---
title: "Get"
method: GET
path: "/connections/{id}"
tags: ["connections"]
---

# Get

`GET /connections/{id}`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/connections/{id}`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

One connection with config REDACTED: only keys on an explicit per-provider public-key allowlist are returned in the clear (e.g. non-secret settings); every other key comes back as a fixed redacted-value marker, never the real credential. ResourceAuth-gated (tenant_admin/admin only) — the fenced value round-trips through PATCH without ever exposing the real secret.

## Path parameters

- `id` string, required

## Response `200`

OK

- InternalDeliveryHttpHandlerConnectionResponse
  - `data` EnforcerV3InternalDomainConnectionTenantConnection
    - `config` object: Config is the decrypted credential map — populated only on authorized single-row reads, never on lists.
    - `created_at` string
    - `id` string
    - `is_active` boolean
    - `name` string
    - `provider` EnforcerV3InternalDomainConnectionProvider
      - `capability` EnforcerV3InternalDomainConnectionCapability
        - `created_at` string
        - `description` string
        - `id` string
        - `name` string
        - `updated_at` string
      - `capability_id` string
      - `created_at` string
      - `description` string
      - `id` string
      - `name` string
      - `updated_at` string
    - `provider_app_id` string: ProviderAppID is the provider's PUBLIC application id (e.g. the Privy app id). Plaintext (not in the sealed config) so it can be queried for login tenant resolution and served to the client SDK. app_secret stays in config_encrypted.
    - `provider_id` string
    - `send_enforcement` boolean: SendEnforcement marks this connection's tenant as wallet-send-enforced (multi-sig): the tenant's Privy smart wallets get the mandatory app-key owner quorum and rwa's signing gateway enforces send policy. It lives on the connection row — the mode is baggage of the cybrid-bank wiring for specific tenants, not a property of every Privy tenant. Plaintext (not in the sealed config) so operators flip it with one UPDATE. A tenant is enforced iff ANY active connection row carries the flag; when rotating the flagged connection, set it on the replacement row or enforcement drops.
    - `tenant_id` string
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)