---
title: "Create provider connection"
method: POST
path: "/api/provider-connections"
tags: ["provider_connections"]
---

# Create provider connection

`POST /api/provider-connections`

## Request

- Base URL: `https://beta.getsales.io/integrations/v1`
- URL: `https://beta.getsales.io/integrations/v1/api/provider-connections`
- Auth: HTTP bearer and API key in header `Team-SID`

Store a credential of the team's OWN API (provider custom): name, auth_type (api_key or bearer inject Authorization Bearer; basic; header; query) and the write-only auth payload, never echoed back. No verification at create: test_provider_connection checks the shape, a custom tool's test exercises it. A vendor is refused (422 provider_not_connectable: the platform holds those keys); hubspot comes only through the OAuth connect (422 auth_type_invalid_for_provider). 409 on a duplicate name.

Contract:
- MCP tool `create_provider_connection`, registry package `mcp.integrations/provider_connections`, mount `integrations.providers`.
- Operation `create`, response envelope `create`.
- Flags: none.

## Request body

- CreateProviderConnectionRequest: Request body of `create_provider_connection`.
  - `name` string, required: Display name, 1..255 chars, unique within the team.
  - `provider` 'custom' | 'hubspot', required: custom in practice; hubspot passes the rule and is refused (its grant comes from the OAuth connect).
  - `auth_type` 'api_key' | 'bearer' | 'basic' | 'header' | 'query': Default api_key.
  - `auth` object, required: WRITE-ONLY, never echoed: {key} for api_key or bearer, {username, password} for basic, {header_name, value} for header, {param_name, value} for query.
  - `status` 'on' | 'off': Default on.

## Response `200`

`create` success envelope.

- CreateProviderConnectionResponse
  - `success` true, required
  - `operation` 'create', required
  - `item` object, required
    - `sid` string, required: Connection sid (in_cn_...).
    - `team_sid` string, required: The owning workspace (ts_tm_...).
    - `name` string, required: Display name, unique within the team among live rows.
    - `provider` 'openai' | 'anthropic' | 'google' | 'deepseek' | 'xai' | 'voyage' | 'cohere' | 'hunter' | 'findymail' | 'anymailfinder' | 'emaillistverify' | 'custom' | 'hubspot' | 'serper', required: custom (the team's own API) or hubspot (a CRM grant); immutable.
    - `auth_type` 'api_key' | 'bearer' | 'basic' | 'header' | 'query' | 'oauth', required: The shape of the stored secret; oauth on a HubSpot grant.
    - `external_account_id` string, nullable, required: The provider-side account of an OAuth grant (the HubSpot portal id): the reconnect key; null on key auth.
    - `status` 'on' | 'off' | 'failed', required: on; off (paused by hand); failed (auto-disabled after five auth failures in a row, revived by update or a reconnect).
    - `consecutive_failed_attempts` integer, required: Auth-classified failures in a row; any non-cache success or a rotation resets it.
    - `last_failure_at` string, nullable, required: ISO 8601 UTC of the last auth failure.
    - `created_by` object, required: Who stored it.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `deleted_by` object, nullable, required: Who deleted it; null while live.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `created_at` string, required: ISO 8601 UTC.
    - `updated_at` string, required: ISO 8601 UTC.
    - `deleted_at` string, nullable, required: ISO 8601 UTC; the secret is scrubbed with it.
  - `already_exists` boolean, required
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/revisions/2e7105d58335?raw)