Integrations

Create a cloud connection

Connects a provider with a pasted access token, a custom MCP server that you run, or a knowledge card. Set provider to custom and give the server url (https only, public address) to connect a custom MCP server. Set provider to supabase, cloudflare, or vercel and give the provider access token to connect a first-party provider. Set card to a knowledge card id to connect it as on the dashboard: a token card takes access_token, and cards that sign in at the vendor cannot be connected here. AWS and Google are connected in the dashboard, because each has its own verification flow. On a self-hosted deployment only custom is accepted. applies_to_domain_ids and applies_to_repository_ids only preselect the connection for new scans on those assets; which connections a run may use is fixed by the scan’s connection selection. The access token is encrypted at rest and is never returned. Personal tokens must belong to an organization admin (parity with the dashboard). Tokens narrowed to specific assets cannot create connections.

POST

integrations

cloud

Error

A valid request URL is required to generate request examples

{
  "connection": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "provider": "aws",
    "externalAccountId": "<string>",
    "accountLabel": "<string>",
    "config": {},
    "notes": "<string>",
    "appliesToDomainIds": [
      "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    ],
    "appliesToRepositoryIds": [
      "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    ],
    "connectedBy": "<string>",
    "connectedAt": "2023-11-07T05:31:56Z",
    "credentialSourceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "awaitingSignIn": true,
    "serverIdentity": {
      "title": "<string>",
      "websiteUrl": "<string>",
      "hasIcon": true,
      "iconVersion": "<string>"
    }
  }
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

Authorizations

Authorization

string

header

required

API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.

Body

application/json

card

string

Knowledge card id to connect, exactly as on the dashboard. A token card takes access_token. Cards that sign in at the vendor are rejected. When card is set, provider and label are unused — the card supplies both.

provider

enum<string>

Provider to connect. Use custom for an MCP server that you run. Self-hosted deployments accept custom only; the first-party providers rely on Strix-owned identities and return 400 there.

Available options:

custom,

supabase,

cloudflare,

vercel

label

string

Display name. For a custom server, a slug of this name becomes the tool prefix and must be unique in the organization.

access_token

string

Provider access token, or the bearer token that the custom MCP server expects. Sent without the Bearer prefix. Encrypted at rest and never returned.

url

string<uri>

MCP endpoint of a custom server. Required when provider is custom. Must use https and resolve to a public address.

kind

enum<string>

Section a custom server is listed under. Optional.

Available options:

infrastructure,

knowledge

project_ref

string

Supabase project reference (20 lowercase letters or digits). Optional, supabase only: when the token's projects can be listed, a reference outside that list is rejected; otherwise the reference is accepted without verification. It scopes the connection's runs to that project and becomes the connection's identity so one token can be connected once per project. Other providers return 400 when it is set, because nothing would enforce it.

notes

string | null

Guidance for the agent on when and how to use the connection.

applies_to_domain_ids

string<uuid>[]

Domain ids the connection is about. Sets which connections a new scan on the domain starts with selected; the scan's own connection selection decides what a run can reach. Empty means offered for every domain.

applies_to_repository_ids

string<uuid>[]

Repository ids the connection is about. Sets which connections a new scan on the repository starts with selected; the scan's own connection selection decides what a run can reach. Empty means offered for every repository.

Response

Cloud connection created.

connection

object

required

Show child attributes

Error

A valid request URL is required to generate request examples

{
  "connection": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "provider": "aws",
    "externalAccountId": "<string>",
    "accountLabel": "<string>",
    "config": {},
    "notes": "<string>",
    "appliesToDomainIds": [
      "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    ],
    "appliesToRepositoryIds": [
      "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    ],
    "connectedBy": "<string>",
    "connectedAt": "2023-11-07T05:31:56Z",
    "credentialSourceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "awaitingSignIn": true,
    "serverIdentity": {
      "title": "<string>",
      "websiteUrl": "<string>",
      "hasIcon": true,
      "iconVersion": "<string>"
    }
  }
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

{
  "detail": "<string>",
  "code": "<string>",
  "required_scope": "scans:read",
  "docs": "<string>",
  "hint": "<string>"
}

Analytics

Asset Discovery

Audit

Billing

Chat

CLI

Connectors

Containers

Assets

Test Users

Integrations

Knowledge

License

LLM

Run Logs

Organization

Invitations

Members

PR Reviews

Vulnerabilities

Supply Chain

Scans

Schedules

Search

Tokens

Uploads

Webhooks

Workspaces

Repositories

Create a cloud connection

Authorizations

Body

Response