Vault API

Update consent state Update the consent state of a connection

Get consent records Get all consent records for a connection

List connection custom mappings This endpoint returns a list of custom mappings for a connection.

Get resource settings This endpoint returns custom settings and their defaults required by connection for a given resource.

Update settings Update default values for a connection's resource settings

Create connection Create an authorized connection

Get all connections This endpoint includes all the configured integrations and contains the required assets to build an integrations page where your users can install integrations. OAuth2 supported integrations will contain authorize and revoke links to handle the authentication flows.

Authorize __In most cases the authorize link is provided in the ``/connections`` endpoint. Normally you don't need to manually generate these links.__ Use this endpoint to authenticate a user with a connector. It will return a 301 redirect to the downstream connector endpoints. Auth links will have a state parameter included to verify the validity of the request. This is the url your users will use to activate OAuth supported integration providers. Vault handles the complete Authorization Code Grant Type Flow for you and will redirect you to the dynamic redirect uri you have appended to the url in case this is missing the default redirect uri you have configured for your Unify application. ## CSRF protection with `nonce` (two-step confirmation) Optionally pass a `nonce` query parameter to enable CSRF-protected authorization. When a `nonce` is supplied and CSRF protection is enabled for your account, the OAuth flow changes from a single step to **two steps**: 1. Vault completes the OAuth exchange but stores the credentials as **unconfirmed** (`confirmed: false`). The connection is **not** callable yet. 2. The callback redirect URL is returned with a hash fragment containing the original `nonce`, a short-lived `confirm_token`, and the `service_id`: `#nonce=&confirm_token=&service_id=`. Your application **must** verify the returned `nonce` matches the value it sent, then call `POST /vault/connections/{unified_api}/{service_id}/confirm` with the `confirm_token` to confirm and activate the connection. Until the connection is confirmed it will not be callable. The `confirm_token` expires after 30 minutes. If no `nonce` is supplied (or CSRF protection is not enabled), the legacy single-step flow is used and the connection becomes callable immediately after the callback — no confirmation step is required.

Callback This endpoint gets called after the triggering the authorize flow. Callback links need a state and code parameter to verify the validity of the request. When an error occurs during the OAuth flow, providers will optionally include error parameters in the callback request instead of the code parameter. When the authorize request was initiated with a `nonce` and CSRF protection is enabled for your account, the connection is left **unconfirmed** and this endpoint redirects back to your `redirect_uri` with a hash fragment containing the original `nonce`, a short-lived `confirm_token`, and the `service_id`: `#nonce=&confirm_token=&service_id=`. Your application must verify the `nonce` matches the value it sent and then call `POST /vault/connections/{unified_api}/{service_id}/confirm` with the `confirm_token` to activate the connection. Without a `nonce` (or with CSRF protection disabled) the connection becomes callable immediately and no confirmation step is required.

Confirm Connection Confirms an OAuth connection after the callback by verifying the confirm token. This is the second step of the CSRF-protected OAuth flow. When you initiate authorization with a `nonce` (and CSRF protection is enabled for your account), the connection is created in an **unconfirmed**, non-callable state and the callback redirect returns a `confirm_token` in its hash fragment. Call this endpoint with that `confirm_token` to confirm the connection and make it callable. The `confirm_token` is single-use and expires 30 minutes after the callback. If you do not supply a `nonce` during authorization, the connection is confirmed automatically and you do not need to call this endpoint.

Deletes a connection

Get resource example This endpoint returns a downstream example of a given resource.

Import connection Import an authorized connection.

Migrate connection Migrate the connection to the target connector, keeping its credentials and connection state (settings, metadata, configuration, subscriptions, consents). The source connection record is removed WITHOUT revoking or disconnecting the downstream token. Available migration targets are declared per connector — refer to the connector's documentation page or the Connector API's `migration_targets` field. Migrated tokens carry the source connector's OAuth scopes, so operations exclusive to the target connector may require re-authorization. Retries are idempotent: a partially-completed migration resumes where it left off.

Get connection Get a connection

Revoke connection __In most cases the authorize link is provided in the ``/connections`` endpoint. Normally you don't need to manually generate these links.__ Use this endpoint to revoke an existing OAuth connector. Auth links will have a state parameter included to verify the validity of the request. This is the url your users will use to activate OAuth supported integration providers. Vault handles the complete revoke flow for you and will redirect you to the dynamic redirect uri you have appended to the url.

Get resource schema This endpoint returns an approximate JSONSchema of a given resource.

Authorize Access Token Triggers exchanging persisted connection credentials for an access token and store it in Vault. Currently supported for connections with the `client_credentials` or `password` OAuth grant type. Note: - Do not include any credentials in the request body. This operation does not persist changes, but only triggers the exchange of persisted connection credentials for an access token. - The access token will not be returned in the response. A 200 response code indicates the authorization was successful and that a valid access token was stored on the connection. - The access token will be used for subsequent API requests.

Update connection Update a connection

Consumer request counts Get consumer request counts within a given datetime range.

Create consumer Create a consumer

Get all consumers This endpoint includes all application consumers, along with an aggregated count of requests made.

Delete consumer and all their connections, including credentials.

Get consumer Consumer detail including their aggregated counts with the connections they have authorized.

Update consumer metadata such as name and email.

Create Callback State This endpoint creates a callback state that can be used to issue requests to the callback endpoint.

Get resource custom fields This endpoint returns an custom fields on a connection resource.

Create custom mapping Create a custom mapping

List custom mappings This endpoint returns a list of custom mappings.

Deletes a custom mapping

Get custom mapping Get a custom mapping

Update custom mapping Update a custom mapping

Get all consumer request logs This endpoint includes all consumer request logs.

Create Session Making a POST request to this endpoint will initiate a Hosted Vault session. Redirect the consumer to the returned URL to allow temporary access to manage their integrations and settings. Note: This is a short lived token that will expire after 1 hour (TTL: 3600).

Validate Connection State This endpoint validates the current state of a given connection. This will perform different checks based on the connection auth type. For basic and apiKey auth types, the presence of required fields is checked. For connectors that implement OAuth2, this operation forces the refresh flow for an access token regardless of its expiry. Note: - Do not include any credentials in the request body. This operation does not persist changes, but only triggers the validation of connection state. - If a refresh token flow was performed and successful, the new access token will then be used for subsequent API requests.

Provider disconnect callback Endpoint that receives browser redirect notifications from downstream providers when a user disconnects their OAuth integration. The JWT in the path encodes the application identity. The service_id identifies the connector.

Provider disconnect server callback Endpoint that receives server-to-server POST callbacks from downstream providers when a user disconnects their OAuth integration. The JWT in the path encodes the application identity. The service_id identifies the connector. The request body contains the provider-specific identifier.