AGagentsky
workspace-connectors

Mint one key per workspace role at the service and vault each [admin, owner or admin]

Changed on

Through the service's own key route (POST {origin}/v1/keys) with the workspace's admin key, read from the named vault by the platform alone. Each key goes into a vault <kind>-<role> as <KIND>_API_KEY bound to the connector's host, which the connector then names for that role; a role that already had a key gets a new one, its secret is rotated in place so attached sessions follow, and the old key is revoked at the service. Behind CONNECTOR_KEY_MINTING (403 not_enabled otherwise). 404 unknown connector or admin vault, 422 admin_key_missing, 502 service_refused.

post/workspace-connectors/{id}/provision

Request

  • Base URL
    https://api.agentsky.dev/v1
  • URL
    https://api.agentsky.dev/v1/workspace-connectors/{id}/provision
  • Auth
    HTTP bearer

Path parameters

idstring required

Request body

admin_vaultstring required

The vault (vlt_…) holding the service's admin key; read by the platform alone

admin_secret_namestring

The secret that is the admin key: an environment_variable secret by variable name, or a static_bearer secret by display name; default CRM_ADMIN_KEY

deliver_as'env' | 'mcp_bearer'

env (default): <KIND>_API_KEY bound to the origin's host; mcp_bearer: a bearer for the service's MCP server at origin + mcp_path

mcp_pathstring

Default /mcp

Response

Created

connector_idstring required
mintedobject required

Per workspace role: the key's id and prefix at the service, when it was minted, and the vault and secret name that carry it; never the key

Changes