connections

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "enum": [
        "create",
        "list",
        "delete",
        "consent_url"
      ],
      "description": "create: store a webhook connection, a stored credential (static header token or a full generic OAuth2 client) a manifest webhook rule authenticates its target with (app_id+name+allowed_host, plus kind-specific fields). list: the app's connections as metadata plus a non-reversible fingerprint, never any secret (app_id). delete: idempotent (app_id+name). consent_url: build (never fetch) the browser URL that completes an oauth2 connection's owner consent (app_id+name); hand it to the signed-in owner to open, since an agent key cannot complete OAuth consent itself."
    },
    "app_id": {
      "type": "string",
      "minLength": 1,
      "description": "The app id."
    },
    "name": {
      "description": "create / delete / consent_url. The connection name (lowercase, starting alphanumeric, up to 64 chars) that a manifest webhook rule's `connection` field references.",
      "type": "string"
    },
    "kind": {
      "description": "create only. Defaults to `static`.",
      "type": "string",
      "enum": [
        "static",
        "oauth2"
      ]
    },
    "provider": {
      "description": "create only. Freeform display label only, e.g. \"hubspot\"; not validated against any allowlist.",
      "type": "string"
    },
    "label": {
      "description": "create only. Optional owner-facing label.",
      "type": "string"
    },
    "allowed_host": {
      "description": "create only, required for both kinds. The host-binding exfiltration defence: an exact DNS host (\"api.hubapi.com\") or a single leftmost wildcard (\"*.zohoapis.com\"). The stored credential is attached to a delivery only when its url host matches; a rule later repointed elsewhere fails delivery rather than sending the secret to the wrong host.",
      "type": "string"
    },
    "header_name": {
      "description": "create only (static). The header the credential rides in. Defaults to \"Authorization\".",
      "type": "string"
    },
    "header_value": {
      "description": "create only, required for kind=static. The header value to send, e.g. \"Bearer sk_live_...\". Encrypted at rest and never returned by any call.",
      "type": "string"
    },
    "authorize_url": {
      "description": "create only, required for kind=oauth2. The provider's OAuth2 authorize endpoint (https; rejected if it resolves to a private/loopback/metadata address).",
      "type": "string"
    },
    "token_endpoint": {
      "description": "create only, required for kind=oauth2. The provider's OAuth2 token endpoint (same https + SSRF rules as authorize_url).",
      "type": "string"
    },
    "client_id": {
      "description": "create only, required for kind=oauth2. Your OAuth2 app's client id.",
      "type": "string"
    },
    "client_secret": {
      "description": "create only, required for kind=oauth2. Your OAuth2 app's client secret. Encrypted at rest and never returned by any call.",
      "type": "string"
    },
    "scopes": {
      "description": "create only (oauth2). Space-delimited scopes for the authorize request.",
      "type": "string"
    },
    "auth_scheme": {
      "description": "create only (oauth2). The scheme the access token is sent under. Defaults to \"Bearer\"; set e.g. \"Zoho-oauthtoken\" for a non-Bearer provider.",
      "type": "string"
    },
    "instance_field": {
      "description": "create only (oauth2). The name of a token-response JSON field holding the API base URL (e.g. \"instance_url\"). When set, the relay re-binds allowed_host to that host after consent and resolves relative rule urls against it.",
      "type": "string"
    },
    "auth_params": {
      "description": "create only (oauth2). Extra key/values merged into the authorize redirect (e.g. to request offline access).",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "token_params": {
      "description": "create only (oauth2). Extra key/values merged into the token POST.",
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    }
  },
  "required": [
    "action",
    "app_id"
  ]
}