---
title: "Create"
method: POST
path: "/v3/integrations"
tags: ["integrations-v3"]
---

# Create

`POST /v3/integrations`

## Request

- Base URL: `https://api.traversal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.traversal.com/v3/integrations`
- Auth: none declared

Create a new named integration instance and start a health check.

Credentials are encrypted and stored in AWS Secrets Manager. Only
metadata (name, type, id, timestamps, environment labels) is stored in
the database.

After the instance is created, a health check workflow runs in the
background against the supplied credentials. The workflow updates
``last_health_check`` asynchronously.

**Permissions**: org admin (own org) or platform admin (any org).
``organization_id`` defaults to the caller's own org; platform admins
may supply a different org to create integrations on its behalf.

Returns HTTP 201 with the created instance metadata.

## Query parameters

- `organization_id` string, nullable

## Request body

- CreateIntegrationV3Request: Request body for creating a new integration instance. The ``integration`` field is a discriminated union over all supported integration types (Datadog, Elasticsearch, PagerDuty, …). Set the ``type`` field inside ``integration`` to select the concrete schema. Example:: { "name": "datadog-prod", "integration": { "type": "datadog", "api_key": "abc123", "app_key": "xyz789", "base_api_url": "https://api.datadoghq.com" } }
  - `name` string, required: Human-readable display name for this integration instance. Must be unique within the organization for a given type. Examples: 'datadog-prod', 'opensearch-us-east', 'github-main-org'.
  - `description` string, nullable: Optional description of this integration instance. This description is surfaced directly to Traversal's AI during incident investigations, so include context that helps the AI understand when and how to use this integration — such as which environment it covers, which services or teams own it, and any relevant scope or access limitations. Examples: 'Primary account for US-East production — covers all API and worker services owned by the platform team', 'Read-only OpenSearch cluster for production log analysis — indexes rotate daily, retain 30 days'.
  - `integration` union, required: The integration configuration. Include a ``type`` discriminator field (e.g. ``"type": "metric_store"``) to select the correct schema. Credential fields (API keys, tokens) are stored encrypted and never returned in plaintext after creation.
    - AnthropicIntegrationConfig: Anthropic Claude API integration for LLM capabilities. Customer provides API key and optional configuration for proxies. Attributes: type: Integration type discriminator for union resolution api_key: Anthropic API key (required) base_url: Base URL for API proxies (optional, defaults to Anthropic's API)
      - `type` 'anthropic'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: Anthropic API key
      - `base_url` string, uri, nullable
    - OpenAIIntegrationConfig: OpenAI API integration for GPT models and embeddings. Customer provides an API key and optional proxy configuration. Attributes: type: Integration type discriminator for union resolution api_key: OpenAI API key (required) base_url: Base URL for API proxies (optional, defaults to OpenAI's API)
      - `type` 'openai'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: OpenAI API key
      - `base_url` string, uri, nullable
    - GradientAIIntegrationConfig: DigitalOcean Gradient AI integration for LLM capabilities. Attributes: type: Integration type discriminator for union resolution api_key: Gradient AI API key (required)
      - `type` 'gradient_ai'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: Gradient AI API key
    - DatadogIntegrationConfig: Datadog monitoring platform for metrics, logs, traces, and alerts. Customer provides API key, Application key, and API URL selection. Attributes: type: Integration type discriminator for union resolution api_key: Datadog API key (required) app_key: Datadog Application key (required) api_url: Datadog API URL (optional, e.g., https://api.datadoghq.com, https://api.datadoghq.eu)
      - `type` 'datadog'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required
      - `app_key` string, password, required
      - `api_url` string, required
    - CloudWatchIntegrationConfig: Customer AWS role Traversal assumes to read CloudWatch metrics and logs. Shares the cross-account IAM role credential plane with the AWS CLI integration (``aws_cli``), but is a distinct telemetry integration: it exposes CloudWatch Logs and Metrics through dedicated SDK-backed tools rather than the terminal AWS CLI. Unlike ``aws_cli`` it carries a list of ``regions`` to query.
      - `type` 'cloudwatch'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `account_id` string, required: 12-digit AWS account ID, derived from role_arn; used as the identity for dedup.
      - `role_arn` string, required: Customer-owned IAM role ARN Traversal assumes to read CloudWatch data.
      - `regions` string[], required: AWS regions to query CloudWatch metrics and logs in.
    - ElasticsearchIntegrationConfig: Elasticsearch search and analytics engine for log aggregation. Customer provides connection details (hosts or cloud ID) and authentication credentials (basic auth, API key with ID, or API key only). Attributes: type: Integration type discriminator for union resolution connection: Connection configuration (hosts or cloud ID) auth: Authentication configuration (basic auth or API key variants)
      - `type` 'elasticsearch'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `connection` union, required
        - ElasticsearchHostsConnection: Connection via explicit host list. Attributes: connection_type: Discriminator for union type hosts: One or more Elasticsearch hosts
          - `connection_type` 'hosts'
          - `hosts` string[]: One or more Elasticsearch hosts
        - ElasticsearchCloudConnection: Connection via Elastic Cloud deployment ID. Attributes: connection_type: Discriminator for union type cloud_id: Elastic Cloud deployment ID
          - `connection_type` 'cloud_id'
          - `cloud_id` string, password, required: Elastic Cloud deployment ID
      - `auth` union, required
        - ElasticsearchBasicAuth: HTTP Basic authentication credentials. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required: Username for basic auth
          - `password` string, password, required: Password for basic auth
        - ElasticsearchApiKeyWithId: API key authentication with ID and key pair. Attributes: auth_type: Discriminator for union type key_id: API key identifier (required) key: API key secret (required)
          - `auth_type` 'api_key_with_id'
          - `key_id` string, required: API key identifier
          - `key` string, password, required: API key secret
        - ElasticsearchApiKey: API key authentication (single key string). Attributes: auth_type: Discriminator for union type api_key: API key (required)
          - `auth_type` 'api_key'
          - `api_key` string, password, required: API key
      - `index_discovery_patterns` string[]: Index patterns used to scope dataset-enumeration requests (_cat/indices/<pattern>, _resolve/index/<pattern>) — e.g. ['logs-*']. Required for least-privilege credentials and path-allowlisted or federated proxies that reject unscoped enumeration. Empty enumerates unscoped ('*').
    - EMIMIntegrationConfig: Amex EMIM (Emergency Incident Management) API integration. EMIM provides access to bridge details, postmortems, and incident data for Amex emergency incidents. Attributes: type: Integration type discriminator for union resolution api_key: EMIM API key for MAC signature authentication api_secret: EMIM API secret for MAC signature authentication api_host: EMIM API host URL (e.g., "emim.example.com")
      - `type` 'emim'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: EMIM API key for authentication
      - `api_secret` string, password, required: EMIM API secret for MAC signature
      - `api_host` string, uri, required: EMIM API host URL
    - PrometheusIntegrationConfig: Prometheus time-series database for metrics collection. Customer provides server URL and optional authentication (basic auth or bearer token). Attributes: type: Integration type discriminator for union resolution url: Prometheus server URL (required) auth: Optional authentication configuration (basic auth or bearer token) enable_ssl: Whether to enable SSL for the connection
      - `type` 'prometheus'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Prometheus server URL
      - `auth` union, required
        - PrometheusBasicAuth: HTTP Basic authentication credentials for Prometheus. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required: Username for basic auth
          - `password` string, password, required: Password for basic auth
        - PrometheusBearerToken: Bearer token authentication for Prometheus. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token for cloud Prometheus authentication
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required: Bearer token for authentication
      - `enable_ssl` boolean: Enables SSL for the Prometheus server. See https://www.python-httpx.org/advanced/ssl/ for more details.
      - `multi_url_legacy` string[], nullable: [Deprecated] Legacy field to represent multiple prometheus endpoints that share the same settings.
      - `scope_tenant_id` string, nullable: Tenant the label policy is issued for (the Grafana Cloud stack's Prometheus instance id). Required when scope_filters is set.
      - `scope_filters` object: Label equality matchers every series must carry, e.g. {'team': 'payments'}. Enforced by the backend via X-Prom-Label-Policy. Empty means unscoped.
    - VictoriaMetricsIntegrationConfigInput: Victoria Metrics time-series database for metrics storage and querying. Cluster URLs and a single shared auth are carried in ``digital_ocean_vm_integration``. IMPORTANT REMARK: - The way this whole class is structured is a massive hack. The real problem is that we currently do not support multiple integrations of the same type for a particular customer. In other words, we cannot have multiple Victoria Metrics integrations for a particular customer. - This is why cluster URLs and authentication live in the ``digital_ocean_vm_integration`` wrapper. Ideally, we would have a list of VictoriaMetricsIntegration objects with their own authentication configurations. Attributes: type: Integration type discriminator for union resolution digital_ocean_vm_integration: Configuration for connecting to multiple Victoria Metrics clusters with a single authentication configuration
      - `type` 'victoria_metrics'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `digital_ocean_vm_integration` MultiClusterSingleAuth: Defines a configuration for connecting to multiple Victoria Metrics clusters with a single authentication configuration.
        - `urls` string[], required: List of Victoria Metrics cluster URLs
        - `auth` union: Authentication configuration for the VM connection
          - VictoriaMetricsBasicAuth: HTTP Basic authentication credentials for Victoria Metrics. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
            - `auth_type` 'basic_auth'
            - `username` string, required: Username for basic auth
            - `password` string, password, required: Password for basic auth
          - VictoriaMetricsBearerToken: Bearer token authentication for Victoria Metrics. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token for authentication
            - `auth_type` 'bearer_token'
            - `bearer_token` string, password, required: Bearer token for authentication
        - `enable_ssl` boolean: Whether to enable SSL for the VM connection. See https://www.python-httpx.org/advanced/ssl/ for more details.
    - AppDynamicsIntegrationConfig: AppDynamics application performance monitoring platform integration. Customer provides OAuth credentials for AppDynamics API access. Attributes: type: Integration type discriminator for union resolution client_id: OAuth client ID (required) client_secret: OAuth client secret (required) base_url: AppDynamics API base URL (required)
      - `type` 'appdynamics'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `client_id` string, required: OAuth client ID
      - `client_secret` string, password, required: OAuth client secret
      - `base_url` string, uri, required
    - ServiceNowIntegrationConfig: ServiceNow IT service management and incident tracking platform integration. Attributes: type: Integration type discriminator for union resolution instance_url: ServiceNow instance URL auth: Authentication configuration (client_credentials, password_grant, or basic_auth) ssl_verify: Whether to verify SSL certificates. Set False for on-prem instances with internal CAs that are not in the system trust store. metrics_api_tables: CMDB class tables queryable via the Clotho metrics API. table_api_tables: Fallback table_query tables union'd into live sys_db_object discovery only when that walk is cut short; ignored when it completes. table_query_filters: Per-table encoded-query conditions AND'd onto every Table API read of that table, scoping it to the rows this org may see. sys_db_object_page_size: Pagination page size for sys_db_object discovery. sys_db_object_probe_concurrency: Max concurrent per-table access probes.
      - `type` 'servicenow'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `instance_url` string, uri, required: ServiceNow instance URL
      - `auth` union, required
        - ServiceNowClientCredentialsAuth
          - `auth_type` 'client_credentials'
          - `client_id` string, required: OAuth client ID
          - `client_secret` string, password, required: OAuth client secret
          - `access_token_url` string, uri, required: OAuth access token URL
        - ServiceNowPasswordGrantAuth
          - `auth_type` 'password_grant'
          - `username` string, required: ServiceNow username
          - `password` string, password, required: ServiceNow password
          - `access_token_url` string, uri, required: OAuth access token URL
        - ServiceNowBasicAuth
          - `auth_type` 'basic_auth'
          - `username` string, required: ServiceNow username
          - `password` string, password, required: ServiceNow password
      - `ssl_verify` boolean: Verify SSL certificates
      - `incident_api_path` string: Incident table API path.
      - `incident_api_health_check_params` object: Query params for the health check probe against the incident table.
      - `custom_headers` object: Optional non-sensitive HTTP headers added to every ServiceNow API request.
      - `metrics_api_tables` string[]: CMDB class tables queryable via the Clotho metrics API (e.g. cmdb_ci_computer). Drives ServiceNow dataset population for DatasetExecuteMetricQueriesTool.
      - `table_api_tables` string[]: Fallback table_query tables (ServiceNowTableQueryTool) used only to backfill live sys_db_object discovery when that walk is cut short, e.g. cmdb_ci, incident. When discovery completes, its table set is used as is and this list is ignored; when it does not, these names are union'd into the discovered set.
      - `table_query_filters` object: Encoded-query conditions keyed by table name, AND'd onto the sysparm_query of every Table API read of that table (e.g. {'incident': 'u_service_tower=command_center^u_impacted_client1=BLK'}). Scopes an org to the rows it may see on a shared instance. Filter only; no ORDERBY.
      - `sys_db_object_page_size` integer: Page size (sysparm_limit) used when paginating sys_db_object to discover the instance's table_query candidate tables.
      - `sys_db_object_probe_concurrency` integer: Max concurrent per-table access probes when confirming sys_db_object-discovered tables are reachable before emitting them as datasets.
    - GitHubIntegrationConfig: GitHub source code hosting and version control platform integration. Customer provides either GitHub App installation ID (preferred) or a personal access token for authentication. Attributes: type: Integration type discriminator for union resolution auth: Authentication configuration (installation ID or access token) api_url: GitHub API URL for Enterprise deployments (optional) repos: List of repositories in 'owner/repo' format (optional) organization: GitHub organization name for organization-wide access (optional) role: Traversal read vs write label (default read)
      - `type` 'github'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth` union, required
        - GitHubInstallationAuth: GitHub App installation authentication. Attributes: auth_type: Discriminator for union type installation_id: GitHub App installation ID (required)
          - `installation_id` string, password, required: GitHub App installation ID
          - `auth_type` 'installation_id'
        - GitHubTokenAuth: GitHub personal access token or OAuth token authentication. Attributes: auth_type: Discriminator for union type access_token: Personal access token or OAuth token (required, begins with secret_)
          - `auth_type` 'access_token'
          - `access_token` string, password, required: Personal access token or OAuth token
        - GitHubEnterpriseAuth: GitHub Enterprise authentication. Attributes: auth_type: Discriminator for union type api_url: GitHub API URL for Enterprise deployments (required)
          - `auth_type` 'enterprise'
          - `api_url` string, uri, required: GitHub API URL for Enterprise deployments
          - `access_token` string, password, required: Personal access token or OAuth token
        - GHESAppAuth: A customer-registered GitHub App on their GitHub Enterprise Server. Attributes: auth_type: Discriminator for union type api_url: GHES REST API URL the App is registered on (required) app_id: The customer's App ID (required) private_key: PEM private key of the customer's App (required) installation_id: Installation ID of the App on the customer's org (required)
          - `installation_id` string, password, required: GitHub App installation ID
          - `auth_type` 'ghes_app'
          - `api_url` string, uri, required: GitHub Enterprise Server API URL
          - `app_id` string, required: GitHub App ID
          - `private_key` string, password, required: GitHub App private key (PEM)
      - `api_url` string, uri, nullable: GitHub API URL for Enterprise deployments
      - `repositories` string[], nullable: List of repositories in 'owner/repo' format (e.g., 'myorg/myrepo')
      - `organization` string, nullable: GitHub organization name for organization-wide access
      - `role` 'read' | 'write'
    - GitHubWebhookIntegrationConfigInput: Credentials and verification contract for inbound GitHub webhooks.
      - `type` 'github_webhook'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `webhook_secret` string, password, required
      - `verification` WebhookVerification: Everything needed to verify one provider's inbound requests. The two strategies partition the fields completely. `shared_token` uses `auth_header` and `auth_value_prefix` and leaves the rest null; `hmac` populates all of them. `_fields_match_strategy` enforces that split, and migration_280 repeats it as a CHECK so a hand-edited row cannot express a contract the verifier would have to guess at.
        - `auth_strategy` 'hmac' | 'shared_token', required: How Combine decides whether an inbound request is authentic.
        - `auth_header` string, required: Header carrying the presented signature or token.
        - `auth_value_prefix` string, nullable: Stripped from the presented value, e.g. 'sha256=' or 'Bearer '.
        - `auth_value_encoding` 'hex' | 'base64': How the presented signature becomes the bytes compared against. Distinct from `WebhookSecretEncoding` because the two sides vary independently: GitHub is a UTF-8 key with a hex signature, GitLab a base64 key with a base64 signature.
        - `secret_prefix` string, nullable: Stripped from the stored secret before decoding, e.g. 'whsec_'.
        - `secret_encoding` 'utf8' | 'base64': How the stored secret becomes HMAC key bytes. `base64` exists for Standard Webhooks providers, whose signing secret is a `whsec_`-prefixed base64 encoding of 32 raw key bytes.
        - `signed_message` union[], nullable: Ordered parts concatenated to form the signed message. HMAC only.
          - union
            - RawBodySignedPart: The request body, byte for byte as received. Byte-exact matters: the webhook route must not decompress, because every provider signs what it put on the wire.
              - …
            - HeaderSignedPart: Another header whose value participates in the signed message. Standard Webhooks signs `webhook-id` and `webhook-timestamp` alongside the body; Grafana's timestamped mode signs its configured timestamp header. These are read in addition to the header carrying the signature itself.
              - …
            - LiteralSignedPart: A fixed separator between other parts, such as Standard Webhooks' dot.
              - …
    - GitLabIntegrationConfig: GitLab source code hosting and version control platform integration. Supports both gitlab.com and self-hosted GitLab instances. Customer provides a personal access token, project access token, or group access token for authentication. Self-hosted instances can specify a custom API URL. Attributes: type: Integration type discriminator for union resolution auth: Authentication configuration (personal, project, or group access token) api_url: GitLab API URL (default: https://gitlab.com for gitlab.com, custom for self-hosted) project_ids: List of project IDs (numeric) to access (optional) group_id: GitLab group ID for group-wide access (optional) role: Traversal read vs write label (default read)
      - `type` 'gitlab'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth` union
        - GitLabTokenAuth: GitLab personal access token or OAuth token authentication. Supports both gitlab.com and self-hosted GitLab instances. Attributes: auth_type: Discriminator for union type access_token: Personal access token or OAuth token (required)
          - `auth_type` 'access_token'
          - `access_token` string, password, required: Personal access token or OAuth token
        - GitLabProjectAccessTokenAuth: GitLab project access token authentication. Project-scoped tokens for specific projects (similar to GitHub deploy keys). Attributes: auth_type: Discriminator for union type project_id: GitLab project ID access_token: Project access token (required)
          - `auth_type` 'project_access_token'
          - `project_id` integer, required: GitLab project ID
          - `access_token` string, password, required: Project access token
        - GitLabGroupAccessTokenAuth: GitLab group access token authentication. Group-scoped tokens for access to all projects within a group. Attributes: auth_type: Discriminator for union type group_id: GitLab group ID access_token: Group access token (required)
          - `auth_type` 'group_access_token'
          - `group_id` integer, required: GitLab group ID
          - `access_token` string, password, required: Group access token
      - `api_url` string, uri: GitLab API URL (default: gitlab.com, set custom URL for self-hosted)
      - `project_ids` integer[], nullable: List of GitLab project IDs (numeric) to access
      - `group_id` integer, nullable: GitLab group ID for group-wide access
      - `role` 'read' | 'write'
    - GrafanaIntegrationConfig: Grafana observability platform for metrics, logs, and traces visualization. Customer provides server URL and authentication credentials (bearer token or username/password). Attributes: type: Integration type discriminator for union resolution url: Grafana server URL (required) auth: Authentication configuration (bearer token or basic auth) enable_querying: Whether Traversal may run queries through this Grafana instance.
      - `type` 'grafana'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Grafana server URL
      - `auth` union, required
        - GrafanaBearerTokenAuth: Bearer token authentication for Grafana. Attributes: auth_type: Discriminator for union type bearer_token: Service account token or API key (required)
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required: Service account token or API key
        - GrafanaBasicAuth: HTTP Basic authentication credentials for Grafana. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required: Username for basic auth
          - `password` string, password, required: Password for basic auth
      - `enable_querying` boolean: Allow Traversal to run queries through this Grafana instance
    - ThousandEyesIntegrationConfig: ThousandEyes network intelligence and monitoring platform integration. Customer provides API key for ThousandEyes API access. Attributes: type: Integration type discriminator for union resolution api_key: ThousandEyes API key (required)
      - `type` 'thousandeyes'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: ThousandEyes API key
    - NotionIntegrationConfig: Notion workspace and knowledge management platform integration. Customer provides integration token for Notion API access. Attributes: type: Integration type discriminator for union resolution token: Notion integration token (required, begins with secret_)
      - `type` 'notion'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `token` string, password, required: Notion integration token
    - OpenSearchIntegrationConfig: OpenSearch search and analytics engine (Elasticsearch fork). Customer provides connection details (hosts) and authentication credentials (basic auth, API key with ID, or API key only). Attributes: type: Integration type discriminator for union resolution hosts: One or more OpenSearch hosts auth: Authentication configuration (basic auth or API key variants)
      - `type` 'opensearch'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth` union, required
        - OpenSearchBasicAuth: HTTP Basic authentication credentials. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required: Username for basic auth
          - `password` string, password, required: Password for basic auth
        - OpenSearchApiKeyWithId: API key authentication with ID and key pair. Attributes: auth_type: Discriminator for union type key_id: API key identifier (required) key: API key secret (required)
          - `auth_type` 'api_key_with_id'
          - `key_id` string, required: API key identifier
          - `key` string, password, required: API key secret
        - OpenSearchApiKey: API key authentication (single key string). Attributes: auth_type: Discriminator for union type api_key: API key (required)
          - `auth_type` 'api_key'
          - `api_key` string, password, required: API key
        - OpenSearchBearerToken: Bearer token authentication. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token sent in the Authorization header
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required: Bearer token
      - `base_url_for_ui` string, uri, nullable
      - `hosts` string[]: One or more OpenSearch hosts
      - `index_discovery_patterns` string[]: Index patterns used to scope dataset-enumeration requests (_cat/indices/<pattern>, _resolve/index/<pattern>) — e.g. ['elf-*-log-*', 'elf-*-span-*']. Required for least-privilege credentials and path-allowlisted or federated proxies that reject unscoped enumeration. Empty enumerates unscoped ('*').
    - SplunkIntegrationConfig: Splunk log management and security information platform integration. Customer provides instance URL and authentication (basic auth or bearer token). Attributes: type: Integration type discriminator for union resolution url: Splunk instance URL (required) auth: Authentication configuration (basic auth or bearer token)
      - `type` 'splunk'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Splunk instance URL
      - `auth` union, required
        - SplunkBasicAuth: Username/password authentication credentials for Splunk. Attributes: auth_type: Discriminator for union type username: Username for authentication (required) password: Password for authentication (required)
          - `auth_type` 'basic_auth'
          - `username` string, required: Username for authentication
          - `password` string, password, required: Password for authentication
        - SplunkBearerToken: Bearer token authentication for Splunk. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token for Splunk authentication
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required: Bearer token for authentication
      - `scope_filters` object: Indexed-field equality matchers, e.g. {'team': 'payments'}, that scope label-value sampling and that the agent is told to include in every search. Not enforced on agent searches. Empty means unscoped.
    - ConfluenceIntegrationConfigInput: Confluence wiki and documentation platform integration. Attributes: type: Integration type discriminator for union resolution url: Confluence instance URL (required) auth: Authentication configuration (Basic Auth, Bearer token, or a client-credentials variant for Cloud reached via an egress gateway) cloud_id: Atlassian cloud ID for multi-tenant deployments (optional, required for api.atlassian.net) scope_space_keys: Space keys whose content Traversal may read. scope_root_page_ids: Pages whose whole subtree Traversal may read.
      - `type` 'confluence'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Confluence instance URL
      - `auth` union, required
        - ConfluenceBasicAuth: Atlassian Cloud authentication via email + API token. Standard auth for Confluence Cloud: the email and API token are sent as HTTP Basic Auth credentials (``Authorization: Basic base64(email:token)``).
          - `auth_type` 'basic_auth'
          - `username` string, required: Email address for Atlassian Cloud
          - `api_key` string, password, required: Atlassian API token
        - ConfluenceUsernamePasswordAuth: Confluence Server / Data Center HTTP Basic authentication.
          - `auth_type` 'username_password'
          - `username` string, required: Confluence username
          - `password` string, password, required: Confluence account password
        - ConfluenceBearerAuth: On-prem / Data Center authentication via personal access token. Used for Confluence Server or Data Center instances that authenticate with ``Authorization: Bearer <token>`` rather than Basic Auth.
          - `auth_type` 'bearer_token'
          - `api_key` string, password, required: Personal access token
        - ClientCredentialsAuthBasicJson: HTTP Basic auth plus a JSON body. Credentials authenticate as HTTP Basic; endpoint-specific parameters travel in ``request_body`` as JSON. The token is read from ``token_response_key``.
          - `token_url` string, uri, required: Token endpoint URL
          - `client_id` string, password, required: Client identifier
          - `client_secret` string, password, required: Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential: A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required: Username for the Basic credential
            - `secret` string, password, required: Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'basic_json'
        - ClientCredentialsAuthHmacSigned: Token request authenticated by an HMAC signature carried in request headers. The caller signs ``{client_id}-{signature_version}-{timestamp_ms}`` with the base64-decoded ``client_secret`` (HMAC-SHA256, base64url-encoded) and sends the signature plus the app id, version, and timestamp as request headers. Endpoint-specific parameters travel in ``request_body`` as JSON; the token is read from ``token_response_key``.
          - `token_url` string, uri, required: Token endpoint URL
          - `client_id` string, password, required: Client identifier
          - `client_secret` string, password, required: Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential: A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required: Username for the Basic credential
            - `secret` string, password, required: Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'hmac_signed'
          - `signature_version` string: Signing scheme version echoed in the signed message and header
      - `cloud_id` string, nullable: Atlassian cloud ID for multi-tenant deployments (required when using api.atlassian.net)
      - `scope_space_keys` string[]: Space keys (e.g. 'ISSS') whose content Traversal may read. Together with scope_root_page_ids this is an allow-list; when both are empty the integration is unscoped and reads everything the credential can.
      - `scope_root_page_ids` string[]: Page ids whose page and every descendant Traversal may read, for content that is a subtree of a larger space rather than a whole space.
    - FireHydrantIntegrationConfig: FireHydrant incident management and retrospective platform integration. Customer provides API key for FireHydrant API access. Attributes: type: Integration type discriminator for union resolution api_key: FireHydrant API key (required)
      - `type` 'firehydrant'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: FireHydrant API key
    - SlackIntegrationConfig: Slack team communication and collaboration platform integration. Customer provides bot token for Slack API access. OAuth credentials and workspace metadata are persisted together in the integrations v3 secret for this instance.
      - `type` 'slack'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `bot_token` string, password, required: Slack bot token
      - `workspace_id` string, nullable: Workspace ID for enterprise installations
      - `team_name` string, nullable: Human-readable Slack workspace name
      - `bot_user_id` string, nullable: Slack user ID of the bot (U...)
      - `bot_id` string, nullable: Bot app configuration ID (B...)
      - `enterprise_id` string, nullable: Enterprise Grid ID
      - `enterprise_name` string, nullable: Human-readable enterprise name
      - `is_enterprise_install` boolean, nullable: Whether this is an Enterprise Grid installation
      - `incoming_webhook_url` string, nullable: Incoming webhook URL
      - `incoming_webhook_channel` string, nullable: Channel name for the incoming webhook
      - `incoming_webhook_channel_id` string, nullable: Channel ID for the incoming webhook
      - `incoming_webhook_configuration_url` string, nullable: URL to reconfigure the incoming webhook
      - `app_id` string, nullable: Slack App ID
      - `enterprise_url` string, nullable: Enterprise Grid URL
      - `bot_scopes` string, nullable: Comma-separated OAuth scopes granted to the bot
      - `user_id` string, nullable: Slack user ID of the person who installed the app
      - `user_scopes` string, nullable: Comma-separated OAuth scopes granted to the user token
      - `token_type` string, nullable: Token type
      - `installed_at` string, nullable: Installation timestamp
      - `bot_token_expires_at` string, nullable: Bot token expiry timestamp
      - `bot_refresh_token` string, password, nullable: Bot token refresh token
      - `user_token` string, password, nullable: User OAuth token
      - `user_refresh_token` string, password, nullable: User token refresh token
      - `user_token_expires_at` string, nullable: User token expiry timestamp
      - `archived_at` string, nullable: Lifecycle marker set when the Slack install is archived
    - TeamsIntegrationConfig: Microsoft Teams chat platform integration. The Teams analogue of ``SlackIntegration``: the typed credentials blob for a Teams bot install, stored as an AWS secret on an ``integration_instances`` row of ``integration_type = teams``. There is no Postgres install table — Teams ships natively on ``integration_instances``. Credentials are Azure Bot Service / Bot Framework app credentials: the bot's Microsoft app (client) id plus its client secret. ``tenant_id`` is the Azure AD tenant the bot is installed in and serves as the ``third_party_id`` for the ``integration_instances`` row. Attributes: type: Integration type discriminator for union resolution. app_id: Microsoft/Bot Framework app (client) id. A public identifier, not a secret. app_password: Bot client secret. Required, secret. tenant_id: Azure AD tenant id; the install identifier (``third_party_id``). app_type: Bot Framework app type ("MultiTenant" / "SingleTenant" / "UserAssignedMSI"). bot_id: The bot's id in Teams (often equal to ``app_id``). Install metadata. bot_name: Human-readable bot/app display name. Install metadata. service_url: Bot Framework service URL for the tenant, discovered from inbound activities and required to send proactive messages. Install metadata. installed_at: Installation timestamp. Install metadata. archived_at: Lifecycle marker set when the install was archived; None for live installs.
      - `type` 'teams'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `app_id` string, required: Microsoft/Bot Framework app (client) id
      - `app_password` string, password, required: Bot client secret
      - `tenant_id` string, nullable: Azure AD tenant id; the install's third_party_id
      - `app_type` string, nullable: Bot Framework app type (MultiTenant / SingleTenant)
      - `bot_id` string, nullable: The bot's id in Teams
      - `bot_name` string, nullable: Human-readable bot/app display name
      - `service_url` string, nullable: Bot Framework service URL for the tenant (for proactive messages)
      - `installed_at` string, nullable: Installation timestamp
      - `archived_at` string, nullable: Lifecycle marker set when the Teams install was archived; None for live installs.
    - LokiIntegrationConfig: Loki log aggregation system integration. Grafana Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. Attributes: type: Integration type discriminator for union resolution url: Loki server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments
      - `type` 'loki'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Loki server URL
      - `token` string, password, nullable: Bearer token for authentication
      - `org_id` string, nullable: Organization ID for multi-tenant deployments
      - `scope_tenant_id` string, nullable: Tenant the label policy is issued for (the Grafana Cloud stack's Loki instance id). Required when scope_filters is set.
      - `scope_filters` object: Label equality matchers every stream must carry, e.g. {'team': 'payments'}. Enforced by the backend via X-Prom-Label-Policy. Empty means unscoped.
    - LinearIntegrationConfig: Linear issue tracking integration. Linear is a modern issue tracking tool for software teams. Attributes: type: Integration type discriminator for union resolution api_key: Linear API key for authentication (required)
      - `type` 'linear'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: Linear API key for authentication
    - MimirIntegrationConfig: Mimir - scalable long-term storage for Prometheus metrics. Customer provides server URL and authentication. Mimir typically requires an X-Scope-OrgID header for multi-tenancy. Attributes: type: Integration type discriminator for union resolution url: Mimir server URL (required) basic_auth: Optional basic authentication credentials bearer_token: Optional bearer token for authentication org_id: X-Scope-OrgID header value for Mimir multi-tenancy
      - `type` 'mimir'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Mimir server URL
      - `basic_auth` PrometheusBasicAuth: HTTP Basic authentication credentials for Prometheus. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
        - `auth_type` 'basic_auth'
        - `username` string, required: Username for basic auth
        - `password` string, password, required: Password for basic auth
      - `bearer_token` string, password, nullable: Bearer token for authentication
      - `org_id` string, nullable: X-Scope-OrgID header value for Mimir multi-tenancy
      - `scope_tenant_id` string, nullable: Tenant the label policy is issued for (the Grafana Cloud stack's Mimir instance id). Required when scope_filters is set.
      - `scope_filters` object: Label equality matchers every series must carry, e.g. {'team': 'payments'}. Enforced by the backend via X-Prom-Label-Policy. Empty means unscoped.
    - MotherDuckIntegrationConfig: MotherDuck serverless analytics integration. MotherDuck is a serverless analytics platform built on DuckDB. Attributes: type: Integration type discriminator for union resolution token: MotherDuck authentication token (required)
      - `type` 'motherduck'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `token` string, password, required: MotherDuck authentication token
    - JiraIntegrationConfigInput: Jira issue tracking integration. Jira is an issue tracking and project management tool by Atlassian. Attributes: type: Integration type discriminator for union resolution base_url: Jira instance URL (e.g., https://company.atlassian.net or https://api.atlassian.net) auth: API-token auth for Cloud or username/password Basic Auth for Server/Data Center cloud_id: Atlassian cloud ID for multi-tenant deployments (optional, required for api.atlassian.net)
      - `type` 'jira'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `base_url` string, uri, required: Jira instance URL (e.g., https://company.atlassian.net or https://api.atlassian.net)
      - `auth` union
        - JiraApiTokenAuth: Atlassian Cloud authentication via email and API token.
          - `auth_type` 'api_token'
          - `email` string, required: Atlassian account email
          - `api_token` string, password, required: Jira API token
        - JiraBasicAuth: Jira Server / Data Center authentication via username and password.
          - `auth_type` 'basic_auth'
          - `username` string, required: Jira username
          - `password` string, password, required: Jira account password
      - `email` string, nullable
      - `api_token` string, password, nullable
      - `cloud_id` string, nullable: Atlassian cloud ID for multi-tenant deployments (required when using api.atlassian.net)
    - KubernetesIntegrationConfig: Kubernetes API integration for sandbox kubectl access. Holds a cluster ``connection`` (how to reach the API server) and an ``auth`` (how to authenticate). Commands receive a per-exec kubeconfig built from a short-lived token. The two axes are orthogonal except for ``aws_eks``, which is self-authenticating and pairs only with the ``aws_eks_derived`` sentinel — the pairing validator enforces the valid combinations.
      - `type` 'kubernetes'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `connection` union, required
        - KubernetesExplicitConnection: Direct connection details for one Kubernetes API server.
          - `connection_type` 'explicit'
          - `cluster_name` string, required: Human-readable cluster/context name
          - `server_url` string, uri, required: Kubernetes API server URL
          - `default_namespace` string, nullable: Optional namespace set as the kubeconfig context default
          - `certificate_authority_data` string, nullable: Base64-encoded PEM CA bundle for the Kubernetes API server
          - `insecure_skip_tls_verify` boolean: Disable TLS verification for the Kubernetes API server
        - KubernetesEksConnection: Discover an EKS cluster and mint tokens from an assumed AWS role. Self-authenticating: one assumed-role session both resolves the endpoint/CA (``eks:DescribeCluster``) and presigns the STS token, so it pairs only with ``aws_eks_derived`` auth. Authorization is deferred to the role's EKS access-entry RBAC — mirrors the AWS CLI integration's defer-to-ARN model. ``external_id`` is optional to configure here, but AWS's own AssumeRole condition is not: every broker-trusting role (customer-CFN-deployed or Traversal's own internal one) requires a matching ``sts:ExternalId``. When unset, the credential provider falls back to the org-derived default (``traversal:<org_id>``) rather than omitting the parameter.
          - `connection_type` 'aws_eks'
          - `cluster_name` string, required: EKS cluster name (also the kubeconfig context name)
          - `region` string, required: AWS region of the EKS cluster
          - `role_arn` string, required: Customer IAM role ARN Traversal assumes; its EKS RBAC is the boundary
          - `external_id` string, password, nullable: External ID for the customer's IAM role trust policy — the confused-deputy mitigation for a multi-tenant assumer. Leave unset to use Traversal's org-derived default (traversal:<org_id>), which is what the CFN template's downloadable default is pre-filled with; set explicitly only if the role's trust policy pins a different value.
          - `session_duration_seconds` integer: Duration of the assumed-role session used to mint EKS tokens
          - `default_namespace` string, nullable: Optional namespace set as the kubeconfig context default
      - `auth` union, required
        - KubernetesTokenRequestAuth: Mint short-lived tokens for a customer-scoped Kubernetes ServiceAccount. The requester token should be bound only to ``create`` on the target ``serviceaccounts/token`` resource. The target ServiceAccount's RBAC is the permission boundary for commands run by the agent.
          - `auth_type` 'token_request'
          - `service_account_name` string, required: Target ServiceAccount whose RBAC defines kubectl permissions
          - `service_account_namespace` string, required: Namespace containing the target ServiceAccount
          - `requester_bearer_token` string, password, required: Bearer token allowed to create tokens for the target ServiceAccount via the Kubernetes TokenRequest API
          - `audience` string, nullable: Optional TokenRequest audience. Leave unset for the cluster default.
          - `expiration_seconds` integer: Requested lifetime for each short-lived ServiceAccount token
        - KubernetesBearerAuth: Static, long-lived ServiceAccount bearer token (self-managed clusters). Pairs with an ``explicit`` connection. The token's ServiceAccount RBAC is the permission boundary for commands run by the agent.
          - `auth_type` 'bearer'
          - `bearer_token` string, password, required: Static ServiceAccount bearer token used to authenticate to the cluster
        - KubernetesAwsEksDerivedAuth: Sentinel: auth derived from an ``aws_eks`` connection's assumed-role identity. Carries no independent credentials — the connection's assumed role both discovers the cluster endpoint/CA (``eks:DescribeCluster``) and presigns the STS token. Valid only with an ``aws_eks`` connection (enforced by ``KubernetesIntegrationConfig``'s pairing validator).
          - `auth_type` 'aws_eks_derived'
    - CoralogixIntegrationConfig: Coralogix observability platform integration. Coralogix is a full-stack observability platform that provides log analytics, metrics, and tracing capabilities. Attributes: type: Integration type discriminator for union resolution api_key: API key for Coralogix authentication (required) base_url: Coralogix API base URL (e.g., "https://api.eu2.coralogix.com")
      - `type` 'coralogix'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: API key for Coralogix authentication
      - `base_url` string, uri, required: Coralogix API base URL (e.g., https://api.eu2.coralogix.com)
    - CriblIntegrationConfig: Cribl.Cloud observability pipeline integration. Authenticates via OAuth client credentials against the Cribl.Cloud workspace URL. Attributes: type: Integration type discriminator for union resolution url: Cribl.Cloud workspace URL (required) auth: Cribl.Cloud OAuth client credentials
      - `type` 'cribl'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Cribl.Cloud workspace URL
      - `auth` CriblSaasAuth, required: OAuth 2.0 client-credentials authentication for Cribl.Cloud. The client_id and client_secret are exchanged at ``https://login.cribl.cloud/oauth/token`` for a 24-hour Bearer JWT used on subsequent API requests. Attributes: client_id: OAuth client ID from the Cribl.Cloud API Credential client_secret: OAuth client secret from the Cribl.Cloud API Credential
        - `client_id` string, required: Cribl.Cloud OAuth client ID
        - `client_secret` string, password, required: Cribl.Cloud OAuth client secret
    - IncidentIoIntegrationConfig: Incident.io incident management platform integration. Customer provides API key for incident.io API access. The API key is used as a Bearer token for all upstream requests. Attributes: type: Integration type discriminator for union resolution api_key: Incident.io API key (required, begins with inc_)
      - `type` 'incident_io'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: Incident.io API key
    - SentryIntegrationConfig: Sentry error and performance monitoring platform integration. Customer provides an auth token (org-scoped internal-integration token preferred, personal auth token as a fallback) plus their organization slug. The token is used as a Bearer token for all upstream requests. Attributes: type: Integration type discriminator for union resolution auth_token: Sentry auth token (required) organization_slug: Sentry organization slug the token belongs to (required, all deployments). Analogous to the cloud ID on Atlassian. base_url: API base URL. Defaults to https://sentry.io when unset. Set to https://de.sentry.io for the EU region, or the custom domain for single-tenant / self-hosted deployments.
      - `type` 'sentry'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth_token` string, password, required: Sentry auth token
      - `organization_slug` string, required: Sentry organization slug
      - `base_url` string, uri, nullable: API base URL; defaults to https://sentry.io. Set to https://de.sentry.io for the EU region, or the custom domain for single-tenant / self-hosted.
    - TempoIntegrationConfig: Grafana Tempo distributed tracing backend integration. Attributes: type: Integration type discriminator for union resolution url: Tempo server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments
      - `type` 'tempo'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Tempo server URL
      - `token` string, password, nullable: Bearer token for authentication
      - `org_id` string, nullable: Organization ID for multi-tenant deployments
      - `scope_tenant_id` string, nullable: Tenant the label policy is issued for (the Grafana Cloud stack's Tempo instance id). Required when scope_filters is set.
      - `scope_filters` object: Label equality matchers every span must carry, e.g. {'resource.team': 'payments'}. Enforced by the backend via X-Prom-Label-Policy. Empty means unscoped.
    - AlertmanagerIntegrationConfig: Grafana Alertmanager integration for querying active and historical alerts. Attributes: type: Integration type discriminator for union resolution url: Alertmanager server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments
      - `type` 'alertmanager'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required: Alertmanager server URL
      - `token` string, password, nullable: Bearer token for authentication
      - `org_id` string, nullable: Organization ID for multi-tenant deployments
    - AlexandriaIntegrationConfig: Configuration for a Nubank Alexandria MCP endpoint. Attributes: type: Integration discriminator (always ``IntegrationType.ALEXANDRIA``). enabled_data_types: Alexandria provides log data via Trino queries. server_url: Alexandria MCP endpoint URL. Defaults to the prod-global cluster-internal address, but is configurable so different envs (blue/green, ist, us, br) can be used without a code change. bearer_token: Optional Nubank API key JWT sent as ``Authorization: Bearer``. Required at query time; omitted on legacy instances until migrated.
      - `type` 'alexandria'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required: Alexandria MCP endpoint URL
      - `bearer_token` string, password, nullable: Bearer token for Alexandria MCP proxy authentication
    - HoneycombIntegrationConfig: Configuration for a Nubank Honeycomb MCP endpoint. Attributes: type: Integration discriminator (always ``IntegrationType.HONEYCOMB``). enabled_data_types: Honeycomb provides trace data via MCP tools. server_url: Honeycomb MCP proxy endpoint URL. bearer_token: Optional Nubank API key JWT sent as ``Authorization: Bearer``. Required at query time; omitted on legacy instances until migrated.
      - `type` 'honeycomb'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required: Honeycomb MCP proxy endpoint URL
      - `bearer_token` string, password, nullable: Bearer token for Honeycomb MCP proxy authentication
    - DynatraceIntegrationConfig: Dynatrace observability integration supporting Classic API and/or Grail. Customers populate *one or both* of (``classic_url`` + ``api_token_auth``) and (``platform_url`` + ``platform_auth``). At least one complete pair is required; the health checker and clients will only exercise the pair(s) that are configured. Typical configurations: * **SaaS, mid-migration:** both pairs. Classic API token unlocks ``/api/v2/problems``, ``/api/v2/entities``, etc.; OAuth unlocks Grail (``/platform/storage/query/*``). * **SaaS, Grail-only:** only ``platform_url`` + ``platform_auth``. Problems and entities still reachable via DQL (``fetch dt.entity.host``, …). * **Managed / self-hosted:** only ``classic_url`` + ``api_token_auth`` (Grail is not deployed on Managed).
      - `type` 'dynatrace'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `classic_url` string, uri, nullable: Classic Environment API URL. SaaS: 'https://<env-id>.live.dynatrace.com'. Managed / self-hosted: 'https://<your-domain>/e/<env-id>'. Required when api_token_auth is set.
      - `platform_url` string, uri, nullable: Platform (Grail) URL: 'https://<env-id>.apps.dynatrace.com'. Required when platform_auth is set. SaaS-only (Managed has no Grail).
      - `api_token_auth` DynatraceApiTokenAuth: Classic Environment API credentials. Authenticates as ``Authorization: Api-Token <api_token>`` against the classic ``/api/v2/*`` surface. This is the **only** auth type available on Dynatrace Managed / self-hosted tenants (Grail is SaaS-only). Generate in Dynatrace UI: Settings → Integration → Dynatrace API → Generate token. Select the scopes the integration needs — at minimum ``metrics.read`` for the health check to pass.
        - `auth_type` 'api_token'
        - `api_token` string, password, required: Dynatrace API Token (starts with 'dt0c01.')
      - `platform_auth` union: OAuth client or Bearer token credentials for Grail/DQL. Required to reach /platform/*.
        - DynatraceOAuthClientAuth: Platform / Grail credentials via OAuth 2.0 client credentials. At request time we exchange (``client_id``, ``client_secret``) plus the requested ``scopes`` and the account URN (``resource``) at ``sso_token_url`` for a short-lived Bearer token, which is then sent as ``Authorization: Bearer <token>`` against ``/platform/*`` endpoints on the platform host. Generate in Dynatrace UI: Account Management → Identity & access management → OAuth clients → Create client. Grant the scopes the integration will need (e.g. ``storage:logs:read``, ``storage:buckets:read``, ``storage:system:read``).
          - `auth_type` 'oauth_client'
          - `client_id` string, required: OAuth client ID (starts with 'dt0s02.')
          - `client_secret` string, password, required: OAuth client secret
          - `account_urn` string, required: Dynatrace account URN, e.g. 'urn:dtaccount:<uuid>'
          - `sso_token_url` string, uri: SSO token endpoint. Override only for sovereign/regional tenants.
          - `scopes` string[]: OAuth scopes to request when minting a Bearer token. Empty (the default) means we omit the scope parameter so Dynatrace returns the full allowlist the OAuth client was granted. Override only to narrow the token below that grant.
        - DynatraceBearerTokenAuth: Platform / Grail credentials using a directly supplied Bearer token.
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required: Platform Bearer token
    - McpIntegrationConfigInput: Configuration for a single MCP server. Three auth methods are supported, distinguished by how the credential is obtained: - ``bearer_token``: a static credential, stamped on a header as-is. No acquisition step. ``auth_header_name`` and ``auth_scheme`` shape the header and default to ``Authorization`` / ``Bearer``, i.e. ``Authorization: Bearer <auth_token>``. Override them for servers that want something else: ``Basic`` for HTTP Basic, ``Bearer Basic`` for Mixpanel's documented hybrid, or ``auth_scheme=None`` plus an ``X-Api-Key`` header name to send the raw credential with no prefix. - ``client_credentials``: exchange service-account credentials for a short-lived token at a custom token endpoint. Carried by the shared client-credentials config, whose ``auth_type`` selects the wire format (e.g. ``basic_json``: HTTP Basic auth + JSON body). - ``oauth``: standard OAuth 2.0 authorization-code + PKCE + Dynamic Client Registration (RFC 7591/7636). User-authorized at creation time via a popup; tokens are stored encrypted, refreshed on demand using the refresh token if the server issued one. ``auth_header_name`` / ``auth_scheme`` apply only to ``bearer_token``. The other two acquire a token whose transport is fixed by their own spec, and always send it as ``Authorization: Bearer <token>``. Multiple MCP servers per organization are achieved by creating multiple ``IntegrationInstance`` rows of type ``mcp`` via the v3 integrations API; each instance carries its own ``McpIntegration`` payload.
      - `type` 'mcp'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required
      - `tool_call_timeout_ms` integer
      - `blocked_tools` string[]
      - `auth_type` 'bearer_token' | 'client_credentials' | 'oauth'
      - `auth_token` string, password, nullable
      - `auth_header_name` string
      - `auth_scheme` string, nullable
      - `client_credentials` union
        - ClientCredentialsAuthBasicForm: HTTP Basic auth plus a form-encoded client-credentials grant body.
          - `token_url` string, uri, required: Token endpoint URL
          - `client_id` string, password, required: Client identifier
          - `client_secret` string, password, required: Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential: A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required: Username for the Basic credential
            - `secret` string, password, required: Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'basic_form'
        - ClientCredentialsAuthBasicJson: HTTP Basic auth plus a JSON body. Credentials authenticate as HTTP Basic; endpoint-specific parameters travel in ``request_body`` as JSON. The token is read from ``token_response_key``.
          - `token_url` string, uri, required: Token endpoint URL
          - `client_id` string, password, required: Client identifier
          - `client_secret` string, password, required: Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential: A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required: Username for the Basic credential
            - `secret` string, password, required: Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'basic_json'
        - ClientCredentialsAuthHmacSigned: Token request authenticated by an HMAC signature carried in request headers. The caller signs ``{client_id}-{signature_version}-{timestamp_ms}`` with the base64-decoded ``client_secret`` (HMAC-SHA256, base64url-encoded) and sends the signature plus the app id, version, and timestamp as request headers. Endpoint-specific parameters travel in ``request_body`` as JSON; the token is read from ``token_response_key``.
          - `token_url` string, uri, required: Token endpoint URL
          - `client_id` string, password, required: Client identifier
          - `client_secret` string, password, required: Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential: A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required: Username for the Basic credential
            - `secret` string, password, required: Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'hmac_signed'
          - `signature_version` string: Signing scheme version echoed in the signed message and header
      - `oauth_access_token` string, password, nullable
      - `oauth_refresh_token` string, password, nullable
      - `oauth_token_expires_at` string, date-time, nullable
      - `oauth_client_id` string, password, nullable
      - `oauth_client_secret` string, password, nullable
      - `oauth_token_endpoint` string, uri, nullable
      - `oauth_authorization_endpoint` string, uri, nullable
      - `oauth_token_endpoint_auth_method` string, nullable
      - `oauth_scope` string, nullable
      - `scope` 'organization'
      - `identity_mode` 'service_account'
    - PagerDutyIntegrationConfig: PagerDuty incident management and on-call platform integration. Read-only. Customer provides an API key created at PagerDuty's Read-only access level, enforcing no-writes server-side. Attributes: type: Integration type discriminator for union resolution api_key: PagerDuty API key (required, Read-only access level)
      - `type` 'pagerduty'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required: PagerDuty API key (Read-only access)
    - SpinnakerIntegrationConfig: Spinnaker continuous-delivery platform integration. Self-hosted CD platform; auth method varies by deployment. Five auth modes are supported via the ``auth`` discriminated union — see each variant's docstring for details on when to use it. Attributes: type: Integration type discriminator for union resolution gate_url: Spinnaker Gate base URL (include port for X.509, e.g. :8085) auth: Authentication configuration (one of five variants) applications: Optional list of Spinnaker applications to scope queries to
      - `type` 'spinnaker'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `gate_url` string, uri, required: Spinnaker Gate base URL
      - `auth` union, required
        - SpinnakerX509Auth: Spinnaker X.509 client certificate (mTLS) authentication. Used when Gate is configured with X.509 client-cert auth on its dedicated API port (default 8085). Same auth mode the ``spin`` CLI uses. Attributes: auth_type: Discriminator for union type client_cert_pem: Client certificate PEM (required) client_key_pem: Client private key PEM (required) ca_bundle_pem: Optional CA bundle for verifying Gate's server cert
          - `auth_type` 'x509'
          - `client_cert_pem` string, password, required: Client certificate PEM
          - `client_key_pem` string, password, required: Client private key PEM
          - `ca_bundle_pem` string, password, nullable: Optional CA bundle PEM for server certificate verification
        - SpinnakerOAuthAuth: Spinnaker OAuth 2.0 client-credentials (OIDC) authentication. Exchanges service-account credentials at the IdP token endpoint for a short-lived bearer token, which is then sent to Gate. Requires Gate to be configured to accept the IdP's bearer tokens (typically a Spring resource-server filter validating against the IdP's JWKS). Attributes: auth_type: Discriminator for union type token_url: IdP token endpoint URL client_id: OAuth client ID client_secret: OAuth client secret scope: Optional OAuth scope(s) audience: Optional audience claim required by some IdPs
          - `auth_type` 'oauth_client_credentials'
          - `token_url` string, uri, required: IdP token endpoint URL
          - `client_id` string, password, required: OAuth client ID
          - `client_secret` string, password, required: OAuth client secret
          - `scope` string, nullable: OAuth scope(s)
          - `audience` string, nullable: Audience claim required by some IdPs (e.g. Auth0)
        - SpinnakerHeaderAuth: Spinnaker ``X-SPINNAKER-USER`` header authentication. Used when Gate's ``gate-header`` module is enabled and an upstream component (mTLS at the load balancer, an SSO proxy) has already authenticated the request. Gate trusts the header value as the principal. Only safe behind upstream authentication — the header is not a credential on its own. Attributes: auth_type: Discriminator for union type spinnaker_user: Email or principal sent in the X-SPINNAKER-USER header
          - `auth_type` 'spinnaker_user_header'
          - `spinnaker_user` string, required: Email or principal sent in the X-SPINNAKER-USER header
        - SpinnakerBasicAuth: Spinnaker HTTP basic authentication. Attributes: auth_type: Discriminator for union type username: Basic-auth username password: Basic-auth password
          - `auth_type` 'basic'
          - `username` string, required: Basic-auth username
          - `password` string, password, required: Basic-auth password
        - SpinnakerBearerAuth: Spinnaker static bearer token authentication. Attributes: auth_type: Discriminator for union type auth_token: Static bearer token sent as the Authorization header
          - `auth_type` 'bearer'
          - `auth_token` string, password, required: Static bearer token sent as Authorization header
      - `applications` string[], nullable: Optional list of Spinnaker application names to scope queries to
    - ArtifactoryIntegrationConfig: JFrog Artifactory container registry integration. Used primarily for querying Docker image tags and manifests to map container image digests back to git commit SHAs.
      - `type` 'artifactory'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `base_url` string, uri, required: Artifactory instance URL (e.g., https://artifactory.example.com)
      - `username` string, required: Username for authentication
      - `password` string, password, required: Password or API key for authentication
    - AwsCliIntegrationConfig: Customer AWS role Traversal can assume for terminal AWS CLI commands.
      - `type` 'aws_cli'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `account_id` string, required: 12-digit AWS account ID this integration represents.
      - `role_arn` string, required: Customer-owned IAM role ARN Traversal assumes for AWS CLI commands.
      - `external_id` string, password, required: External ID required by the customer's IAM role trust policy.
      - `region` string, required: AWS region used for STS and as the default AWS CLI region.
      - `session_duration_seconds` integer: Duration for short-lived AWS CLI credentials.
      - `session_name_prefix` string: Prefix used for STS role session names.
      - `allowed_domain_suffixes` string[]: Domain suffixes egress-proxy allows this session to dial directly. A bare suffix (no '*.' prefix) matches only that exact host, not its subdomains — see egress-proxy's matchesAnySuffix. Placeholder default, not a considered scoping policy — see egress_proxy_token_signing.EgressProxyTokenSigner.sign_for_domain_allowlist.
    - AmexWebexCaptionsIntegrationConfig: Amex Bridge Summarizer integration for retrieving Webex meeting captions. Authenticates via the Amex AuthBlue App2App client-credentials flow: ``username`` and ``password`` are HTTP-Basic-authed against ``authblue_signin_url`` (proxied through the org's relay) to mint a short-lived ``blueToken`` JWT. That token is sent as a Bearer header to ``bridge_captions_url`` to fetch caption records for a given bridge id and time window. Token minting goes through the shared ``basic_json_client_credentials`` client-credentials flow. App2App only accepts AD service accounts (e.g. ``svc.ai-ops``); real user LDAP creds are rejected. AuthBlue exposes different App2App hosts per environment (E1 dev, E2 qa, E3 prod), so the URL is configured per integration instance rather than hardcoded. Attributes: type: Integration type discriminator for union resolution. authblue_signin_url: AuthBlue App2App token endpoint that mints the ``blueToken`` (e.g. ``https://authbluetokens.aexp.com/v1/app2app/tokens`` for prod). Historical name kept for stored-config compatibility. bridge_captions_url: Bridge Summarizer endpoint that returns Webex caption records (e.g. ``https://bridgesummarization.aexp.com/get_webex_captions``). username: AD service account name (App2App rejects user LDAP creds). password: AuthBlue password for the service account.
      - `type` 'amex_webex_captions'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `authblue_signin_url` string, uri, required: AuthBlue App2App token endpoint that mints the blueToken (e.g. https://authbluetokens.aexp.com/v1/app2app/tokens for prod).
      - `bridge_captions_url` string, uri, required: Bridge Summarizer endpoint that returns Webex caption records (e.g. https://bridgesummarization.aexp.com/get_webex_captions).
      - `username` string, required: AD service account name (App2App rejects user LDAP creds).
      - `password` string, password, required: AuthBlue password for the service account.
    - DeptrackerIntegrationConfig: Configuration for a DigitalOcean deptracker REST endpoint. Attributes: type: Integration discriminator (always ``IntegrationType.DEPTRACKER``). enabled_data_types: Deptracker provides deployment events. server_url: Deptracker REST base URL (e.g. ``https://<traversal-domain>/dep-tracker``). The ``/api/v1/query`` path is appended by the client.
      - `type` 'deptracker'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required: Deptracker REST base URL
    - DoServiceCatalogIntegrationConfig: Configuration for DigitalOcean's internal Backstage-shaped catalog. Attributes: type: Integration discriminator (always ``IntegrationType.DO_SERVICE_CATALOG``). enabled_data_types: The catalog provides topology (service inventory + ``dependsOn`` edges + GitHub source links). server_url: Catalog base URL (e.g. ``https://servicecatalog.internal.digitalocean.com``). The client appends ``/entities`` for queries. auth_token: Bearer token presented in the ``Authorization`` header.
      - `type` 'do_service_catalog'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required: Service catalog base URL
      - `auth_token` string, password, required: Bearer token for the service catalog API
    - AzureDevOpsIntegrationConfig: Azure DevOps work tracking, repositories, and pipelines integration. Covers both deployments behind one URL field: `organization_url` is the organization base on Azure DevOps Services (`https://dev.azure.com/{organization}`) or the collection base on on-premises Azure DevOps Server (`https://tfs.corp.com/tfs/DefaultCollection`). Every REST route hangs off that base as `_apis/...`, so the two shapes need no separate schema. Attributes: type: Integration type discriminator for union resolution organization_url: Azure DevOps organization or on-premises collection URL auth: Personal access token credentials
      - `type` 'azure_devops'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `organization_url` string, uri, required: Azure DevOps organization URL (https://dev.azure.com/{organization}) or on-premises collection URL (https://server/tfs/DefaultCollection)
      - `auth` AzureDevOpsPersonalAccessTokenAuth, required: Personal access token authentication for Azure DevOps. The only credential shape that works against both Azure DevOps Services and on-premises Azure DevOps Server. Alternate credentials (a plain username and password) were deprecated in March 2020 and stopped working entirely in January 2024, and Microsoft Entra ID / OAuth is Services-only — so a PAT is the single mechanism that spans every deployment. Attributes: auth_type: Discriminator for union type personal_access_token: Azure DevOps personal access token (required)
        - `auth_type` 'personal_access_token'
        - `personal_access_token` string, password, required: Azure DevOps personal access token
    - AzureIntegrationConfig: Customer Azure (Commercial Cloud) tenant Traversal runs CLI and Monitor queries against. Scoped today to capturing the tenant ID the agent will later run `az` CLI and Azure Monitor queries against. Role-grant and connectivity fields are added once Entra publisher verification and the connector's federated credential land — see RFC: Azure Integration (Azure CLI, Azure Monitor). Azure Government and other national/sovereign clouds (e.g. Azure China) are explicitly out of scope: they are fully separate login systems requiring their own app registration, not representable by this type. Distinct from AzureDevopsIntegrationConfig, which covers Azure DevOps (source control, pipelines) and is tracked in its own RFC.
      - `type` 'azure'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `tenant_id` string, required: Microsoft Entra tenant ID (Commercial Cloud) this integration represents.
    - TraversalUserApiKeyIntegrationConfig: Container for Traversal API key configurations. Stores a list of API keys for an organization. Each organization can have multiple users with multiple keys each. Attributes: type: Integration type discriminator for union resolution. api_keys: List of Traversal API key configurations.
      - `type` 'traversal_api_key'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_keys` TraversalApiKey[]
        - `id` string
        - `name` string, required
        - `principal_id` string, required
        - `prefix` string, required
        - `hashed_secret` string, required
        - `created_at` string, date-time
        - `last_used_at` string, date-time, nullable
        - `revoked_at` string, date-time, nullable
  - `network_access` string, nullable: Name of the network this integration should connect through (e.g. an internal VPN). Omit or set to null to connect over the public internet.
  - `environment_labels` string[], nullable: The customer's own names for the environments this integration's data covers, e.g. ``["prod", "staging"]``. Lowercased, trimmed and deduped on the way in, so ``PROD`` and ``prod`` are one environment. At most 10 labels of 20 characters each. Use the reserved ``"unscoped"`` alone when the data is not split by environment at all — it cannot be combined with any other label. Omit or leave null to store none; every dataset this instance owns inherits the labels at population time.

## Response `201`

Successful Response

- IntegrationInstanceResponse: Metadata about a single integration instance. Credential fields are never included in this response. Use the integration-type-specific credential rotation endpoints to update secrets.
  - `id` string, required: Stable UUID for this integration instance. Use this in PUT /v3/integrations/{id} and DELETE /v3/integrations/{id}.
  - `organization_id` string, required: UUID of the organization that owns this integration instance.
  - `name` string, required: Human-readable display name set at creation time.
  - `description` string, nullable: Optional free-text description of this integration instance. Surfaced to Traversal's AI during investigations to help it understand when and how to use this integration.
  - `type` 'anthropic' | 'openai' | 'gradient_ai' | 'datadog' | 'elasticsearch' | 'prometheus' | 'mimir' | 'victoria_metrics' | 'grafana' | 'appdynamics' | 'servicenow' | 'github' | 'github_webhook' | 'gitlab' | 'thousandeyes' | 'linear' | 'notion' | 'loki' | 'opensearch' | 'splunk' | 'gcp' | 'motherduck' | 'confluence' | 'coralogix' | 'firehydrant' | 'pagerduty' | 'slack' | 'teams' | 'jira' | 'kubernetes' | 'traversal' | 'traversal_webhook' | 'traversal_api_key' | 'incident_io' | 'sentry' | 'tempo' | 'alexandria' | 'honeycomb' | 'alertmanager' | 'emim' | 'trailblazer' | 'dynatrace' | 'cribl' | 'mcp' | 'aws_cli' | 'artifactory' | 'spinnaker' | 'amex_webex_captions' | 'deptracker' | 'do_service_catalog' | 'cloudwatch' | 'azure_devops' | 'azure', required: Canonical integration platform types. Represents the platform or system where data originates from. Used to determine appropriate connectors, authentication, and API clients.
  - `third_party_id` string, nullable: Optional opaque identifier from the third-party system (e.g. a Log Store instance ID). Populated automatically from the integration payload when present.
  - `enabled_data_types` string[], required: List of data-type capabilities enabled for this integration (e.g. ``["logs", "metrics"]``). Controlled by the integration payload.
  - `metadata` object: Non-secret integration-specific metadata stored with this instance.
  - `created_at` string, date-time, nullable: ISO-8601 timestamp of when this integration instance was created.
  - `updated_at` string, date-time, nullable: ISO-8601 timestamp of the most recent update to this instance.
  - `created_by` string, nullable: UUID of the user who created this integration instance, if known.
  - `last_health_check` HealthCheckResponse: Aggregate result of an integration's connection health check.
    - `status` 'pending' | 'connected' | 'partial' | 'failed', required: Overall status of a connection health check.
    - `steps` HealthCheckStepResponse[], required
      - `step` 'connectivity' | 'auth' | 'query', required: Identifies which health check step a result is for.
      - `passed` boolean, required
      - `message` string, required
      - `details` object
    - `checked_at` string, date-time, required
  - `connector_id` string, nullable: UUID of the org connector this instance routes through. Null when the instance connects over the public internet.
  - `network_access` string, nullable: Name of the network this integration connects through (e.g. an internal VPN). Null when the integration connects over the public internet.
  - `environment_labels` string[]: The customer's own names for the environments this integration's data covers, e.g. ``["prod", "staging"]``, normalized to lowercase. Empty when the instance has none. The single reserved value ``"unscoped"`` means the data is deliberately not split by environment, which is distinct from the empty list meaning nobody has labelled it yet.

## Other responses

- `422`: Validation Error

## Changes

> 66 revisions in range; 9 not diffed.

- **2026-10-06** `31e1a8b7cf89`: 1 warning, 4 info
  - added the new `azure` enum value to the `type` response property for the response status `201`
  - the `enabled_data_types` request property default value changed from `logs, metrics` to `metrics, logs`
  - the `enabled_data_types` request property default value changed from `logs, traces, metrics` to `metrics, logs, traces`
  - added `azure` discriminator mapping keys to the `integration` request property
  - …1 more
- **2026-10-05** `88beb50883b9`: 2 info
  - the `enabled_data_types` request property default value changed from `metrics, logs` to `logs, metrics`
  - the `enabled_data_types` request property default value changed from `metrics, traces, logs` to `logs, traces, metrics`
- **2026-10-03** `609da234e5da`: 2 info
  - the `enabled_data_types` request property default value changed from `logs, metrics` to `metrics, logs`
  - the `enabled_data_types` request property default value changed from `logs, metrics, traces` to `metrics, traces, logs`
- **2026-10-02** `53b6ebae31bc`: 2 info
  - the `enabled_data_types` request property default value changed from `metrics, logs` to `logs, metrics`
  - the `enabled_data_types` request property default value changed from `traces, metrics, logs` to `logs, metrics, traces`
- …earlier changes not shown

[Operation history](https://skmtc.dev/traversal/apis/traversal-api/changes/v3/integrations/post.md)

---

[API](https://skmtc.dev/traversal/apis/traversal-api.md) - [All operations](https://skmtc.dev/traversal/apis/traversal-api/llms.txt) - [OpenAPI document](https://skmtc.dev/traversal/apis/traversal-api/revisions/31e1a8b7cf89?raw)