---
title: "List active connections"
method: GET
path: "/api/connections"
tags: ["Connections"]
---

# List active connections

`GET /api/connections`

## Request

- Base URL: `https://api.engram.page`
- URL: `https://api.engram.page/api/connections`
- Auth: HTTP bearer

OAuth client families, device families, and PATs. Session-auth only.

## Response `200`

Connections

- Connection[]
  - `cimd_url` string, nullable: CIMD metadata-document URL. Present only for clients that published one, in which case it is the client's public identifier and the reason it can be `verified` despite redirecting to loopback.
  - `client_id` string, nullable
  - `connected_at` string, date-time, nullable
  - `family_id` string, uuid, nullable: The grant lineage this row is. One OAuth client can hold several grants over different vault sets, each its own row; pass this to `DELETE /connections/oauth/{client_id}` to revoke only this one. Null for PATs.
  - `first_ip` string, nullable
  - `first_user_agent` string, nullable
  - `key_id` string, nullable
  - `kind` string, required
  - `label` string, nullable: The user's own name for this connection, when they set one.
  - `last_used_at` string, date-time, nullable
  - `logo` string, nullable
  - `name` string, nullable
  - `new_vaults` 'none' | 'read' | 'write': The level this connection gets on vaults you create later.
  - `redirect_uri` string, nullable: The redirect this grant's authorization code was delivered to. This, not `redirect_uris`, is what decides `verified`. Null for non-OAuth connections and for grants issued before it was recorded.
  - `redirect_uris` string[], nullable: Every redirect the client registered. Informational only — a client may register several and choose one per authorization, so a vendor host appearing here proves nothing about this grant.
  - `scope` string, nullable
  - `slug` string, nullable
  - `software_id` string, nullable
  - `software_version` string, nullable
  - `vault_ids` string[], nullable: Vaults this connection may reach right now (read or write). Null means every vault, including ones created later. For a connection with per-vault levels this is resolved, not stored: the vaults `vault_levels` shows at read or write. Vaults created later get `new_vaults`, so read both for the full picture.
  - `vault_levels` object[]: What this connection may do in each of your vaults, resolved now. Every vault you can see is listed, `none` included. `read` = search and read, `write` = also change notes and the vault.
    - `level` 'none' | 'read' | 'write', required
    - `vault_id` string, uuid, required
    - `vault_name` string, nullable
  - `vault_names` string[], nullable: Positional against `vault_ids`. An entry is null when the vault is gone or outside the caller's own scope.
  - `verified` boolean, nullable

---

[API](https://skmtc.dev/engram/apis/engram-api.md) · [All operations](https://skmtc.dev/engram/apis/engram-api/llms.txt) · [OpenAPI document](https://skmtc.dev/engram/apis/engram-api/revisions/8c4c2eec29dc?raw)