Every account this tenant holds for a provider (CLO-528/890).

GET /{provider}/connection (singular) answers "which one counts" for every other route on this connector, and stays that way — this is additive, for a caller that wants to list and manage more than one rather than act on the tenant's single implicit connection.

Same membership check as the singular route. Each entry carries the singular route's fields, with two deliberate differences: no connected (every entry here is, by construction), and resource_health_summary without the full per-resource map, which at 50 connections × 40 resources would dwarf everything else — fetch one connection for that. The account id is spelled both ways: account_id, which is what every other route takes as a parameter, and provider_account_id, which is what the singular route returns, so a client reading the documented field does not get undefined and hand exactly that to a disconnect call (review-reported).

is_default marks the entry every account_id-less route on this connector acts on. This list is oldest-first so a new account never reorders the ones an owner is already looking at, while the implicit pick is newest-first — so the first entry here is never the implicit one, and a UI that renders the list and then issues a plain disconnect would revoke a different account than the card the user clicked (review-reported). The flag says which, rather than leaving it to be inferred from an ordering that is deliberately the reverse.