> ## Documentation Index > Fetch the complete documentation index at: https://docs.labelbox.com/llms.txt > Use this file to discover all available pages before exploring further. # Replace a built-in integration connection's tool allow-list > Replaces the tools the organization's agents may use through this built-in integration connection, validated against the catalog exactly as when the app was added: an empty list, an unknown tool, or a tool the read preset does not admit is refused. The connection's state is unchanged. Every agent using the app inherits the new list at its next credential refresh. A connection that is narrowed at vault-grant time instead is refused with 422. ## OpenAPI ````yaml /managed-agents/openapi.yaml patch /managed-agents/v1/integrations/connections/{connection_id} openapi: 3.1.0 info: title: Managed Agents API version: 0.14.0 description: >- The Recursion Managed Agents REST API. Authenticate with a Recursion API key as a bearer token. An organization-scoped key acts in its own organization and needs nothing else; a tenant-scoped key must also send `x-organization-id` with an organization id or `default`. Field names follow each operation's published schema. servers: - url: https://api.recursion.labelbox.com security: - bearerAuth: [] paths: /managed-agents/v1/integrations/connections/{connection_id}: patch: tags: - Integrations summary: Replace a built-in integration connection's tool allow-list description: >- Replaces the tools the organization's agents may use through this built-in integration connection, validated against the catalog exactly as when the app was added: an empty list, an unknown tool, or a tool the read preset does not admit is refused. The connection's state is unchanged. Every agent using the app inherits the new list at its next credential refresh. A connection that is narrowed at vault-grant time instead is refused with 422. operationId: managedAgentsUpdateIntegrationConnectionSelection parameters: - description: >- Integration connection id (UUID) as returned by listIntegrationConnections. in: path name: connection_id required: true schema: description: >- Integration connection id (UUID) as returned by listIntegrationConnections. format: uuid type: string requestBody: content: application/json: schema: $ref: >- #/components/schemas/ManagedAgentsUpdateIntegrationConnectionSelectionRequest required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsIntegrationConnection' description: >- An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it. '400': description: The request was rejected by schema or semantic validation. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidJson' - $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidRequest' discriminator: propertyName: code mapping: invalid_json: $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidJson' invalid_request: $ref: '#/components/schemas/ManagedAgentsApiErrorInvalidRequest' '401': description: The caller is unauthenticated. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorUnauthorized' '403': description: The caller lacks a required permission or capability. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorForbidden' '404': description: No such resource is reachable for this caller. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorNotFound' '413': description: The request exceeds a size or transaction budget. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorPayloadTooLarge' '415': description: The request body uses a media type this operation does not accept. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorUnsupportedMediaType' '422': description: The request is well formed but failed semantic validation. content: application/json: schema: $ref: >- #/components/schemas/ManagedAgentsApiErrorProviderSelectionUnsupported '429': headers: Retry-After: description: When to retry, as delay seconds or an HTTP date. schema: type: string description: A rate limit is exhausted. Honor `Retry-After`. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorRateLimitExceeded' '500': description: An unexpected server-side failure. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ManagedAgentsApiErrorInternalError' - $ref: >- #/components/schemas/ManagedAgentsApiErrorInvariantViolation discriminator: propertyName: code mapping: internal_error: $ref: '#/components/schemas/ManagedAgentsApiErrorInternalError' invariant_violation: $ref: >- #/components/schemas/ManagedAgentsApiErrorInvariantViolation '502': description: The service returned an invalid response. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorBadGateway' '503': description: >- A dependency is unavailable. Consult details.retryable and Retry-After when present before retrying. content: application/json: schema: oneOf: - $ref: >- #/components/schemas/ManagedAgentsApiErrorIntegrationsUnconfigured - $ref: >- #/components/schemas/ManagedAgentsApiErrorManagedAgentsUnavailable - $ref: >- #/components/schemas/ManagedAgentsApiErrorServiceUnavailable discriminator: propertyName: code mapping: integrations_unconfigured: $ref: >- #/components/schemas/ManagedAgentsApiErrorIntegrationsUnconfigured managed_agents_unavailable: $ref: >- #/components/schemas/ManagedAgentsApiErrorManagedAgentsUnavailable service_unavailable: $ref: >- #/components/schemas/ManagedAgentsApiErrorServiceUnavailable '504': description: The service did not respond before the timeout. content: application/json: schema: $ref: '#/components/schemas/ManagedAgentsApiErrorGatewayTimeout' components: schemas: ManagedAgentsUpdateIntegrationConnectionSelectionRequest: description: >- Request body replacing the tool allow-list of a built-in integration connection. Validated against the catalog exactly as when the app was added; the connection's state is unchanged and sessions pick the new list up at their next credential refresh. properties: permission: description: >- The permission preset the allow-list is held to: read (every tool must be classified read-only) or write (any catalog tool; each is stored at its classified level). Omit for read. type: string resources: description: >- The app's tools the organization's agents may use, by tool name from the catalog. Replaces the connection's allow-list in full; an empty list is refused. items: type: string maxItems: 200 minItems: 1 type: - array - 'null' required: - resources type: object example: permission: example resources: - example ManagedAgentsIntegrationConnection: description: >- An organization's link to a third-party account, created by installing an integration such as the GitHub App. It holds no secret itself; grant it to an agent so sessions can mint short-lived provider credentials from it. properties: account_login: description: >- Name of the connected third-party account, e.g. the GitHub org or user login. Cached at install time for display, so no provider call is needed to show it. type: string account_type: description: >- Kind of account that was connected, as the provider reports it, e.g. Organization or User for GitHub and workspace for Slack. type: string connected_by: description: >- User who completed the install, recorded for audit. Empty for connections created by an internal admin route. type: string connection_id: description: >- Identifier for this connection (UUID). Server-assigned. Cite it when granting an agent access to the integration. type: string created_at: description: RFC 3339 timestamp of when this record was created. Server-assigned. format: date-time type: string external_id: description: >- The provider's own identifier for the link, which token minting addresses. The installation id for GitHub; the composite {api_app_id}:{team_id} for Slack; the customer service-account email for Google Cloud. type: string organization_id: description: >- Organization that owns this record. Resolved from the API key; never accepted from the caller. type: string permissions: additionalProperties: type: string description: >- What the provider granted the install, as permission name to access level (e.g. contents: write). Used to narrow a minted token without a provider round trip and to explain why a permission preset is unavailable. type: object provider: description: >- Stable slug of the third-party integration adapter this connection uses. type: string resource_selection: description: >- Whether the install covers all of the account's resources or only chosen ones: all or selected. Informational only; the authoritative list stays at the provider. type: string state: description: >- Lifecycle of the connection: pending was registered directly and waits for the customer to grant trust at the provider (a successful probe activates it), active can mint tokens, suspended is restorable at the provider and resolves to no credential, revoked was uninstalled and must be installed again. type: string updated_at: description: >- RFC 3339 timestamp of the last change to this record. Server-assigned. format: date-time type: string usage: $ref: '#/components/schemas/ManagedAgentsIntegrationConnectionUsage' description: Runtime usage counts, supplied on the connection list. required: - organization_id - connection_id - provider - external_id - state - created_at - updated_at type: object example: account_login: example account_type: example connected_by: example connection_id: 9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d created_at: '2026-02-18T09:30:00.000Z' external_id: 9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d organization_id: 9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d permissions: key: example provider: example resource_selection: example state: example updated_at: '2026-02-18T09:30:00.000Z' usage: agents: 1 automations: 1 ManagedAgentsApiErrorInvalidJson: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invalid_json message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInvalidRequest: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invalid_request message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorUnauthorized: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - unauthorized message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorForbidden: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - forbidden message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorNotFound: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - not_found message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorPayloadTooLarge: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - payload_too_large message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorUnsupportedMediaType: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - unsupported_media_type message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorProviderSelectionUnsupported: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - provider_selection_unsupported message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorRateLimitExceeded: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - rate_limit_exceeded message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInternalError: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - internal_error message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorInvariantViolation: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - invariant_violation message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorBadGateway: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - bad_gateway message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorIntegrationsUnconfigured: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - integrations_unconfigured message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorManagedAgentsUnavailable: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - managed_agents_unavailable message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorServiceUnavailable: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - service_unavailable message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsApiErrorGatewayTimeout: type: object properties: code: type: string minLength: 1 description: Stable machine-readable error code. enum: - gateway_timeout message: type: string minLength: 1 description: Human-readable error message. details: $ref: '#/components/schemas/ManagedAgentsApiErrorDetails' description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. required: - code - message additionalProperties: false description: Standard flat error response. ManagedAgentsIntegrationConnectionUsage: description: Current agent and pinned automation runtime usage of a connection. properties: agents: description: Distinct agents whose current version selects this connection. format: int64 type: integer automations: description: >- Distinct canonical automations, including paused ones, whose pinned agent version selects this connection. format: int64 type: integer required: - agents - automations type: object example: agents: 1 automations: 1 ManagedAgentsApiErrorDetails: type: object properties: field: description: >- Request field or header responsible for the error, when one can be identified. type: string issues: description: >- Boundary-validation failures as path-prefixed human-readable messages. type: array items: type: string requestId: description: Request correlation identifier for support and log lookup. type: string retryable: description: >- Server advice about failure transience. `true` means transient, `false` means non-transient, and absence gives no advice. Automatic replay is allowed only when this field is not `false` and the operation-specific retry and idempotency contract permits replay. type: boolean additionalProperties: {} description: >- Optional structured error details. Reserved transport fields are typed; code-specific fields remain forward compatible. securitySchemes: bearerAuth: type: http scheme: bearer description: A Recursion API key, created in the console under API keys. ````