Org Connections

Operations of the Connector Gateway API. Paths are relative to your deployment's API host.

GET /api/connector-gateway-api/org-connections

List org connections with credential status

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/connector-gateway-api/org-connections

Connect organization to a provider

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json CreateOrgConnectionDto

GET /api/connector-gateway-api/org-connections/{id}

Get org connection by ID

Authentication: bearer token (Authorization: Bearer <token>)

DELETE /api/connector-gateway-api/org-connections/{id}

Disconnect org from provider

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/connector-gateway-api/org-connections/{id}/credentials

Add or update user credentials for connection (encrypted at rest)

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json AddCredentialsDto

DELETE /api/connector-gateway-api/org-connections/{id}/credentials

Remove a named member’s credential from this connection (offboarding). The connection itself, and every other member’s credential on it, are untouched.

Authentication: bearer token (Authorization: Bearer <token>)

PATCH /api/connector-gateway-api/org-connections/{id}/default

Make this connection the default for its provider at its own space (org, project or personal): authors the connection.<provider> pointer there as the caller. A personal connection only by its owner (404 otherwise); an org or project connection only by an org admin (403). Refused (403/409/503) when the pointer cannot be authored.

Authentication: bearer token (Authorization: Bearer <token>)

PATCH /api/connector-gateway-api/org-connections/{id}/disable

Disable this connection without deleting its credentials

Authentication: bearer token (Authorization: Bearer <token>)

PATCH /api/connector-gateway-api/org-connections/{id}/enable

Enable a configured, disabled connection

Authentication: bearer token (Authorization: Bearer <token>)

PUT /api/connector-gateway-api/org-connections/{id}/endpoint

Change this connection's endpoint. Suspends every credential on the connection until re-entered; audited; probed.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json ChangeConnectionEndpointDto

GET /api/connector-gateway-api/org-connections/{id}/inbound-endpoints/{slug}

Whether a biome-contributed inbound endpoint can verify deliveries for this connection: unbound, secret-missing, secret-unresolvable or ready (the connection's webhook secret resolves through the credential broker), and the endpoint URL path to register with the external caller, /webhooks/inbound/<slug>/<endpointToken>, carrying the connection's platform-minted endpoint token. Report-only; the refusal at the edge is the gate.

Authentication: bearer token (Authorization: Bearer <token>)

PUT /api/connector-gateway-api/org-connections/{id}/inbound-endpoints/{slug}

Route a biome-contributed inbound endpoint's deliveries for this connection's external installation to this organisation. Idempotent; re-binding refreshes the installation id.

Authentication: bearer token (Authorization: Bearer <token>)

DELETE /api/connector-gateway-api/org-connections/{id}/inbound-endpoints/{slug}

Stop routing a biome-contributed inbound endpoint's deliveries to this connection. Idempotent.

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/connector-gateway-api/org-connections/{id}/test

Test an org connection — actively resolves its credential; needs no project binding

Authentication: bearer token (Authorization: Bearer <token>)

POST /api/connector-gateway-api/org-connections/{id}/webhook-endpoint-token/rotate

Issue a new endpoint token for this connection's inbound webhook URLs and refuse the previous one immediately. The new token is returned once and is not readable back.

Authentication: bearer token (Authorization: Bearer <token>)

PUT /api/connector-gateway-api/org-connections/{id}/webhook-secret

Seal this connection's inbound webhook signing secret into the credential broker and return the URL path to register at the provider. The secret is never stored by this service and is not readable back.

Authentication: bearer token (Authorization: Bearer <token>)

Request body: application/json SetWebhookSecretDto

DELETE /api/connector-gateway-api/org-connections/{id}/webhook-secret

Revoke this connection's inbound webhook signing secret and stop routing deliveries to it.

Authentication: bearer token (Authorization: Bearer <token>)