---
title: "Invoke one grant-bound governed provider operation"
method: POST
path: "/v1/provider-operations"
tags: ["connect"]
---

# Invoke one grant-bound governed provider operation

`POST /v1/provider-operations`

## Request

- Base URL: `https://api.runx.ai`
- URL: `https://api.runx.ai/v1/provider-operations`
- Auth: HTTP bearer

## Request body

- ProviderOperationRequest
  - `connector_binding` ConnectorBinding, required: An exact connector revision: its connector name, its manifest digest, and its connector digest over the manifest and the tool packages it runs. A grant lists the one Connect executes it under; a provider operation or request names the one its caller admitted, and Cloud refuses any other with operation_contract_mismatch.
    - `connector` string, required
    - `manifest_digest` string, required
    - `connector_digest` string, required
  - `grant_id` string, required
  - `operation` string, required
  - `operation_digest` string, required: The digest of the connector operation the caller admitted. Cloud refuses one that is not its manifest's with operation_contract_mismatch.
  - `target` string, required: Exact provider-neutral target locator bound into the operation readback evidence.
  - `scopes` string[]: Optional exact Runx capability scopes already admitted by the runtime; Cloud checks supplied evidence against the connector manifest and grant.
  - `input` object
  - `access` 'read' | 'mutate': Optional caller assertion checked against the connector manifest's operation before dispatch.

## Response `200`

Provider operation result.

- ProviderOperationResultEnvelope
  - `status` 'success', required
  - `provider` string, required
  - `operation` string, required
  - `target` string, required
  - `access` 'read' | 'mutate', required: The access the connector manifest declares for the executed operation.
  - `result` unknown, required
  - `readback_ref` string, required
  - `operation_id` string
  - `idempotency_key` string

## Other responses

- `400`: Invalid or unsupported operation request.
- `401`: Unauthorized.
- `403`: Grant or binding does not authorize the operation.
- `404`: Grant not found.
- `409`: Operation unavailable, or admitted under another contract.

---

[API](https://skmtc.dev/runx/apis/runx-hosted-api.md) · [All operations](https://skmtc.dev/runx/apis/runx-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/runx/apis/runx-hosted-api/revisions/6c940d8edacc?raw)