---
title: "The org's data connections, names + scopes only (never material)"
method: GET
path: "/preview/connections"
tags: ["connections"]
---

# The org's data connections, names + scopes only (never material)

`GET /preview/connections`

## Request

- Base URL: `https://autoresearch.sfcompute.com`
- URL: `https://autoresearch.sfcompute.com/preview/connections`
- Auth: HTTP bearer

Your org's stored data connections, BY NAME ONLY - the access they grant is exercised only by the platform and is never shown to you or anyone: there is nothing here to paste anywhere. Returns [{name, kind, verbs, scope, auth, disabled, last_used_at}], e.g. {name: "acme-corpus", kind: "s3-keys", verbs: ["read"], scope: "s3://acme-ml/corpus-v3/*", auth: "token"} (auth "oauth" = a browser grant, no stored secret at all; one still pending its browser step shows pending_authorization: true and can't import yet). Use a name with import_data to land private data on a node without ever holding a credential. A kind "registry" row is different: it is a private Docker registry, exercised when a JOB pulls an image inside its scope, so you never name it anywhere - just pass the image to submit_job(image:) and the platform authenticates the pull. Empty, or missing the source you need? A human org admin adds one from their own terminal or CI - `autor connection create` (install: `curl -fsSL https://autoresearch.sfcompute.com/cli.sh | bash`, then `autor login`) - a one-time step, ~2 minutes, good for every future task. Ask them to do exactly that; NEVER ask anyone to paste a token, key, or password into this chat (transcripts are recorded and outlive the task), and connection mutations are not callable with this connection's grant.

## Query parameters

- `cursor` string: Opaque page cursor: the `next_cursor` a previous response returned. Omit for the first page.
- `limit` integer: Rows per page. Clamped to the range shown.
- `workspace` string

## Response `200`

The capability's JSON result.

- List: The list envelope every paging endpoint returns.
  - `items` Result[], required
    - `object` string: The resource type, when the result is one resource.
  - `next_cursor` string: Pass as ?cursor= for the next page. Absent on the last page. Opaque: never parse it.
  - `object` 'list', required

## Other responses

- `400`: Malformed request: bad JSON, a parameter that does not parse, or a value outside its range. Code `invalid`.
- `401`: No bearer token, or one this API cannot verify. Code `unauthenticated`.
- `403`: Authenticated, but the token's scopes or the account's role do not reach this operation. The message names the scope word to request. Code `forbidden`.
- `404`: No such route. Code `not_found`; the body names the OpenAPI document.
- `422`: A well-formed request the platform declined: no such node, a cap reached, a state that forbids the move. The message says which, and what to do instead. Code `refused`.
- `429`: Over this door's per-customer budget. Wait `Retry-After` seconds. Code `rate_limited`.
- `500`: Our fault. Retry; if it persists, quote the request-id. Code `internal`.

---

[API](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api.md) · [All operations](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/revisions/f88dcb70ac6c?raw)