maxLength: 30 type: string required: - value - label type: object additionalProperties: false ManagedAgentsApiErrorDetails: type: object properties: field: description: >- Request field or header responsible for the error, when one can be identified. type: string issues: description: >- Boundary-validation failures as path-prefixed human-readable messages. type: array items: type: string requestId: description: Request correlation identifier for support and log lookup. type: string retryable: description: >- Server advice about failure transience. `true` means transient, `false` means non-transient, and absence gives no advice. Automatic replay is allowed only when this field is not `false` and the operation-specific retry and idempotency contract permits replay. type: boolean additionalProperties: $ref: '#/components/schemas/PlatformSafeJsonValue' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. IntegrationConnectionUsage: description: Current agent usage of a connection. properties: agents: description: Distinct agents whose current version selects this connection. format: int64 type: integer minimum: -9007199254740991 maximum: 9007199254740991 readOnly: true required: - agents type: object additionalProperties: false PlatformSafeJsonValue: description: >- A JSON value whose integer members stay within the exact ECMAScript safe-integer range at every nesting level. oneOf: - type: 'null' - type: boolean - type: string - type: integer minimum: -9007199254740991 maximum: 9007199254740991 - type: number not: type: integer - type: array items: $ref: '#/components/schemas/PlatformSafeJsonValue' - additionalProperties: $ref: '#/components/schemas/PlatformSafeJsonValue' type: object headers: RecursionOrganizationId: description: Organization id resolved for this request. schema: type: string minLength: 1 RecursionTenantId: description: Tenant id resolved for this request. schema: type: string minLength: 1 securitySchemes: bearerAuth: type: http scheme: bearer description: A Recursion API key, created in the console under API keys. ````