> ## Documentation Index > Fetch the complete documentation index at: https://docs.parable.work/llms.txt > Use this file to discover all available pages before exploring further. # List Providers this Workspace has connected > Lists the Providers this Workspace has at least one connection to, with those connections included. Neither the Providers nor the connections carry Provider docs, and connector.taps is empty; read one connection for its Taps. > **[List Providers this Workspace has connected](/protocols/_generated/mcp/web-api/vendors#tool-list_providers_workspace_connected)** > > `list_providers_workspace_connected` ## OpenAPI ````yaml /protocols/_generated/openapi/web-api.json get /api/vendors/parable-vendors-with-connectors openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/vendors/parable-vendors-with-connectors: get: tags: - Vendors summary: List Providers this Workspace has connected description: >- Lists the Providers this Workspace has at least one connection to, with those connections included. Neither the Providers nor the connections carry Provider docs, and connector.taps is empty; read one connection for its Taps. operationId: VendorsParableVendorsWithConnectorsHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/VendorWithConnectors' type: array links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request is not valid. `detail` says why. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 100 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '504': content: text/plain: schema: example: Gateway Timeout type: string description: The operation did not finish in 30 seconds. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: |- import { WebApiSDK } from "@parable-platform/web-api-sdk"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const result = await sdk.vendors.parableVendorsWithConnectors(); - label: Python SDK lang: python source: |- import os from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) result = sdk.vendors.parable_vendors_with_connectors() - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let result = sdk.vendors.parable_vendors_with_connectors( Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nresult, err := sdk.VendorsNamespace.ParableVendorsWithConnectors(ctx)" components: schemas: VendorWithConnectors: description: |- Vendor with its connector instances (workspace-scoped). Returned only for vendors that have at least one configured connector. properties: connectorInstances: description: Connector instances configured for this vendor items: $ref: '#/components/schemas/TenantConnectorInstance' type: array vendor: $ref: '#/components/schemas/ParableVendor' description: The vendor required: - vendor - connectorInstances type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object TenantConnectorInstance: description: Instance of a configured connector for a workspace. properties: authenticationConfig: description: The authentication configuration for this connector instance nullable: true type: object authenticationStrategy: description: The authentication strategy used for this connector instance oneOf: - $ref: '#/components/schemas/ConnectorAuthStrategy' - enum: - null nullable: true type: object connectionStatus: $ref: '#/components/schemas/TenantConnectorStatusEnum' description: Current status of this connector instance. connectionStatusMessage: description: Human-readable message describing the current connection status. type: string connector: $ref: '#/components/schemas/Connector' description: The connector createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string createdBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string credentialErrorCode: description: >- Latest credential validation error code for this connection, the same as ConnectorCredentialDetail.errorCode (TokenExpired / InsufficientScopes / AuthFailed / ...). Null whenever the most recent credential validation succeeded or has not yet produced a recognised ValidationErrorCode. oneOf: - $ref: '#/components/schemas/ValidationErrorCode' - enum: - null nullable: true type: string credentialMetadataId: description: >- ID of the current credential metadata record for this connector instance. Useful for polling validation status after submitCredentials. nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string credentialStatus: description: >- Status of the most recent credential record for this connector instance. oneOf: - $ref: '#/components/schemas/CredentialStatus' - enum: - null nullable: true type: string grouping: $ref: '#/components/schemas/ParableVendorGrouping' description: The grouping this instance is configured from hasValidCredentials: description: Whether credentials are configured and valid type: boolean id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string ingestionConfig: description: The ingestion configuration for this connector instance nullable: true type: object lastDataReceivedAt: description: >- When a push (streaming) connection last received data: the newest lastUsedAt among its ingest tokens, which the collector stamps when it lands data for a token, at most once a minute. Null for a pull connection, and for a push connection no sender has delivered to yet. format: date-time nullable: true type: string lastNonSyncStatus: description: >- Display health derived without queued/running activity. Absent/null when health is not established; cards must not interpret that as healthy. oneOf: - $ref: '#/components/schemas/TenantConnectorStatusEnum' - enum: - null nullable: true type: string lastNonSyncStatusMessage: description: Message derived with lastNonSyncStatus. nullable: true type: string lastSyncAt: description: Last sync timestamp format: date-time nullable: true type: string lastSyncStatus: description: Last sync status oneOf: - $ref: '#/components/schemas/SyncJobStatus' - enum: - null nullable: true type: string name: description: Optional user-facing label for this connector instance. maxLength: 80 minLength: 2 nullable: true type: string parentDataFilters: description: 'Workspace allowlist: one predicate per parent tap.' items: $ref: '#/components/schemas/TenantParentDataFilterEntry' nullable: true type: array updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - grouping - connector - connectionStatus - connectionStatusMessage - hasValidCredentials type: object ParableVendor: description: |- Vendor for API responses - includes computed fields. Represents a top-level company/product family in the connector catalog. properties: description: nullable: true type: string groupings: description: Top-level groupings under this vendor items: $ref: '#/components/schemas/ParableVendorGrouping' type: array id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string logo: description: Logo metadata for display. nullable: true type: object name: description: An objects name maxLength: 80 minLength: 2 type: string slug: description: A URL friendly version of a string maxLength: 17 minLength: 1 pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$ type: string sortOrder: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer required: - id - slug - name - sortOrder - groupings type: object ConnectorAuthStrategy: description: |- Authentication strategy row for a connector. Each strategy is persisted as its own record to support stable identity. properties: addressingConfig: description: >- Per-strategy API addressing configuration. Overrides the connector-level addressingConfig when this strategy is active. Variables with source=user_input must resolve from configSchema, this strategy's ingestionConfigSchema, or the connector's ingestionConfigSchema. oneOf: - $ref: '#/components/schemas/AddressingConfig' - enum: - null nullable: true type: object apiKeyConfig: description: API key settings (when type = API_KEY_HEADER or API_KEY_QUERY) oneOf: - $ref: '#/components/schemas/ApiKeyAuthConfig' - enum: - null nullable: true type: object basicConfig: description: Basic auth settings (when type = BASIC) oneOf: - $ref: '#/components/schemas/BasicAuthConfig' - enum: - null nullable: true type: object bearerConfig: description: Bearer token settings (when type = BEARER) oneOf: - $ref: '#/components/schemas/BearerAuthConfig' - enum: - null nullable: true type: object configSchema: description: Strategy-specific customer config schema nullable: true type: object createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string createdBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string credentialProbe: description: >- Declarative credential check for this strategy. When set, credential validation runs it instead of a dedicated or generic probe. oneOf: - $ref: '#/components/schemas/CredentialProbeWorkflow' - enum: - null nullable: true type: object defaultBaseUrl: description: >- Per-strategy base URL override. Takes precedence over the connector-level defaultBaseUrl when this strategy is active. format: uri maxLength: 2048 nullable: true pattern: >- ^https?://[\w\-\{\}]+(\.[\w\-\{\}]+)+([:/?#][\w\-\._~:/?#\[\]@!\$&'\(\)\*\+,;=\{\}%]*)?$ type: string defaultScopes: description: Default OAuth2 scopes for this auth strategy items: type: string nullable: true type: array delegatedUserField: description: Ingestion config field name for delegated user email (DWD) nullable: true type: string docs: description: >- Per-strategy setup documentation (Markdown). When set, the Parable app shows it in place of the vendor grouping's docs for the selected auth method. nullable: true pattern: ^[\s\S]*$ type: string extraHeaders: additionalProperties: type: string description: Additional headers to include in all authenticated requests nullable: true type: object hook: description: Optional hook reference executed for auth strategy behavior nullable: true type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string ingestionConfigSchema: description: >- Per-strategy ingestion config schema. When set, overrides the connector-level ingestionConfigSchema for workspace connectors using this auth strategy. nullable: true type: object label: description: Display label for this strategy in setup flows maxLength: 80 minLength: 2 nullable: true type: string oauth2Config: description: >- OAuth2 settings (when type = OAUTH2_CLIENT_CREDENTIALS or OAUTH2_REFRESH) oneOf: - $ref: '#/components/schemas/OAuth2AuthConfig' - enum: - null nullable: true type: object preEncodedBasicConfig: description: >- Pre-encoded basic auth settings (when type = BASIC with pre-encoded token) oneOf: - $ref: '#/components/schemas/PreEncodedBasicAuthConfig' - enum: - null nullable: true type: object support: description: |- Whether customers may use this strategy. Unset means supported when the backends run its type for this connector. oneOf: - $ref: '#/components/schemas/AuthStrategySupportEnum' - enum: - null nullable: true type: string type: $ref: '#/components/schemas/AuthMethodEnum' description: Authentication method updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - type type: object TenantConnectorStatusEnum: description: Operational status of a workspace connector instance. enum: - disabled - sync_failed - manual_validation_required - validation_pending - initial_syncing - update_syncing - sync_queued - idle - sync_partial_success - transform_quality_degraded - schedule_paused - config_invalid - credential_error - internal_error - ingestion_stale type: string Connector: description: Web Types of the Connector, see the db types for main reference properties: addressingConfig: description: >- API addressing configuration. Per-strategy addressingConfig on the active ConnectorAuthStrategy overrides this. oneOf: - $ref: '#/components/schemas/AddressingConfig' - enum: - null nullable: true type: object apiVersion: description: API version for documentation and compatibility nullable: true type: string createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string createdBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string defaultAudience: description: >- The audience of every tap that has no anchor and no audience of its own. oneOf: - $ref: '#/components/schemas/ConnectorDefaultAudienceEnum' - enum: - null nullable: true type: string defaultBaseUrl: description: Default base URL for API calls (can be overridden per-workspace) format: uri maxLength: 2048 nullable: true pattern: >- ^https?://[\w\-\{\}]+(\.[\w\-\{\}]+)+([:/?#][\w\-\._~:/?#\[\]@!\$&'\(\)\*\+,;=\{\}%]*)?$ type: string description: description: Description of what this connector does nullable: true type: string effortMetadata: description: >- ── Effort Estimation ──────────────────────────────────────────────── Structured effort estimation metadata (bucket, confidence, breakdown) nullable: true fieldDiscovery: description: >- Configuration for runtime field discovery. When present, wildcard tokens in SOQL/queries are resolved by calling a describe endpoint. oneOf: - $ref: '#/components/schemas/FieldDiscoveryConfig' - enum: - null nullable: true type: object id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string inboundAuthStrategies: description: |- Inbound sender verification strategies (collector / push-ingestion connectors only; absent for pull connectors) items: $ref: '#/components/schemas/InboundAuthStrategy' nullable: true type: array ingestionConfigSchema: description: >- Schema for the required ingestion params for the customer to setup this connector nullable: true type: object integrationClass: description: High-level integration class determining how data is extracted oneOf: - $ref: '#/components/schemas/IntegrationClassEnum' - enum: - null nullable: true type: string name: description: Human-readable connector name maxLength: 80 minLength: 2 type: string parallelParentFetch: description: Whether parent fan-out may run concurrently. type: boolean permissionModel: description: >- Access-gating model compiled into the immutable ingestion execution plan. oneOf: - $ref: '#/components/schemas/ConnectorPermissionModelEnum' - enum: - null nullable: true type: string protocolType: description: API protocol type (rest, graphql, webhook, otlp, agent, ...) nullable: true type: string rateLimits: description: Global rate limits (can be overridden per-tap) oneOf: - $ref: '#/components/schemas/ConnectorRateLimits' - enum: - null nullable: true type: object releaseStatus: $ref: '#/components/schemas/ConnectorLifecycleStatusEnum' description: >- ── Lifecycle ────────────────────────────────────────────────────────── setupDocumentation: description: >- ── Customer facing ───────────────────────────────────────────────────── Markdown document for a customer setting up this connector nullable: true pattern: ^[\s\S]*$ type: string slug: description: >- ── Identity ────────────────────────────────────────────────────────── Unique slug for this connector it is made of up of the first 8 characters of the taps name + _ + 8 random base62 characters maxLength: 32 minLength: 1 pattern: ^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$ type: string supportedAuthStrategies: description: >- ── Composable Components ────────────────────────────────────────────── Supported authentication strategies items: $ref: '#/components/schemas/ConnectorAuthStrategy' type: array taps: description: Available taps (data streams) items: $ref: '#/components/schemas/ConnectorTap' type: array timeoutSeconds: description: |- HTTP request timeout in seconds (default: 30). Increase for APIs that return large payloads slowly (e.g., Workday RaaS custom reports: 30-90s). format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer traversal: description: >- Traversal graph defining tap DAG relationships. Omit for flat connectors (all taps are roots with no edges). oneOf: - $ref: '#/components/schemas/ConnectorTraversalConfig' - enum: - null nullable: true type: object updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string validationEndpoint: description: >- Full URL for the credential-validation probe (a lightweight authenticated GET that returns 401/403 for a bad credential, 2xx for a good one); empty means probe defaultBaseUrl directly. format: uri maxLength: 2048 nullable: true pattern: >- ^https?://[\w\-\{\}]+(\.[\w\-\{\}]+)+([:/?#][\w\-\._~:/?#\[\]@!\$&'\(\)\*\+,;=\{\}%]*)?$ type: string visibilityModel: $ref: '#/components/schemas/ConnectorVisibilityModelEnum' description: >- How the source decides which of its own users may see a record. A stored connector with no value reads as not_modeled. required: - id - createdAt - createdBy - updatedAt - updatedBy - slug - name - supportedAuthStrategies - parallelParentFetch - taps - visibilityModel - releaseStatus type: object ValidationErrorCode: description: Error category when credential validation fails. enum: - auth_failed - internal_error - insufficient_permissions - expired - config_invalid type: string CredentialStatus: description: >- Credential Types for Workspace Connector Configuration These types define how credentials are stored and referenced for connector authentication. Credentials are stored securely in GCP Secret Manager - only metadata/references are in the DB. These types are created when customers configure connectors through the UI, as part of the workspace connector setup workflow. ============================================================================ Credential Enums ============================================================================ Status of stored credentials. enum: - valid - expired - invalid - pending - unvalidated type: string ParableVendorGrouping: description: >- Grouping for API responses - includes computed fields. Represents a node in the connector hierarchy (can be organizational or a leaf connector). properties: breadcrumbs: description: >- Full path for breadcrumbs (e.g., ['Atlassian', 'Jira', 'Jira Cloud']) items: type: string type: array connectorId: description: |- Reference to Connector entity for leaf groupings. Null for organizational groupings (folders). nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string connectorReleaseStatus: description: Connector engineering lifecycle. Null for organizational groupings. oneOf: - $ref: '#/components/schemas/ConnectorLifecycleStatusEnum' - enum: - null nullable: true type: string connectorSlug: description: >- The connector's slug for leaf groupings. Plot SQL names the connector's Provider by it (providers.., after Parable.CatalogSlug's fold), so a Parable page opens this grouping's setup for a Provider its SQL names. Null for organizational groupings (folders). maxLength: 32 minLength: 1 nullable: true pattern: ^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$ type: string description: nullable: true type: string docs: description: |- Documentation content (Markdown). Loaded from docsPath if set. nullable: true pattern: ^[\s\S]*$ type: string externalVersion: nullable: true type: string groupingPath: description: >- Slug path from vendor root to this grouping (e.g. 'jira/jira-cloud'). Used to build config URLs on the frontend. Null when not needed. nullable: true type: string groupings: description: Child groupings items: $ref: '#/components/schemas/ParableVendorGrouping' type: array id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string ingestionConfigSchema: description: |- If connector ID is set, then this value will be set to the ingestion config schema required for that connector nullable: true type: object integrationClass: description: >- High-level integration class of the connector for leaf groupings (e.g. API pull vs STREAMING push). Null for organizational groupings. Drives the configuration flow variant in the frontend. oneOf: - $ref: '#/components/schemas/IntegrationClassEnum' - enum: - null nullable: true type: string isLeaf: description: |- Whether this is a leaf node (can be configured). Computed: true if connectorId is set. type: boolean logo: description: Logo for this grouping. Falls back to vendor logo when not set. nullable: true type: object name: description: An objects name maxLength: 80 minLength: 2 type: string parableVersion: nullable: true type: string parent: description: Parent grouping (null if top-level under vendor) oneOf: - $ref: '#/components/schemas/ParableVendorGrouping' - enum: - null nullable: true type: object priority: description: >- Priority assigned to this grouping for the current workspace, if any. Set by Parable admins via the admin API. oneOf: - $ref: '#/components/schemas/ConnectorPriorityEnum' - enum: - null nullable: true type: string protocolType: description: >- Push-protocol type of the connector for STREAMING leaf groupings (e.g. "otlp", "webhook"). Null for pull connectors and organizational groupings. Drives protocol-specific endpoint setup instructions in the frontend (e.g. OTLP exporter environment variables). nullable: true type: string releaseStage: $ref: '#/components/schemas/ParableReleaseStageEnum' slug: description: A URL friendly version of a string maxLength: 17 minLength: 1 pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$ type: string sortOrder: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer supportedAuthStrategies: description: |- If connector ID is set, then this value will be set to the supported auth strategies required for that connector items: $ref: '#/components/schemas/ConnectorAuthStrategy' nullable: true type: array supportedInboundAuthStrategies: description: >- If connector ID is set and the connector is a push (STREAMING) connector, the inbound sender-verification strategies it supports. The workspace picks one and supplies its configSchema credentials at setup. items: $ref: '#/components/schemas/InboundAuthStrategy' nullable: true type: array vendor: $ref: '#/components/schemas/ParableVendor' description: Vendor this belongs to required: - id - slug - name - releaseStage - sortOrder - vendor - groupings - isLeaf - breadcrumbs type: object SyncJobStatus: description: Status of a sync job. enum: - pending - running - completed - failed - cancelled - partial_success type: string TenantParentDataFilterEntry: description: >- One workspace allowlist entry: a parent tap name and the predicate applied to that tap's records before child fan-out. Look up by parentTap at read time. properties: parentTap: description: Parent tap name this predicate applies to (traversal edge `from`). maxLength: 255 type: string predicate: $ref: '#/components/schemas/ParentEligibilityPredicate' required: - parentTap - predicate type: object AddressingConfig: description: >- API addressing configuration for a connector or auth strategy. Defines the URL template and how each template variable is resolved at runtime. properties: basePath: description: >- Base path appended to host (e.g. /ex/jira/{cloudId}). Must start with /. nullable: true type: string host: description: >- API hostname. May contain {var} placeholders resolved from typed variables. nullable: true type: string scheme: description: URL scheme. Defaults to https when omitted by runtime consumers. nullable: true type: string variables: description: Typed declarations for {var} placeholders in host and basePath. items: $ref: '#/components/schemas/AddressingVariable' nullable: true type: array type: object ApiKeyAuthConfig: description: Configuration for API key authentication. properties: credentialHeaders: additionalProperties: type: string description: >- More headers sent with the API key on every request, for API_KEY_HEADER. Maps header name to the credential field whose value it carries, e.g. {'DD-APPLICATION-KEY': 'applicationKey'} beside headerName 'DD-API-KEY'. nullable: true type: object headerName: description: Header name for API_KEY_HEADER (e.g., 'X-API-Key') nullable: true type: string queryParam: description: Query parameter name for API_KEY_QUERY nullable: true type: string type: object BasicAuthConfig: description: Configuration for HTTP basic authentication. properties: passwordField: description: Config field path for password (e.g., 'auth.apiToken') type: string passwordValue: description: >- Static password when the API expects a fixed value (e.g. BambooHR HTTP Basic uses x). Applied when decrypted credentials omit the password field. nullable: true type: string usernameField: description: Config field path for username (e.g., 'auth.email') type: string required: - usernameField - passwordField type: object BearerAuthConfig: description: Configuration for bearer token authentication. properties: headerName: description: 'Header name (default: ''Authorization'')' nullable: true type: string tokenField: description: 'Token Field (defaults to: ''token'')' nullable: true type: string tokenPrefix: description: >- Token prefix (default: 'Bearer'); an empty prefix sends the bare token nullable: true type: string type: object CredentialProbeWorkflow: description: >- The credential check an auth strategy declares instead of the generic probe,. Operations run in order: the first one whose outcome is not success decides the verdict, and the credential is valid when every operation succeeds. success maps to VALID; auth_rejected, permission_denied and config_invalid to INVALID with that reason; retry and upstream_failure keep the stored status; expected_empty, and a response no rule matches, leave the credential unvalidated. properties: maxRequests: description: >- Most HTTP requests the workflow may send, retries included. Defaults to 6. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 nullable: true type: integer operations: description: The operations to run, in order. items: $ref: '#/components/schemas/ProviderOperation' type: array signedTokens: description: Tokens the check signs from the credential. At most 4. items: $ref: '#/components/schemas/ProviderSignedToken' nullable: true type: array timeoutSeconds: description: >- Wall-clock budget for the whole workflow. Defaults to 30. A workflow that runs out of time keeps the stored credential status. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 nullable: true type: integer writebacks: description: >- Extracted values written to the connection's ingestion config when every operation succeeds. A value that fails its target field's type, or that matches a credential or secret value, is withheld. items: $ref: '#/components/schemas/CredentialProbeWriteback' nullable: true type: array required: - operations type: object OAuth2AuthConfig: description: Configuration for OAuth 2.0 authentication flows. properties: audienceParam: description: Audience parameter (for APIs that require it) nullable: true type: string authorizeUrl: description: Authorization URL (for authorization code flow) format: uri maxLength: 2048 nullable: true pattern: >- ^https?://[\w\-\{\}]+(\.[\w\-\{\}]+)+([:/?#][\w\-\._~:/?#\[\]@!\$&'\(\)\*\+,;=\{\}%]*)?$ type: string grantType: description: OAuth2 grant type (e.g. client_credentials, account_credentials) oneOf: - $ref: '#/components/schemas/OAuthGrantType' - enum: - null nullable: true type: string passwordField: description: Credential field name for password (basic_credentials auth method) nullable: true type: string platformManagedClient: description: >- Whether Parable owns the OAuth client and supplies its credentials at runtime. nullable: true type: boolean resourceHeaders: additionalProperties: type: string description: Maps resource request header names to credential field names. nullable: true type: object scopes: description: >- OAuth scopes for the token request (space-joined in the token POST body per RFC 6749) items: type: string nullable: true type: array tokenBodyEncoding: description: Token request body encoding (form by default). oneOf: - $ref: '#/components/schemas/BodyEncodingEnum' - enum: - null nullable: true type: string tokenEndpoint: description: Token endpoint URL format: uri maxLength: 2048 pattern: >- ^https?://[\w\-\{\}]+(\.[\w\-\{\}]+)+([:/?#][\w\-\._~:/?#\[\]@!\$&'\(\)\*\+,;=\{\}%]*)?$ type: string tokenEndpointAuthMethod: description: How credentials are sent to the token endpoint oneOf: - $ref: '#/components/schemas/TokenEndpointAuthMethod' - enum: - null nullable: true type: string tokenEndpointExtraParams: description: Maps token request param names to credential field names nullable: true tokenPrefix: description: 'Authorization header prefix (default: Bearer)' nullable: true type: string tokenReadinessDelaySeconds: description: >- Delay between token issuance and the first request that uses the token. format: int64 maximum: 10 minimum: 0 nullable: true type: integer tokenRefreshCodes: description: >- HTTP failure status codes on API responses that trigger an OAuth2 access-token refresh and a single retry of the same request (client-credentials flow). When this field is omitted, ingestion defaults to HTTP 401 as the only refresh trigger (equivalent to a list containing 401), so long paginated syncs can recover after token TTL (for example Microsoft Graph). Pass an explicit empty list to disable HTTP-triggered refresh; proactive refresh near local token expiry may still apply. items: description: HTTP response status code, 100 through 599 format: int64 maximum: 599 minimum: 400 type: integer nullable: true type: array tokenResponsePath: description: 'Dot-separated path to token in response JSON (default: access_token)' nullable: true type: string usernameField: description: Credential field name for username (basic_credentials auth method) nullable: true type: string required: - tokenEndpoint type: object PreEncodedBasicAuthConfig: description: |- Configuration for pre-encoded HTTP basic authentication. Uses an already-encoded Base64 token instead of username:password. properties: tokenField: description: Credential field name for the pre-encoded Base64 token type: string required: - tokenField type: object AuthStrategySupportEnum: description: >- Whether customers may use an auth strategy. A strategy is usable only when Parable can both validate its credentials and ingest with it. The catalog may record a strategy that the vendor offers and Parable cannot run yet. It does not offer that strategy to customers. enum: - supported - unsupported type: string AuthMethodEnum: description: Authentication method for API calls. enum: - bearer - basic - api_key_header - api_key_query - oauth2_client_credentials - oauth2_refresh - google_domain_wide_delegation - oauth2_jwt_bearer - oauth2_auth_code_pkce - session_exchange - session_exchange_jwt - session_exchange_password - custom - saml - mtls - ssh_key - kerberos - aws_sig_v4 - gcp_service_account - hmac - digest - ntlm - azure_ad - oauth2_device_code type: string ConnectorDefaultAudienceEnum: description: >- The audience of a tap that has no anchor and no audience of its own. Declared on a connector for all of its taps, or on one tap. enum: - source_users - unrestricted type: string FieldDiscoveryConfig: description: >- Configuration for runtime field discovery. Some APIs (e.g., Salesforce) use a wildcard token like FIELDS(ALL) that only works below a field-count threshold. This config tells the ingestion engine how to call a describe/schema endpoint, enumerate queryable fields, and substitute the wildcard with the explicit field list before executing queries. properties: endpointTemplate: description: >- Describe endpoint template with {objectName} and {apiVersion} placeholders type: string excludeFieldTypes: description: >- Field types to exclude from the resolved list (e.g., ['address', 'location']) items: type: string nullable: true type: array fieldArrayPath: description: Path to field array in describe response (e.g., 'fields') type: string fieldNameKey: description: Key for field name in each descriptor object (e.g., 'name') type: string fieldTypeKey: description: Key for field type in each descriptor object (e.g., 'type') type: string includeCondition: description: >- Optional condition for including fields (e.g., only queryable fields) oneOf: - $ref: '#/components/schemas/FieldDiscoveryIncludeCondition' - enum: - null nullable: true type: object objectNameField: description: 'Tap field that holds the API object name (default: ''objectName'')' type: string wildcardToken: description: Token to replace with resolved field list (e.g., 'FIELDS(ALL)') type: string required: - endpointTemplate - objectNameField - fieldArrayPath - fieldNameKey - fieldTypeKey - wildcardToken type: object InboundAuthStrategy: description: |- Inbound sender verification strategy for a collector (push-ingestion) connector. Web projection; see the db type for main reference. properties: configSchema: description: >- Schema for the verification credentials the workspace must supply at connector setup. Stored in the runtime-IR wire form (secret fields have `secret: true`; "x-secret": true in the JSON-Schema authoring form). nullable: true type: object createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string createdBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string handshakeKind: $ref: '#/components/schemas/InboundHandshakeKindEnum' description: >- Subscription-time validation dance performed when the workspace registers the ingest URL in the vendor console id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string label: description: Display label for this strategy in setup flows maxLength: 80 minLength: 2 nullable: true type: string replayWindowSeconds: description: Maximum accepted age, in seconds, of the timestampHeader value format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer signatureBase: description: >- Template for the string the sender signs. Placeholders: {timestamp}, {body}. Example (Slack): "v0:{timestamp}:{body}" nullable: true type: string signatureHeader: description: >- Header carrying the sender's signature (when verificationType = HMAC_SHA256) nullable: true type: string timestampHeader: description: Header carrying the sender's request timestamp for replay protection nullable: true type: string updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string verificationType: $ref: '#/components/schemas/InboundVerificationTypeEnum' description: How the collector verifies the sender of a pushed payload required: - id - createdAt - createdBy - updatedAt - updatedBy - verificationType - handshakeKind type: object IntegrationClassEnum: description: >- High-level integration class determining how data is extracted from a connector. enum: - api - database - file - streaming - meta_tool - custom type: string ConnectorPermissionModelEnum: description: >- How a connector gates access to a tap's data, which determines how the platform expresses each tap's required access and reconciles it against what the customer's credential actually grants. This is the permission *vocabulary*, not an exemption: only `none` opts a connector out of per-tap requirements. enum: - object_acl - oauth_scope - none type: string ConnectorRateLimits: description: >- Connector Rate Limits Rate limiting and retry configuration for connectors and individual taps. Can be set at the connector level (global) and overridden per-tap. Rate limit configuration for a connector or tap. properties: admissionKind: $ref: '#/components/schemas/RequestAdmissionKindEnum' description: >- How provider requests are admitted. Absent means fixed: the limits below. provider_budget must be explicit and is the only kind that may carry providerBudgetPolicy. maxConcurrent: description: Maximum concurrent requests format: int64 maximum: 9007199254740991 minimum: 1 nullable: true type: integer providerBudgetPolicy: oneOf: - $ref: '#/components/schemas/ProviderBudgetPolicy' - enum: - null nullable: true type: object requestsPerSecond: description: Maximum requests per second format: double minimum: 0.000001 nullable: true type: number resetHeader: description: >- Response header containing the Unix epoch reset time (e.g. x-rate-limit-reset for Okta). Used as fallback when Retry-After is absent. It times the cooldown only; it does not by itself mark a 403 as a throttle. maxLength: 255 nullable: true pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string retry: description: Retry behavior configuration oneOf: - $ref: '#/components/schemas/RetryConfig' - enum: - null nullable: true type: object required: - admissionKind type: object ConnectorLifecycleStatusEnum: description: >- ConnectorLifecycleStatusEnum is the release-maturity label on a connector definition (Connector.releaseStatus). Values Draft through Verified are an ordered progression. Write paths preserve maturity unless given an explicit higher or lower target. ParableReleaseStageEnum controls what customers see. Maturity progression and required proof: Draft -> identity proof Configured -> catalog proof Authorized -> credential-intake proof (product label: Authorizable) Executable -> config-execution proof Landing -> orchestration proof Materialized -> query proof Verified -> release proof enum: - draft - configured - authorized - executable - landing - materialized - modeled - verified - deprecated type: string ConnectorTap: description: |- Definition of a data extraction tap for a connector. A tap represents a single endpoint/entity type that can be extracted. properties: access: description: |- The access facts this tap carries for source permissions. Null = none. oneOf: - $ref: '#/components/schemas/TapAccessConfig' - enum: - null nullable: true type: object createdAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string createdBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string customFields: description: Capture config for dynamic/custom fields. Null = capture off. oneOf: - $ref: '#/components/schemas/TapCustomFieldsConfig' - enum: - null nullable: true type: object dataKind: description: |- Materialization class for this tap's records on the promote path. Null = undeclared; the promote path applies documented defaults. oneOf: - $ref: '#/components/schemas/TapDataKindEnum' - enum: - null nullable: true type: string deduplicateAcrossLoads: description: >- Whether records with the same declared transform key are deduplicated across separate loads. type: boolean deletionSemantics: description: >- How deletions are detectable in this tap's source. Null = undeclared. oneOf: - $ref: '#/components/schemas/TapDeletionSemanticsEnum' - enum: - null nullable: true type: string description: description: Human-readable description of what this tap extracts nullable: true type: string docs: description: Reader-facing tap identity. Null for some older Taps. oneOf: - $ref: '#/components/schemas/TapDocumentation' - enum: - null nullable: true type: object enabledByDefault: description: Whether this tap is enabled by default for new connections type: boolean enabledSince: description: |- Start of the current uninterrupted default-enabled period. Null when disabled, or when the period started before Parable recorded it. format: date-time nullable: true type: string errorBodyRules: description: >- Rules that reclassify HTTP errors from the response body (retry vs skip). items: $ref: '#/components/schemas/ErrorBodyRule' nullable: true type: array extractionHook: description: Hook executed after extracting response records nullable: true type: string icon: description: Semantic Font Awesome glyph name. Null for some older Taps. nullable: true type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string identityDirectory: description: >- Marks principal/account-directory taps (e.g. Slack users, Okta users). Directory taps are unioned into the account set downstream. type: boolean name: description: Unique name for this tap (e.g., 'repos', 'issues', 'users') maxLength: 80 minLength: 1 pattern: ^[a-z][a-z0-9_]*$ type: string objectName: description: >- API object name for field discovery (e.g., 'User', 'Account' for Salesforce SOQL objects) nullable: true type: string parentContextFields: description: >- Mappings to inject parent record values into tap output records. Used on root taps fed by config fan-out when no traversal edge supplies parent context (e.g. team_id from synthetic parent records). items: $ref: '#/components/schemas/ParentContextFieldMapping' nullable: true type: array perParentAuth: description: >- Per-parent authentication or request headers. When unset the connector's default auth is used without parent-derived headers. oneOf: - $ref: '#/components/schemas/TapPerParentAuth' - enum: - null nullable: true type: object purpose: description: Free-form Markdown explaining why customers use this data stream. nullable: true pattern: ^[\s\S]*$ type: string qualityConfig: oneOf: - $ref: '#/components/schemas/TapQualityConfig' - enum: - null nullable: true type: object rateLimitOverride: description: Rate limit overrides for this specific tap oneOf: - $ref: '#/components/schemas/ConnectorRateLimits' - enum: - null nullable: true type: object rateLimits: description: >- Per-tap rate limits (e.g. maxConcurrent) merged over connector defaults. oneOf: - $ref: '#/components/schemas/ConnectorRateLimits' - enum: - null nullable: true type: object requestHook: description: Hook executed before making transport requests nullable: true type: string requiredAccess: description: >- Read-only. The access this tap needs, derived from the connector's permissionModel and this tap's sync.scopes or objectName. Null when the tap lacks a required field or its connector has multiple auth strategies. Strategy-specific declarations are not yet supported. oneOf: - $ref: '#/components/schemas/TapRequiredAccess' - enum: - null nullable: true type: object responseExtraction: $ref: '#/components/schemas/ResponseExtractionConfig' description: How to extract records from API responses retentionPolicy: description: >- Source API data retention policy. Null if the source has no retention limit. oneOf: - $ref: '#/components/schemas/TapRetentionPolicy' - enum: - null nullable: true type: object schema: description: >- The schema describing the shape of the data this tap outputs. Customers render this in the data-catalog UI to enumerate available fields. type: object sync: $ref: '#/components/schemas/TapSyncConfig' description: Sync strategy and incremental parameters tombstoneMarkerColumn: description: >- Root schema field whose truthy value marks an explicit tombstone record. Required when deletionSemantics is tombstone. nullable: true type: string transportOptions: description: Prioritized transport options for this tap items: $ref: '#/components/schemas/TapTransportOption' type: array updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - name - transportOptions - responseExtraction - sync - enabledByDefault - schema - deduplicateAcrossLoads - identityDirectory type: object ConnectorTraversalConfig: description: |- Connector Traversal Configuration Formalizes the implicit DAG (parentTap/parentKeyField) into an explicit traversal graph with typed edges. This makes the data extraction order visible at the schema level and enables validation (cycle detection, orphan detection, fan-out limits). Traversal configuration defining the DAG of tap relationships. The ingestion engine uses this to determine extraction order and parent-child data flow. properties: configFanouts: description: >- Maps a multi-value ingestion config field to a URL template variable for root taps. The runtime fans out one API request per value. items: $ref: '#/components/schemas/ConnectorConfigFanout' nullable: true type: array edges: description: >- Directed edges defining parent-child relationships between taps. Each edge specifies how parent records are used to construct child requests. items: $ref: '#/components/schemas/ConnectorEdge' nullable: true type: array rootTaps: description: >- Taps with no parent — the entry points for data extraction. These are synced first; their records feed into child taps via edges. items: description: >- A machine identifier for a data tap (lowercase letter, then lowercase alphanumeric or underscores) maxLength: 80 minLength: 1 pattern: ^[a-z][a-z0-9_]*$ type: string type: array required: - rootTaps type: object ConnectorVisibilityModelEnum: description: >- How a source system decides which of its own users may see a record. This describes the source's rules for its users. It is separate from ConnectorPermissionModelEnum, which describes what Parable's credential needs in order to read a tap. enum: - record_acl - container_acl - source_users - unrestricted - not_modeled type: string ConnectorPriorityEnum: description: Priority level assigned to a vendor grouping for a specific workspace. enum: - required - suggested type: string ParableReleaseStageEnum: description: |- Release stage for connector offerings. Determines visibility and access in the connector catalog. enum: - ga - early_access - invite_access - coming_soon type: string ParentEligibilityPredicate: description: >- One condition a parent record must satisfy to be fanned out to a child tap. A predicate must only encode deterministic expected absence -- a parent the vendor is already known to have no child rows for. It must never encode transient errors, access failures, or merely slow parents; those are retryable and filtering them silently loses data. ParentEligibilityOperatorEnum documents each operator and its operand. properties: field: description: Parent record field to evaluate. Dotted path for nested fields. maxLength: 255 type: string operator: $ref: '#/components/schemas/ParentEligibilityOperatorEnum' description: Comparison to apply to the field value. threshold: description: >- Operand for the numeric and length operators. Unused by every other operator. format: double nullable: true type: number values: description: Operand for `any_of` and `none_of`. Unused by every other operator. items: maxLength: 255 type: string maxItems: 10000 minItems: 1 nullable: true type: array required: - field - operator type: object AddressingVariable: description: A single template variable in an AddressingConfig. properties: name: description: Name of the {var} placeholder in host or basePath. type: string oauthResponsePath: description: |- Dot-separated path into the OAuth token response body. Required when source = oauth_response. nullable: true type: string required: description: Whether a missing value for this variable should halt the sync. nullable: true type: boolean source: description: 'Resolution source: user_input, oauth_response, or static.' type: string required: - name - source type: object ProviderOperation: description: One request and the rules that judge its response. properties: extracts: description: Values read from the response when the operation succeeds. items: $ref: '#/components/schemas/ProviderExtract' nullable: true type: array id: description: >- Unique within its workflow. Named in results and admission errors, and in `${step..}` references from later operations. type: string invocation: description: 'Runs the operation once per member of a list. Absent: one request.' oneOf: - $ref: '#/components/schemas/ProviderInvocation' - enum: - null nullable: true type: object outcomes: description: >- Ordered outcome rules; the first rule whose predicates all hold decides. items: $ref: '#/components/schemas/ProviderOutcomeRule' type: array request: $ref: '#/components/schemas/ProviderRequestTemplate' description: The request to send. required: - id - request - outcomes type: object ProviderSignedToken: description: >- A short-lived JWT a check signs from the strategy's credential, for a provider whose sign-in takes a token the client mints itself, such as a Tableau Connected App. Requests read it as `${signed.}`; it is secret, so it goes only in a header that carries a credential or as a whole string value of a sign-in body. It is minted fresh for each request: the executor adds `exp` (now plus lifetimeSeconds) and a random `jti`, and sets the JOSE header's `alg` and `typ`. The signing key never enters the token, a URL, a log or a result. properties: algorithm: $ref: '#/components/schemas/ProviderSigningAlgorithmEnum' description: How the token is signed. claims: description: >- The claims, as a JSON object. A member is a string, which may hold the same references as a header value, a number, a boolean, or a list of strings. The executor sets `exp` and `jti`; neither they nor `iat` and `nbf` may be declared. headers: additionalProperties: type: string description: |- JOSE header members besides `alg` and `typ`: only `kid` and `iss`. A value may hold `${credential.}` and non-secret `${ingestion.}` references. nullable: true type: object key: description: |- The credential field holding the signing key. It must be declared x-secret, and no claim or header value may reference it. type: string lifetimeSeconds: description: How long the token is valid, from 1 to 600 seconds. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer name: description: Unique within the workflow; the name `${signed.}` reads. type: string required: - name - algorithm - key - lifetimeSeconds - claims type: object CredentialProbeWriteback: description: |- An extracted value a successful workflow stores in the connection's ingestion config, the way a Tableau sign-in records the site id. Only an extract declared `secret: false`, of type string, may be written, and only to a declared, non-URL, string ingestion field. properties: extract: description: The extract's name within that operation. type: string operation: description: The id of the operation that extracts the value. type: string target: description: The top-level ingestion config field the value is written to. type: string required: - operation - extract - target type: object OAuthGrantType: description: OAuth 2.0 grant type for token requests. enum: - client_credentials - authorization_code - refresh_token - account_credentials type: string BodyEncodingEnum: description: Serialization of a POST/PUT/PATCH request body for a REST endpoint. enum: - json - form type: string TokenEndpointAuthMethod: description: How client credentials are sent to the OAuth2 token endpoint. enum: - client_secret_basic - client_secret_post - none - basic_credentials type: string FieldDiscoveryIncludeCondition: description: >- ============================================================================= Field Discovery ============================================================================= Condition for including a field during field discovery. Allows filtering describe-endpoint results by a boolean or enum property. properties: key: description: Field key to check on each field descriptor (e.g., 'queryable') type: string value: description: Required value for inclusion (e.g., true) required: - key - value type: object InboundHandshakeKindEnum: description: |- Subscription-time validation dance a webhook provider performs when the workspace registers the ingest URL in the vendor console. The collector implements each kind exactly once; the set is deliberately bounded. enum: - none - slack_url_verification - ms_graph_validation_token type: string InboundVerificationTypeEnum: description: >- How Parable verifies a sender that pushes data to incoming.parable.work. AuthMethodEnum covers the other direction: the API calls that Parable makes to a Provider. enum: - hmac_sha256 - bearer_token - device_key - none type: string RequestAdmissionKindEnum: enum: - fixed - provider_budget type: string ProviderBudgetPolicy: properties: budgets: items: $ref: '#/components/schemas/ProviderBudgetDefinition' minItems: 1 type: array feedback: items: $ref: '#/components/schemas/ProviderBudgetFeedbackRule' nullable: true type: array operations: items: $ref: '#/components/schemas/ProviderBudgetOperation' minItems: 1 type: array quotaOwner: $ref: '#/components/schemas/ProviderQuotaOwnerSelector' required: - quotaOwner - budgets - operations type: object RetryConfig: description: >- Retry behavior for rate-limited or failed requests. A tap's retry block layers over the connector's, so every field keeps presence: a field a layer does not set is inherited, and TapRequestRetryPolicy holds the default when no layer sets it. properties: maxRetries: description: >- Attempt budget per request, counting the first attempt: 5 sends a request at most 5 times, so at most 4 retries. The name predates the budget and stays so stored definitions keep working. An explicit 0 keeps its presence through a Go read and write: Go declares an optional integer without a default as a pointer. format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer maxRetryTimeSeconds: description: >- Seconds from a request's first failed attempt to its last retry. Time spent before that first outcome counts against the execution deadline. format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer respectRetryAfter: description: >- Honor a Retry-After header on a rate-limited or failed response. Unset honors it under fixed admission. A provider_budget layer must leave it unset, and the control plane checks whether a layer set it (connectordef ValidateTapRequestAdmission). nullable: true type: boolean type: object TapAccessConfig: description: >- The access facts a tap carries for source permissions. The sync manifest carries it and the execution plan drops it: the access job reads it live, as the identity job reads identityDirectory. properties: defaultAudience: description: Overrides the connector's defaultAudience for this tap. oneOf: - $ref: '#/components/schemas/ConnectorDefaultAudienceEnum' - enum: - null nullable: true type: string roles: description: Which access facts the tap's rows are. items: $ref: '#/components/schemas/TapAccessRoleEnum' type: array required: - roles type: object TapCustomFieldsConfig: description: >- Capture config for dynamic/custom fields on the provider-pool promote path. Patterns route keys into `_custom_fields`; remaining undeclared keys land in `_raw_unknown_fields` when captureUnknownFields is true. Prefer patterns over per-workspace field ID allowlists. properties: captureUnknownFields: description: |- When true, undeclared keys that do not match known patterns land in `_raw_unknown_fields` instead of being dropped. type: boolean knownCustomFieldKeyPatterns: description: >- Glob-style patterns (prefix `customfield_*`, suffix `*__c`, or exact). items: type: string nullable: true type: array required: - captureUnknownFields type: object TapDataKindEnum: description: >- Materialization class for a tap's records on the ingestion-to-transformation promote path. Selects how the transformation layer materializes the stream. enum: - snapshot - event - changelog type: string TapDeletionSemanticsEnum: description: How deletions in the source are detectable for a tap. enum: - by_absence - tombstone - undetectable type: string TapDocumentation: description: >- Reader-facing identity for a connector tap. The longer explanation and glyph live beside this object on the tap because they have distinct scalar and validation contracts. properties: title: description: Short human-facing title used in catalog and configuration surfaces. maxLength: 80 minLength: 2 type: string required: - title type: object ErrorBodyRule: description: >- Rule for classifying HTTP errors by inspecting the response body. When the HTTP status code matches, a JMESPath expression extracts a value from the body and compares it against the retry and empty lists. properties: emptyValues: description: >- Values that mean the provider found no records for the request (Gong answers an empty window with a 404 naming it). A matching response is a page with zero records and the read completes; it is not an error and not a refusal. items: type: string nullable: true type: array jmesPath: description: JMESPath expression to extract a value from the response body type: string retryValues: description: Values that indicate the error is transient and should be retried items: type: string nullable: true type: array statusCode: description: HTTP status code this rule applies to format: int64 maximum: 599 minimum: 100 type: integer required: - statusCode - jmesPath type: object ParentContextFieldMapping: description: >- ============================================================================= Tap Definition Types ============================================================================= Mapping from a target field name to a source field name in the parent record. Used to inject parent record values into child records during tap execution. properties: sourceField: description: Field name to read from parent record type: string targetField: description: Field name to set in child records type: string required: - targetField - sourceField type: object TapPerParentAuth: description: >- ============================================================================= Per-Parent Authentication ============================================================================= Per-parent authentication configuration for taps that iterate over records from a parent tap. A tap can mint a delegated service-account token or retain the connector credential and add a request header derived from its parent. properties: headerName: description: Request header added by `request_header`. nullable: true type: string impersonateField: description: Parent field containing the delegated service-account subject. nullable: true type: string method: description: >- `service_account` mints a delegated token. `request_header` keeps the connector authorization and adds one parent-derived request header. type: string quotaUserHeader: description: |- Optional HTTP header name to set the per-user value on each request (e.g., `x-goog-quota-user` so per-user quota is attributed to the impersonated user instead of the service account). nullable: true type: string valueField: description: >- Parent-record field path whose scalar value is written to `headerName`. nullable: true type: string required: - method type: object TapQualityConfig: properties: rules: items: $ref: '#/components/schemas/QualityRuleConfig' type: array spc: $ref: '#/components/schemas/TapSpcConfig' required: - rules - spc type: object TapRequiredAccess: description: >- The access a Provider credential must carry before a tap can read its data. Derived on read from the connector's permissionModel and the tap's own declaration by connectordef.RequiredAccess. Never stored or authored, so it cannot drift from sync.scopes or objectName. Multiple auth strategies yield unknown until per-strategy declarations are supported. Combined permission models are unsupported and fail validation. properties: model: $ref: '#/components/schemas/ConnectorPermissionModelEnum' description: >- How the connector gates access. A connector with no permissionModel reads as none. values: description: >- oauth_scope: the tap's sync.scopes. object_acl: the tap's objectName. none: empty, because the credential works for the whole account or not at all. items: type: string type: array required: - model - values type: object ResponseExtractionConfig: description: >- ============================================================================= Response Extraction ============================================================================= How to extract records from an API response. properties: primaryKey: description: Primary key field name for deduplication (e.g., 'id') type: string responseFormat: description: >- Wire format of the response body. Defaults to JSON when null. Set to JSONL for newline-delimited JSON responses (one record per line, body is not a single JSON document), e.g. Mixpanel's Raw Event Export API. With JSONL, set responsePath to '@' so each line becomes a record. oneOf: - $ref: '#/components/schemas/ResponseFormatEnum' - enum: - null nullable: true type: string responsePath: description: |- JMESPath expression to extract records from response. Examples: '@' (response is array), 'data', 'results.items' nullable: true type: string responsePathFallback: description: >- Fallback JMESPath when the primary responsePath returns null. Handles polymorphic responses where the array may be at a different path (e.g., TestrRail suites: 'suites' normally, 'root_array' for single-suite projects). nullable: true type: string responseValidation: description: Validation rules for API response success/error handling oneOf: - $ref: '#/components/schemas/ResponseValidation' - enum: - null nullable: true type: object syntheticPrimaryKey: description: >- Synthetic primary key configuration. When present, generates a unique ID by hashing the specified fields. The primaryKey field becomes the output field name where the hash is stored (e.g., primaryKey: "id"). oneOf: - $ref: '#/components/schemas/SyntheticPrimaryKeyConfig' - enum: - null nullable: true type: object required: - primaryKey type: object TapRetentionPolicy: description: >- ============================================================================= Retention Policy ============================================================================= Data retention policy for a tap's source API. When set, enables proactive alerting when ingestion gaps risk permanent data loss due to source-side retention expiry. properties: alertThresholdDays: description: |- Alert when remaining coverage buffer drops below this many days. Default: 7 days (alert fires when we are 7 days from losing data). format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer retentionDays: description: |- Maximum number of days the source API retains historical data. After this window, data is permanently unrecoverable. Example: Google Meet API = 30 days, Zoom Reports = 180 days. format: int64 maximum: 9007199254740991 minimum: 0 type: integer required: - retentionDays type: object TapSyncConfig: description: >- ============================================================================= Sync Configuration ============================================================================= Sync strategy and incremental parameters for a tap. properties: asyncQuery: description: >- Async query configuration for APIs that use a create-poll-fetch pattern (e.g., Microsoft Purview audit logs). When present, the ingestion engine POSTs to create a query job, polls for completion, then fetches paginated results. oneOf: - $ref: '#/components/schemas/AsyncQueryConfig' - enum: - null nullable: true type: object cursorField: description: |- Cursor field for incremental sync watermarks (e.g., 'updated_at'). Required when mode = INCREMENTAL. nullable: true type: string cursorValueFormat: description: >- Format of raw cursorField values on API records (partial watermark only). Stored control-plane watermarks remain ISO8601. oneOf: - $ref: '#/components/schemas/IncrementalTimeFormatEnum' - enum: - null nullable: true type: string incrementalParams: description: Configuration for incremental time-based filtering oneOf: - $ref: '#/components/schemas/IncrementalParamsConfig' - enum: - null nullable: true type: object maxLookbackDays: description: >- Maximum lookback days for a run without a watermark. When set, the watermarkless window is capped to min(global lookback, maxLookbackDays). Use for APIs with data retention limits (e.g., Zoom Report API rejects queries older than 12 months). format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer mode: $ref: '#/components/schemas/SyncModeEnum' description: 'Sync mode: FULL extracts all records, INCREMENTAL uses watermarks' refreshLookbackDays: description: Number of days to overlap each incremental request with prior work. format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer scopes: description: >- OAuth scopes required for this tap (e.g., Google Workspace per-service scopes) items: type: string nullable: true type: array required: - mode type: object TapTransportOption: description: >- ============================================================================= Transport Options ============================================================================= A prioritized transport option for executing a tap. Taps can define multiple options and the runtime chooses by priority. properties: apiType: $ref: '#/components/schemas/ApiTypeEnum' description: API transport type for this option errorBodyRules: description: >- Rules for disambiguating HTTP error responses by inspecting the response body. Allows overriding the default error classification (transient/permanent/skippable) based on status code + body content. items: $ref: '#/components/schemas/ErrorBodyRule' nullable: true type: array graphqlConfig: description: GraphQL endpoint configuration (when apiType = GRAPHQL) oneOf: - $ref: '#/components/schemas/GraphQLEndpointConfig' - enum: - null nullable: true type: object pagination: $ref: '#/components/schemas/PaginationConfig' description: Pagination configuration for this transport option paginationHook: description: Optional hook reference for custom pagination behavior nullable: true type: string priority: description: Execution priority (1 is highest priority) format: double type: number providerBudgetOperation: description: >- The provider budget policy operation every request of this option charges. Provider-budget taps read pages, streams and batches; a tap with field discovery or an async job uses fixed admission. minLength: 1 nullable: true type: string restConfig: description: REST endpoint configuration (when apiType = REST) oneOf: - $ref: '#/components/schemas/RestEndpointConfig' - enum: - null nullable: true type: object required: - priority - apiType - pagination type: object ConnectorConfigFanout: description: >- Declares how a list-valued ingestion config field drives root-tap fan-out. properties: configField: description: Ingestion config property name (e.g. team_ids). type: string separator: description: >- Separator for legacy string config values. Defaults to comma when omitted. Array config values ignore this field. nullable: true type: string templateVariable: description: Endpoint placeholder name (e.g. team_id). type: string required: - configField - templateVariable type: object ConnectorEdge: description: >- A directed edge in the tap DAG from a parent tap to a child tap. Defines how records from the parent are used to construct requests for the child. properties: from: description: Parent tap name (source of the edge) maxLength: 80 minLength: 1 pattern: ^[a-z][a-z0-9_]*$ type: string parentContextFields: description: >- Mappings to inject parent record values into child records. Each entry maps a target field (set on child) to a source field (read from parent). Enables multi-field context propagation through tap hierarchies. items: $ref: '#/components/schemas/ParentContextFieldMapping' nullable: true type: array parentEligibility: description: >- Optional eligibility predicates evaluated against each parent record before any child request is planned. All predicates must hold for the parent to be fanned out. `any_of` keeps allowlist semantics (a missing value matches nothing); the comparison operators fail open on a missing field or a value of the wrong type, so an incomplete payload never silently drops data. items: $ref: '#/components/schemas/ParentEligibilityPredicate' nullable: true type: array parentKeyField: description: >- Field from the parent record used to construct the child tap's request. Examples: 'full_name' (GitHub repos → issues), 'id' (Slack channels → messages) type: string parentsPerRequest: description: >- Parent records served by one child request. Null or 1 sends one request per parent. Above 1, each request carries up to this many parents: a parent placeholder written as a whole list element in the request body, query params, or GraphQL variables (e.g. "userIds": ["{id}"]) expands to every parent value in the group. Use it for Provider endpoints that accept an id list and compute over every id they receive (Gong /v2/stats/activity/*), where one request per parent, or one unscoped request, is too slow. Rows cannot be attributed to a single parent, so a grouped edge takes no parentContextFields. format: int64 maximum: 9007199254740991 minimum: 1 nullable: true type: integer templateVariable: description: >- Template variable name in the child tap's endpoint. If omitted, defaults to parentKeyField. Example: endpoint '/repos/{full_name}/issues' uses templateVariable 'full_name' nullable: true type: string to: description: Child tap name (target of the edge) maxLength: 80 minLength: 1 pattern: ^[a-z][a-z0-9_]*$ type: string required: - from - to - parentKeyField type: object ParentEligibilityOperatorEnum: description: >- Comparison a ParentEligibilityPredicate applies to a parent record field. A predicate must only encode deterministic expected absence; see the predicate schema for that rule. enum: - any_of - none_of - exists - not_exists - gt - gte - lt - lte - length_gt - length_gte type: string ProviderExtract: description: >- A value an operation reads from its response once a success rule matches. A workflow writeback can store it in the connection's ingestion config. A secret value never enters a URL, a log, a result detail, or a writeback. properties: name: description: >- Unique within its operation; a writeback names it with the operation id. type: string secret: description: >- Whether the value is secret. Absent means secret: only an extract that declares `secret: false` may be written back. nullable: true type: boolean source: $ref: '#/components/schemas/ProviderValueRef' description: >- The response value: `status`, `headers.`, or `body.`. type: $ref: '#/components/schemas/ProviderExtractTypeEnum' description: >- The JSON type the value must have; a value of another type, a value the bounded read cannot reach, or a value over 2048 bytes is not extracted. required: - name - source - type type: object ProviderInvocation: description: >- Runs an operation once per member of a list, a bounded number of times. Each member is one request, counted against the workflow's request budget; the request reads the member as `${item.}`. properties: aggregation: description: >- How member outcomes combine into the operation's outcome. Defaults to all_success. oneOf: - $ref: '#/components/schemas/ProviderAggregationEnum' - enum: - null nullable: true type: string forEach: $ref: '#/components/schemas/ProviderValueRef' description: >- The list to iterate: an `ingestion` field declared as a list of strings or numbers. itemName: description: The name the request uses for the current member. type: string maxItems: description: >- Most members to run, from the start of the list. Required: an iteration without a bound is refused. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 nullable: true type: integer required: - forEach - itemName type: object ProviderOutcomeRule: description: >- An outcome that applies when every predicate holds. Rules are tried in order and the first match wins; a predicate the response cannot decide (a body read only in part) never holds. properties: all: description: Conditions that must all hold. items: $ref: '#/components/schemas/ProviderPredicate' type: array outcome: $ref: '#/components/schemas/ProviderOutcomeEnum' description: What a match means. reason: description: Why, in words a reader of the result can act on. nullable: true type: string required: - all - outcome type: object ProviderRequestTemplate: description: The request an operation sends. properties: allowedConfiguredHost: description: >- An ingestion field declared as a Network.Url, not secret, whose host the request may also go to, exactly: a self-hosted provider the connection is configured to reach. The suffixes above still apply to every other host, and the host must still be public. A Workspace editor can change the field, so the request then carries the credential to any public host the editor saves. nullable: true type: string allowedHostSuffixes: description: >- DNS suffixes the resolved endpoint host may use. Matching is on a label boundary, so `api.example.com` matches `example.com` and `notexample.com` does not. items: description: Valid domain name (RFC 1035 compliant) maxLength: 255 pattern: >- ^[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?)*$ type: string type: array auth: $ref: '#/components/schemas/ProviderRequestAuth' description: How the request is authenticated. defaults: additionalProperties: type: string description: >- Literal values for referenced configuration fields that are absent or empty, keyed `ingestion.` or `credential.`: the value the provider or sync assumes when the field is left blank and no schema default supplies it (Tableau's `apiVersion` 3.29, its Default site `""`). An ingestion field's schema default applies before these. Each key names a declared, non-secret field the request references. A default is catalog text, not configuration, yet it takes its field's taint and placement rules. Only a declared default may be empty, and never in the endpoint. A default for a field that supplies the base URL must be an absolute https URL without a query or fragment, under allowedHostSuffixes. nullable: true type: object endpoint: description: >- One of: an absolute https URL with references in its path and query; one reference to an ingestion field declared as a Network.Url (the whole URL comes from configuration); that reference followed by a path or query (`${ingestion.baseUrl}/api/3.29/auth/signin`); or an https URL whose host starts with one non-secret ingestion field used as a DNS label (`https://${ingestion.tenantName}.workday.com/...`), when the literal rest of the host lies under an allowed suffix. Every form is checked against the allowed destinations once resolved, before anything is sent. type: string fallbackEndpoint: description: >- The endpoint used when the configured URL `endpoint` starts with is absent or empty: the provider's fixed host, for a connection that overrides it only when set (Workday's optional `baseUrl` in place of `https://${ingestion.tenantName}.workday.com`). Only an endpoint that starts with a `${ingestion.}` reference with no default may declare one. It is an absolute https URL, or the host-label form, never a configured URL itself, and its host must lie under allowedHostSuffixes: allowedConfiguredHost does not admit it, because the configured field is empty whenever it is used. nullable: true type: string headers: additionalProperties: type: string description: >- Request headers by name. A value may hold `${ingestion.}` references, and `${credential.}` references only in a header whose name says it carries a credential (Authorization, Cookie, or a name containing token, key, auth, secret, session, password, signature or credential). A header the transport or the strategy's auth sets is refused. nullable: true type: object method: $ref: '#/components/schemas/HttpMethodEnum' description: >- HTTP method: GET, or POST for providers whose check is a call (Slack's auth.test, a GraphQL query). queryParams: additionalProperties: type: string description: >- Query parameters added to the endpoint's query, by name. A value may hold `${ingestion.}` references, never a credential. nullable: true type: object replaySafe: description: >- Whether the request may be sent again when a rule answers retry. A GET always may; a POST only when declared safe (a read-only query), so a single-use exchange is never replayed. nullable: true type: boolean requestBody: description: >- A JSON body for a POST, sent as application/json unless the strategy's extraHeaders set another content type. A string value may hold `${ingestion.}` references. A `${credential.}` reference is allowed only when auth mode is `body` (a sign-in) and must be a whole string value. nullable: true required: - method - endpoint - allowedHostSuffixes - auth type: object ProviderSigningAlgorithmEnum: description: How a check signs a token it mints. enum: - HS256 type: string ProviderBudgetDefinition: properties: apiFamily: minLength: 1 type: string id: minLength: 1 type: string kind: $ref: '#/components/schemas/ProviderBudgetKindEnum' limit: description: >- Starting allowance for adaptive budgets; a ceiling for fixed budgets. format: int64 maximum: 9007199254740991 minimum: 1 type: integer observation: description: >- With observation, limit/windowSeconds bounds pace, not provider entitlement. oneOf: - $ref: '#/components/schemas/ProviderBudgetWindowObservation' - enum: - null nullable: true type: object scope: items: $ref: '#/components/schemas/ProviderBudgetScopeEnum' minItems: 1 type: array windowSeconds: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: 1 nullable: true type: integer required: - id - apiFamily - kind - scope - limit type: object ProviderBudgetFeedbackRule: additionalProperties: false properties: bodyReason: description: >- Case-sensitive substring of a top-level error field in a JSON body: a string `error`, a string `message`, an `error` object's `message`, `status`, or any `errors[].reason`, or a `message` object's `error`. Record content never matches. Null matches on status and headers alone. minLength: 1 nullable: true type: string budgetId: description: >- Null means the response does not identify which claim was refused; it then throttles only the request's narrowest claimed budgets, the same as a 429 that no rule matches. So does a rule naming a budget the request does not claim, without that budget's delay. minLength: 1 nullable: true type: string fallbackCooldownSeconds: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: 1 nullable: true type: integer headerMatches: description: All must match. A missing header never matches. items: $ref: '#/components/schemas/ProviderBudgetHeaderCondition' minItems: 1 nullable: true type: array resetHeader: maxLength: 255 nullable: true pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string resetHeaderCondition: description: >- Only the reset-header delay depends on this condition; Retry-After still wins. oneOf: - $ref: '#/components/schemas/ProviderBudgetHeaderCondition' - enum: - null nullable: true type: object statusCode: description: HTTP response status code, 100 through 599 format: int64 maximum: 599 minimum: 100 type: integer required: - statusCode type: object ProviderBudgetOperation: properties: claims: description: >- The request's shape comes from the transport option that names this operation (providerBudgetOperation) or from the credential exchange whose policy declares it. items: $ref: '#/components/schemas/ProviderBudgetClaimSpec' minItems: 1 type: array id: minLength: 1 type: string required: - id - claims type: object ProviderQuotaOwnerSelector: properties: credentialPaths: description: >- Required for Google project owners and absent for flow credential owners. Dot-separated aliases must resolve to the same value. items: type: string minItems: 1 nullable: true type: array kind: $ref: '#/components/schemas/ProviderQuotaOwnerKindEnum' required: - kind type: object TapAccessRoleEnum: description: >- Which access facts a tap carries. The access job discovers its inputs from these roles, the way the identity job discovers directory taps. enum: - principals - memberships - grants - resources type: string QualityRuleConfig: description: Discriminated union of all quality rule variants. discriminator: mapping: dupe_rate: '#/components/schemas/DupeRateRule' no_future_timestamp: '#/components/schemas/NoFutureTimestampRule' null_rate: '#/components/schemas/NullRateRule' referential_integrity: '#/components/schemas/ReferentialIntegrityRule' row_count_not_suspicious: '#/components/schemas/RowCountNotSuspiciousRule' string_pattern_rate: '#/components/schemas/StringPatternRateRule' temporal_order: '#/components/schemas/TemporalOrderRule' timeline_gaps: '#/components/schemas/TimelineGapsRule' timestamp_coverage: '#/components/schemas/TimestampCoverageRule' propertyName: type oneOf: - $ref: '#/components/schemas/NullRateRule' - $ref: '#/components/schemas/DupeRateRule' - $ref: '#/components/schemas/TimestampCoverageRule' - $ref: '#/components/schemas/TemporalOrderRule' - $ref: '#/components/schemas/NoFutureTimestampRule' - $ref: '#/components/schemas/TimelineGapsRule' - $ref: '#/components/schemas/StringPatternRateRule' - $ref: '#/components/schemas/ReferentialIntegrityRule' - $ref: '#/components/schemas/RowCountNotSuspiciousRule' TapSpcConfig: properties: minHistoryForViolation: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 1000 minimum: 2 type: integer trackedSeries: items: $ref: '#/components/schemas/SpcSeriesKind' maxItems: 16 minItems: 1 type: array windowSize: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 1000 minimum: 2 type: integer required: - windowSize - trackedSeries - minHistoryForViolation type: object ResponseFormatEnum: description: >- Wire format of a successful HTTP response body, controlling how the ingestion engine turns the body into records before responsePath extraction. enum: - json - jsonl type: string ResponseValidation: description: Validation rules for API response handling. properties: errorField: description: Field containing error code/message (e.g., 'error') type: string okField: description: Field indicating success in response body (e.g., 'ok') type: string transientErrors: description: >- Application-level errors that are transient and should be retried (e.g., 'ratelimited') items: type: string nullable: true type: array required: - okField - errorField type: object SyntheticPrimaryKeyConfig: description: >- ============================================================================= Synthetic Primary Key Types ============================================================================= Configuration for generating a synthetic primary key by hashing multiple fields. When present on a tap, the engine concatenates the specified fields, hashes them, and injects the result into the record. A nested field is a dotted path of bare or double-quoted identifiers (id.time, properties."$insert_id"); the definition gate rejects any other JMESPath, because promote recomputes the key for rows that landed before the tap declared it and reads only that subset. Uses outputField when set; otherwise falls back to primaryKey as the output field name. A single '*' entry in fields hashes every top-level record key (sorted canonical JSON, excluding the output field) for rows whose columns are not known ahead of time. properties: algorithm: description: 'Hash algorithm (default: sha1)' oneOf: - $ref: '#/components/schemas/SyntheticKeyAlgorithm' - enum: - null nullable: true type: string fields: description: Record fields to concatenate for hash input items: type: string type: array fieldsConfigKey: description: >- Authoring directive: the ingestion-config property whose non-empty string-array value replaces `fields` for that Workspace (e.g. a Workday RaaS report's key columns). The execution-plan compiler resolves it once and freezes only the final field list; the definition's `fields` stay the default when the property is absent or empty. nullable: true type: string outputField: description: 'Top-level record field for the hash (default: tap primaryKey)' nullable: true type: string separator: description: 'Separator between field values (default: ''|'')' nullable: true type: string required: - fields type: object AsyncQueryConfig: description: |- Configuration for asynchronous create-poll-fetch query execution. Used by APIs that require submitting a query, polling for completion, and then fetching results from a separate endpoint. properties: columnNamesPath: description: >- JMESPath to the column-name array on the status or result response. Falls back to the default manifest paths when unset. nullable: true type: string completionStatusCode: description: >- HTTP status code that signals completion while polling. When set, completion is decided by the HTTP status instead of statusPath/successValue. format: int64 maximum: 299 minimum: 200 nullable: true type: integer externalLinksPath: description: >- JMESPath to an array of presigned result links on a chunk payload (Databricks EXTERNAL_LINKS disposition). When set, chunk fetch downloads result bytes from those URLs instead of reading rows out of the chunk response. Presigned URLs carry their own credentials, so the download is issued without the connector's Authorization header. nullable: true type: string failureValue: description: Status value indicating the query failed (optional) nullable: true type: string failureValues: description: |- Additional terminal failure status values (optional). Merged with failureValue when present so vendors with several terminal failure states (e.g. Databricks FAILED/CANCELED/CLOSED) do not stall until maxPollSeconds. items: type: string nullable: true type: array maxPollSeconds: description: >- Seconds to poll before the query is treated as timed out. 0 times out on the first poll. format: int64 maximum: 9007199254740991 minimum: 0 type: integer partitionCountPath: description: >- JMESPath to the partition array on the status response whose length is the partition count. nullable: true type: string partitionParam: description: |- Query-parameter name carrying the partition index. Selects the partition-index fetch model instead of the chunk-index model. nullable: true type: string pollIntervalSeconds: description: Seconds between status poll requests. 0 polls with no delay. format: int64 maximum: 9007199254740991 minimum: 0 type: integer queryIdPath: description: JMESPath to extract the query ID from the create-query response type: string recordsEndpoint: description: Endpoint template for fetching results (use {queryId} placeholder) type: string recordsPagination: description: Pagination config for the results endpoint oneOf: - $ref: '#/components/schemas/PaginationConfig' - enum: - null nullable: true type: object recordsQueryParams: description: Query parameters for the results endpoint nullable: true recordsResponsePath: description: JMESPath to extract records from the results response type: string statusEndpoint: description: Endpoint template for polling status (use {queryId} placeholder) type: string statusPath: description: JMESPath to extract status string from the poll response type: string successValue: description: Status value indicating the query completed successfully type: string required: - queryIdPath - statusEndpoint - statusPath - successValue - pollIntervalSeconds - maxPollSeconds - recordsEndpoint - recordsResponsePath type: object IncrementalTimeFormatEnum: description: Format for incremental sync time parameters. enum: - iso8601 - iso8601_z - iso8601_seconds_z - unix - unix_millis - unix_micros - unix_nanos - date_slash - date type: string IncrementalParamsConfig: description: Configuration for incremental sync time-based filtering. properties: bodyFilterEndPath: description: |- Optional second POST-body path for the window end bound (e.g. monday activity_logs variables.to alongside variables.from). nullable: true type: string bodyFilterFormat: description: Format for body filter timestamp value oneOf: - $ref: '#/components/schemas/IncrementalTimeFormatEnum' - enum: - null nullable: true type: string bodyFilterPath: description: Dot-notation path in POST body for time filter injection nullable: true type: string bodyFilterTemplate: description: >- Template for body filter with {window_start} and {window_end} placeholders nullable: true type: string filterType: description: Type of incremental filtering to apply oneOf: - $ref: '#/components/schemas/IncrementalFilterTypeEnum' - enum: - null nullable: true type: string maxWindowDays: description: >- Maximum number of days per sync window. APIs with date range limits (e.g., Microsoft Graph 30 days, Zoom 30 days) are automatically split into sub-windows. format: int64 maximum: 9007199254740991 minimum: 0 nullable: true type: integer queryParam: description: Query parameter for template-based filters (e.g., 'q' for Gmail) nullable: true type: string queryTemplate: description: Template with {window_start} and {window_end} placeholders nullable: true type: string sinceFormat: description: Format for the since parameter value oneOf: - $ref: '#/components/schemas/IncrementalTimeFormatEnum' - enum: - null nullable: true type: string sinceParam: description: Query parameter name for start time filter (e.g., 'since', 'oldest') nullable: true type: string untilFormat: description: Format for the until parameter value oneOf: - $ref: '#/components/schemas/IncrementalTimeFormatEnum' - enum: - null nullable: true type: string untilParam: description: Query parameter name for end time filter (e.g., 'until', 'latest') nullable: true type: string type: object SyncModeEnum: description: Sync strategy for a tap. enum: - full - incremental type: string ApiTypeEnum: description: |- API transport protocol. Determines how requests are constructed and executed. enum: - rest - graphql - database - file - custom type: string GraphQLEndpointConfig: additionalProperties: false description: |- GraphQL API endpoint configuration. For connectors that use GraphQL APIs (e.g., Linear). Strict for the same reason as RestEndpointConfig: every key shapes the Provider request. `variables` stays free-form. properties: endpoint: description: GraphQL endpoint path type: string operationName: description: GraphQL operation name nullable: true type: string query: description: GraphQL query or mutation string type: string variables: description: Static variables to include in every request nullable: true required: - endpoint - query type: object PaginationConfig: description: >- ============================================================================= Pagination ============================================================================= Pagination configuration for a tap endpoint. properties: cursor: description: Cursor pagination settings (when type = CURSOR) oneOf: - $ref: '#/components/schemas/CursorPaginationConfig' - enum: - null nullable: true type: object offset: description: Offset pagination settings (when type = OFFSET) oneOf: - $ref: '#/components/schemas/OffsetPaginationConfig' - enum: - null nullable: true type: object pageNumber: description: Page number pagination settings (when type = PAGE_NUMBER) oneOf: - $ref: '#/components/schemas/PageNumberPaginationConfig' - enum: - null nullable: true type: object sessionPage: description: Session + page pagination settings (when type = SESSION_PAGE) oneOf: - $ref: '#/components/schemas/SessionPagePaginationConfig' - enum: - null nullable: true type: object type: $ref: '#/components/schemas/PaginationTypeEnum' description: Pagination strategy type required: - type type: object RestEndpointConfig: additionalProperties: false description: >- Connector Tap Definition A tap represents a single data stream (e.g., repos, issues, users). Each tap defines how to extract one entity type from an API. Taps are API-type-aware: REST taps use RestEndpointConfig, GraphQL taps use GraphQLEndpointConfig. ============================================================================= Endpoint Configurations ============================================================================= REST API endpoint configuration. Supports template variables resolved from workspace config or parent tap records. Examples: '/orgs/{orgId}/repos', '/repos/{full_name}/issues' Strict: every key shapes the Provider request, so a reader that does not know a key must reject it rather than send a broader request. The nested object types are marked too. properties: batch: description: >- Optional batch packer config for Google-style multipart/mixed batch APIs. When set, the runtime packs one sub-request per parent record (built from this RestEndpointConfig's endpoint/method/headers) into a single multipart/mixed POST to `batch.endpoint`. When the tap declares `perParentAuth`, each sub-request gets its own `Authorization` header so it impersonates the parent user (Google domain-wide delegation). When `perParentAuth` is omitted, the outer POST's auth applies to every sub-request -- used for admin-token detail taps such as Drive Docs/Sheets. When unset, the runtime executes one HTTP request per parent record. oneOf: - $ref: '#/components/schemas/RestBatchConfig' - enum: - null nullable: true type: object bodyEncoding: description: >- Serialization for the POST/PUT/PATCH body. Defaults to JSON when null. Set to FORM (application/x-www-form-urlencoded) for APIs that reject a JSON body, e.g. Mixpanel's Engage query API. oneOf: - $ref: '#/components/schemas/BodyEncodingEnum' - enum: - null nullable: true type: string endpoint: description: |- API endpoint path (supports {variable} templates). Variables are resolved from parent tap records or workspace config. type: string headers: description: Additional headers to include nullable: true method: $ref: '#/components/schemas/HttpMethodEnum' description: 'HTTP method (default: GET)' parentDataFilterBodyInject: description: >- Optional inject of workspace parentDataFilters values into requestBody. Used by root taps that take an allowlist array (e.g. Purview userPrincipalNameFilters) without depending on a parent tap. oneOf: - $ref: '#/components/schemas/ParentDataFilterBodyInject' - enum: - null nullable: true type: object parentDataFilterQueryInject: description: >- Optional inject of workspace parentDataFilters values into a query param (typically $filter). Used by root taps that take an allowlist in the query string without depending on a parent tap. oneOf: - $ref: '#/components/schemas/ParentDataFilterQueryInject' - enum: - null nullable: true type: object pathParamEncodings: description: >- Optional provider-neutral encoding rules for path template parameters. items: $ref: '#/components/schemas/PathParamEncodingRule' nullable: true type: array queryParams: description: Default query parameters to include nullable: true requestBody: description: Request body template (for POST endpoints, e.g., Notion search) nullable: true required: - endpoint - method type: object ProviderValueRef: description: >- A declarative provider operation: one bounded request and the ordered rules that read its response. Request strings carry references in the `${namespace.path}` form, for example `${ingestion.customReportUrl}`. A value a predicate or an extract reads, or the list an iteration runs over. properties: namespace: $ref: '#/components/schemas/ProviderValueNamespaceEnum' description: The source of the value. path: description: |- Where in the namespace. For `response`: `status`, `text`, `headers.`, `body`, or `body.`. type: string required: - namespace - path type: object ProviderExtractTypeEnum: description: >- The JSON type an extract requires of the value it reads. A value of another type is not extracted. enum: - string - number - boolean type: string ProviderAggregationEnum: description: How the members of an iterated operation combine into its outcome. enum: - all_success - any_success type: string ProviderPredicate: description: One condition on a value. properties: expected: description: >- The operand: a scalar for equals, not_equals and contains, a [low, high] pair for between, a list for any_of, and null for exists, not_exists, empty and non_empty. nullable: true operator: $ref: '#/components/schemas/ProviderPredicateOperatorEnum' description: How the value is compared. source: $ref: '#/components/schemas/ProviderValueRef' description: The value the condition reads. required: - source - operator type: object ProviderOutcomeEnum: description: >- Vocabulary of a declarative provider operation: one bounded request to a provider and the ordered rules that turn its response into an outcome. Credential validation is the first consumer; each consumer maps an outcome to its own verdict. What a matched outcome rule says about the request. enum: - success - expected_empty - retry - auth_rejected - permission_denied - config_invalid - upstream_failure type: string ProviderRequestAuth: description: How the request is authenticated. properties: mode: $ref: '#/components/schemas/ProviderRequestAuthModeEnum' password: description: 'Auth mode `basic` only: the credential field holding the password.' nullable: true type: string username: description: 'Auth mode `basic` only: the credential field holding the user name.' nullable: true type: string required: - mode type: object HttpMethodEnum: description: HTTP method for API calls. enum: - GET - POST - PUT - PATCH - DELETE type: string ProviderBudgetKindEnum: enum: - token_bucket - paced_window - adaptive_paced_window - adaptive_concurrent - concurrent type: string ProviderBudgetWindowObservation: properties: fallbackLimit: description: >- Native units per budget window while the provider allowance is unknown. format: int64 maximum: 9007199254740991 minimum: 1 type: integer limitHeader: maxLength: 255 pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string remainingHeader: maxLength: 255 pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string resetEpochSecondsHeader: maxLength: 255 pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string resourceHeader: description: >- resourceHeader and resourceValue are declared together or not at all. maxLength: 255 nullable: true pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string resourceValue: nullable: true pattern: ^\S(.*\S)?$ type: string required: - remainingHeader - limitHeader - resetEpochSecondsHeader - fallbackLimit type: object ProviderBudgetScopeEnum: enum: - quota_owner - delegated_subject type: string ProviderBudgetHeaderCondition: additionalProperties: false properties: equals: pattern: ^\S(.*\S)?$ type: string header: maxLength: 255 pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$ type: string required: - header - equals type: object ProviderBudgetClaimSpec: properties: budgetId: minLength: 1 type: string charge: $ref: '#/components/schemas/ProviderBudgetChargeEnum' cost: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: 1 type: integer required: - budgetId - cost - charge type: object ProviderQuotaOwnerKindEnum: enum: - google_cloud_project - flow_credential type: string DupeRateRule: properties: maxRate: format: double type: number type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxRate type: object NoFutureTimestampRule: properties: maxViolations: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxViolations type: object NullRateRule: properties: maxRate: format: double type: number type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxRate type: object ReferentialIntegrityRule: description: 'Quality rule: foreign key must exist in referenced dataset.' properties: localColumn: type: string maxOrphanRate: format: double type: number referencedColumn: type: string referencedDatasetId: type: string type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - localColumn - referencedDatasetId - referencedColumn - maxOrphanRate type: object RowCountNotSuspiciousRule: properties: suspiciousCounts: items: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer type: array type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - suspiciousCounts type: object StringPatternRateRule: properties: column: type: string maxRate: format: double type: number pattern: type: string type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - column - pattern - maxRate type: object TemporalOrderRule: properties: maxViolations: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxViolations type: object TimelineGapsRule: properties: maxGapDays: description: >- Signed integer count of days: an amount of elapsed time, never a point in time or a calendar date. format: int64 maximum: 9007199254740991 minimum: 0 type: integer type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxGapDays type: object TimestampCoverageRule: properties: minRate: format: double type: number type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - minRate type: object SpcSeriesKind: description: |- Tracked SPC series kind. TapSpcConfig.trackedSeries also uses it to say which series Parable monitors. enum: - TABLE_ROW_COUNT - COLUMN_NULL_PCT - COLUMN_VALIDATION_FAILURE_PCT - COLUMN_DISTINCT_COUNT - COLUMN_AVG type: string SyntheticKeyAlgorithm: description: Hash algorithm for generating synthetic primary keys. enum: - sha1 - sha256 type: string IncrementalFilterTypeEnum: description: Type of incremental filtering to apply. enum: - simple - query_template - body_filter type: string CursorPaginationConfig: description: Configuration for cursor-based pagination. properties: cursorBodyPath: description: >- Dot-notation path inside the POST request body where the cursor must be injected for the next page (e.g., 'cursor', 'variables.after'). When set, the cursor is written into the body instead of the query string. Required for APIs that paginate POST endpoints with a body cursor (e.g., Gong /v2/calls/extensive). nullable: true type: string cursorIsFullUrl: description: >- When true, the cursor value is an absolute URL (e.g., OData @odata.nextLink) nullable: true type: boolean cursorParam: description: 'Query parameter name for cursor (default: ''cursor'')' nullable: true type: string cursorPath: description: JMESPath to extract next cursor from response type: string hasMorePath: description: JMESPath to check if more pages exist nullable: true type: string nextCursorPath: description: JMESPath to extract the next cursor from the nextQuery response. nullable: true type: string nextDataPath: description: JMESPath to extract records from the nextQuery response. nullable: true type: string nextEndpoint: description: Endpoint for continuation requests, which send only the cursor body. nullable: true type: string nextQuery: description: >- GraphQL query used to fetch subsequent pages when the API requires a different query to continue a cursor. Example: monday.com fetches the first page via boards { items_page }, then continues with next_items_page(cursor). nullable: true type: string required: - cursorPath type: object OffsetPaginationConfig: description: Configuration for offset-based pagination. properties: defaultLimit: description: Default page size format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer initialOffset: description: 'First offset sent to the Provider (default: 0)' format: int64 maximum: 9007199254740991 minimum: -9007199254740991 nullable: true type: integer limitParam: description: 'Query parameter name for limit (default: ''limit'')' nullable: true type: string maxLimit: description: Maximum page size allowed by API format: int64 maximum: 9007199254740991 minimum: -9007199254740991 nullable: true type: integer nextPageLinkPath: description: >- When set, offset pagination mirrors TestRail-style responses: continue only while this path is non-null (e.g. `_links.next`), and advance offset by `defaultLimit` per page instead of the returned record count. nullable: true type: string offsetParam: description: 'Query parameter name for offset (default: ''offset'')' nullable: true type: string totalPath: description: JMESPath to extract total count nullable: true type: string required: - defaultLimit type: object PageNumberPaginationConfig: description: Configuration for page number pagination. properties: defaultPageSize: description: Default page size format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer pageParam: description: 'Query parameter name for page (default: ''page'')' nullable: true type: string pageSizeParam: description: 'Query parameter name for page size (default: ''per_page'')' nullable: true type: string paramLocation: description: Where page/pageSize travel for POST endpoints (body or query). nullable: true type: string totalPagesPath: description: JMESPath to extract total pages nullable: true type: string totalPath: description: >- JMESPath to the total record count. Paging stops once the pages read cover it, so a Provider that rejects a page past the end is not asked for one. nullable: true type: string zeroBased: description: |- Whether pages are numbered from 0 instead of 1 (default: false). Datadog numbers page[number] from 0. A boolean, because drops an integer 0 (schema: optional integers are value types). nullable: true type: boolean required: - defaultPageSize type: object SessionPagePaginationConfig: description: Configuration for Mixpanel-style session_id + page pagination. properties: defaultPageSize: description: Default page size used to detect the last page format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer pageParam: description: 'Query/body parameter name for page (default: ''page'')' nullable: true type: string pagePath: description: JMESPath to extract the current page from the response nullable: true type: string sessionIdParam: description: 'Query/body parameter name for session id (default: ''session_id'')' nullable: true type: string sessionIdPath: description: JMESPath to extract session id from the response nullable: true type: string required: - defaultPageSize type: object PaginationTypeEnum: description: Pagination strategy for API endpoints. enum: - link_header - cursor - offset - page_number - session_page - none type: string RestBatchConfig: additionalProperties: false description: >- Batch packer configuration for Google-style multipart/mixed batch endpoints (e.g., Gmail https://gmail.googleapis.com/batch/gmail/v1, Drive https://www.googleapis.com/batch/drive/v3). Used to bundle high-cardinality detail fetches (one sub-request per parent record) into a single HTTP round trip. Requires the tap's pagination type to be `none` (one sub-response per parent). `perParentAuth` is optional: when present each sub-request is authed per parent (DWD), when absent the outer POST's auth applies to all sub-requests. properties: endpoint: description: |- Multipart batch endpoint URL. Always invoked with POST and `Content-Type: multipart/mixed; boundary=...`. type: string format: description: >- Batch wire format. Null or absent = Google-style multipart/mixed (default). "json" = JSON batch (e.g., Microsoft Graph $batch, OData $batch). nullable: true type: string maxSubRequests: description: |- Maximum sub-requests packed into a single multipart body. Google recommends <= 100 sub-requests per batch. Typical value: 50. format: int64 maximum: 100 minimum: 1 type: integer required: - endpoint - maxSubRequests type: object ParentDataFilterBodyInject: additionalProperties: false description: |- When set on RestEndpointConfig, the tap (typically a root tap) injects ingestionConfig.parentDataFilters[filterKey].values into requestBody at bodyPath. No parent-tap fan-out or frontier is required. properties: bodyPath: description: >- Top-level requestBody key that receives the values array. Example: 'userPrincipalNameFilters' for Microsoft Purview audit queries. type: string field: description: >- Expected parentDataFilters[filterKey].field. Values are injected as-is when the field matches; field mismatch or empty values skip the tap (fail closed). When the filter key is absent, the body key is omitted (workspace-wide). type: string filterKey: description: Key under ingestionConfig.parentDataFilters (e.g. 'users'). type: string required: - filterKey - bodyPath - field type: object ParentDataFilterQueryInject: additionalProperties: false description: >- When set on RestEndpointConfig, the tap injects ingestionConfig.parentDataFilters[filterKey].values into a query parameter. Two modes: 1) OData expression (Microsoft): set clauseTemplate + join/combine operators to build a $filter string. 2) Repeated list values (Claude Compliance actor_ids[]): omit clauseTemplate; values are passed as a list on queryParam (doseq-encoded). properties: chunkSize: description: >- Max values per request. Null uses the runtime default (10 for OData mode, 50 for repeated-list mode). Both defaults keep the encoded query string under the common 8KB request-line cap. format: double maximum: 500 minimum: 1 nullable: true type: number clauseTemplate: description: >- Per-value clause with '{value}' placeholder for OData expression mode. Example: "userPrincipalName eq '{value}'". Null selects repeated-list mode (values set as a list on queryParam). nullable: true pattern: \{value\} type: string combineOperator: description: |- How to combine the joined clauses with an existing queryParam value (OData mode only). When the query param is absent, only the joined clauses are used. oneOf: - $ref: '#/components/schemas/ParentDataFilterCombineOperatorEnum' - enum: - null nullable: true type: string field: description: >- Expected parentDataFilters[filterKey].field. Values are injected when the field matches; field mismatch or empty values skip the tap (fail closed). When the filter key is absent, no inject runs (workspace-wide). type: string filterKey: description: Key under ingestionConfig.parentDataFilters (e.g. 'users'). type: string joinOperator: description: How to join multiple value clauses (OData mode only). oneOf: - $ref: '#/components/schemas/ParentDataFilterJoinOperatorEnum' - enum: - null nullable: true type: string normalize: description: Optional value normalization before render / inject. oneOf: - $ref: '#/components/schemas/ParentDataFilterNormalizeEnum' - enum: - null nullable: true type: string queryParam: description: |- Query parameter name that receives the filter. Examples: '$filter' (OData), 'actor_ids[]' (repeated list). type: string required: - filterKey - field - queryParam type: object PathParamEncodingRule: additionalProperties: false description: One transformation applied to a named endpoint-template parameter. properties: encoding: $ref: '#/components/schemas/PathParamEncodingEnum' parameter: type: string required: - parameter - encoding type: object ProviderValueNamespaceEnum: description: Where a reference reads its value from. enum: - credential - ingestion - clock - item - step - response - signed type: string ProviderPredicateOperatorEnum: description: How a predicate compares the value it reads. enum: - equals - not_equals - between - any_of - exists - not_exists - empty - non_empty - contains type: string ProviderRequestAuthModeEnum: description: How a provider operation request is authenticated. enum: - none - strategy - body - basic type: string ProviderBudgetChargeEnum: enum: - outer_request - batch_member type: string QualityRuleTypeEnum: description: |- Discriminator literal for the QualityRuleConfig union variants. The wire/storage value is the snake_case form. enum: - null_rate - dupe_rate - timestamp_coverage - temporal_order - no_future_timestamp - timeline_gaps - string_pattern_rate - referential_integrity - row_count_not_suspicious type: string ParentDataFilterCombineOperatorEnum: description: |- How parentDataFilterQueryInject combines joined clauses with an existing query param value (typically a time-window $filter). enum: - and - or type: string ParentDataFilterJoinOperatorEnum: description: How parentDataFilterQueryInject joins multiple per-value clauses. enum: - or - and type: string ParentDataFilterNormalizeEnum: description: |- Optional value normalization before parentDataFilterQueryInject renders clauseTemplate. Unrecognized values must fail at schema validation time (not silently no-op at runtime). enum: - lowercase type: string PathParamEncodingEnum: description: >- Provider-neutral transformations for values inserted into endpoint paths. enum: - double_url_encode_slashes type: string headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.