> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a cloud connection > Connects a provider with a pasted access token, a custom MCP server that you run, or a knowledge card. Set `provider` to `custom` and give the server `url` (https only, public address) to connect a custom MCP server. Set `provider` to `supabase`, `cloudflare`, or `vercel` and give the provider access token to connect a first-party provider. Set `card` to a knowledge card id to connect it as on the dashboard: a token card takes `access_token`, and cards that sign in at the vendor cannot be connected here. AWS and Google are connected in the dashboard, because each has its own verification flow. On a self-hosted deployment only `custom` is accepted. `applies_to_domain_ids` and `applies_to_repository_ids` only preselect the connection for new scans on those assets; which connections a run may use is fixed by the scan's connection selection. The access token is encrypted at rest and is never returned. Personal tokens must belong to an organization admin (parity with the dashboard). Tokens narrowed to specific assets cannot create connections. ## OpenAPI ````yaml /openapi.json post /integrations/cloud openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /integrations/cloud: post: tags: - Integrations summary: Create a cloud connection description: >- Connects a provider with a pasted access token, a custom MCP server that you run, or a knowledge card. Set `provider` to `custom` and give the server `url` (https only, public address) to connect a custom MCP server. Set `provider` to `supabase`, `cloudflare`, or `vercel` and give the provider access token to connect a first-party provider. Set `card` to a knowledge card id to connect it as on the dashboard: a token card takes `access_token`, and cards that sign in at the vendor cannot be connected here. AWS and Google are connected in the dashboard, because each has its own verification flow. On a self-hosted deployment only `custom` is accepted. `applies_to_domain_ids` and `applies_to_repository_ids` only preselect the connection for new scans on those assets; which connections a run may use is fixed by the scan's connection selection. The access token is encrypted at rest and is never returned. Personal tokens must belong to an organization admin (parity with the dashboard). Tokens narrowed to specific assets cannot create connections. operationId: createCloudConnection requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateCloudConnectionRequest' responses: '201': description: Cloud connection created. content: application/json: schema: type: object properties: connection: $ref: '#/components/schemas/CloudConnection' required: - connection '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': $ref: '#/components/responses/Conflict' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - integrations:write components: schemas: CreateCloudConnectionRequest: type: object properties: card: type: string description: >- Knowledge card id to connect, exactly as on the dashboard. A token card takes `access_token`. Cards that sign in at the vendor are rejected. When `card` is set, `provider` and `label` are unused — the card supplies both. provider: type: string enum: - custom - supabase - cloudflare - vercel description: >- Provider to connect. Use `custom` for an MCP server that you run. Self-hosted deployments accept `custom` only; the first-party providers rely on Strix-owned identities and return 400 there. label: type: string description: >- Display name. For a custom server, a slug of this name becomes the tool prefix and must be unique in the organization. access_token: type: string description: >- Provider access token, or the bearer token that the custom MCP server expects. Sent without the `Bearer ` prefix. Encrypted at rest and never returned. url: type: string format: uri description: >- MCP endpoint of a custom server. Required when `provider` is `custom`. Must use https and resolve to a public address. kind: type: string enum: - infrastructure - knowledge description: Section a custom server is listed under. Optional. project_ref: type: string description: >- Supabase project reference (20 lowercase letters or digits). Optional, `supabase` only: when the token's projects can be listed, a reference outside that list is rejected; otherwise the reference is accepted without verification. It scopes the connection's runs to that project and becomes the connection's identity so one token can be connected once per project. Other providers return 400 when it is set, because nothing would enforce it. notes: type: - string - 'null' description: Guidance for the agent on when and how to use the connection. applies_to_domain_ids: type: array items: type: string format: uuid description: >- Domain ids the connection is about. Sets which connections a new scan on the domain starts with selected; the scan's own connection selection decides what a run can reach. Empty means offered for every domain. applies_to_repository_ids: type: array items: type: string format: uuid description: >- Repository ids the connection is about. Sets which connections a new scan on the repository starts with selected; the scan's own connection selection decides what a run can reach. Empty means offered for every repository. CloudConnection: type: object required: - id - provider - externalAccountId - accountLabel - config - notes - appliesToDomainIds - appliesToRepositoryIds - connectedBy - connectedAt - credentialSourceId - awaitingSignIn - serverIdentity properties: id: type: string format: uuid provider: type: string enum: - aws - vercel - supabase - cloudflare - google - custom - notion - linear - confluence - airtable - trello - posthog - neon - stripe - clickup - railway - jira - gitlab - github - sentry - amplitude - attio - incidentio - granola - glean - devin externalAccountId: type: - string - 'null' accountLabel: type: - string - 'null' config: type: - object - 'null' additionalProperties: true notes: type: - string - 'null' appliesToDomainIds: type: array items: type: string format: uuid appliesToRepositoryIds: type: array items: type: string format: uuid connectedBy: type: - string - 'null' connectedAt: type: string format: date-time credentialSourceId: type: - string - 'null' format: uuid awaitingSignIn: type: boolean description: >- True for a custom MCP server connection whose OAuth sign-in has not finished. Scans do not use the connection until an admin signs in. serverIdentity: type: - object - 'null' description: >- What a custom MCP server reported about itself after sign-in. Null for other providers and for servers that reported nothing. hasIcon is true when the server supplied an icon that the dashboard shows. required: - title - websiteUrl - hasIcon - iconVersion properties: title: type: - string - 'null' websiteUrl: type: - string - 'null' format: uri hasIcon: type: boolean iconVersion: type: - string - 'null' description: >- Changes when the server reports a different icon. Null when hasIcon is false. ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Conflict: description: Conflict. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.