Skip to main content
PATCH
Replace a built-in integration connection's tool allow-list

Authorizations

Authorization
string
header
required

A Recursion API key, created in the console under API keys.

Path Parameters

connection_id
string<uuid>
required

Integration connection id (UUID) as returned by listIntegrationConnections.

Body

application/json

Request body replacing the tool allow-list of a built-in integration connection. Validated against the catalog exactly as when the app was added; the connection's state is unchanged and sessions pick the new list up at their next credential refresh.

resources
string[] | null
required

The app's tools the organization's agents may use, by tool name from the catalog. Replaces the connection's allow-list in full; an empty list is refused.

Required array length: 1 - 200 elements
permission
string

The permission preset the allow-list is held to: read (every tool must be classified read-only) or write (any catalog tool; each is stored at its classified level). Omit for read.

Response

An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it.

An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it.

connection_id
string
required

Identifier for this connection (UUID). Server-assigned. Cite it when granting an agent access to the integration.

created_at
string<date-time>
required

RFC 3339 timestamp of when this record was created. Server-assigned.

external_id
string
required

The provider's own identifier for the link, which token minting addresses. The installation id for GitHub; the composite {api_app_id}:{team_id} for Slack; the customer service-account email for Google Cloud.

organization_id
string
required

Organization that owns this record. Resolved from the API key; never accepted from the caller.

provider
string
required

Stable slug of the third-party integration adapter this connection uses.

state
string
required

Lifecycle of the connection: pending was registered directly and waits for the customer to grant trust at the provider (a successful probe activates it), active can mint tokens, suspended is restorable at the provider and resolves to no credential, revoked was uninstalled and must be installed again.

updated_at
string<date-time>
required

RFC 3339 timestamp of the last change to this record. Server-assigned.

account_login
string

Name of the connected third-party account, e.g. the GitHub org or user login. Cached at install time for display, so no provider call is needed to show it.

account_type
string

Kind of account that was connected, as the provider reports it, e.g. Organization or User for GitHub and workspace for Slack.

connected_by
string

User who completed the install, recorded for audit. Empty for connections created by an internal admin route.

permissions
object

What the provider granted the install, as permission name to access level (e.g. contents: write). Used to narrow a minted token without a provider round trip and to explain why a permission preset is unavailable.

resource_selection
string

Whether the install covers all of the account's resources or only chosen ones: all or selected. Informational only; the authoritative list stays at the provider.

usage
object

Runtime usage counts, supplied on the connection list.

Example: