Skip to main content
Connect a provider account

Authorizations

Authorization
string
header
required

BoxRouter API key; never an upstream provider key.

Headers

Idempotency-Key
string

Optional for this operation. Preserve the same stable identifier when retrying an uncertain response; never reuse it for new work. If omitted where allowed, Cloud generates a request-scoped key that cannot reconcile a later retry. Do not include credentials or payloads. Stable identifier for one logical mutation.

Required string length: 1 - 128

Body

application/json
name
string
required
Required string length: 1 - 100
Pattern: ^[^\u0000]*$
credentials
object
required

One provider's account credentials as flat fields. provider names an available provider (available_providers of listProviderAccounts); every other property is one of that provider's credential_fields. A required field is a nonempty string; an optional field is a string or null, and null is the same as leaving it out. Secret values contain 12 through 16384 characters and identifiers 1 through 256. A field the provider does not declare, a missing or null required field, or a value of another type is rejected; errors name the field, never its value. Accepted only on credential-management endpoints, over TLS. Write-only and encrypted at rest. Never logged or returned.

Response

Connected-account record, without credentials.

id
string
required
name
string
required
provider
string
required
status
string
required

Known states are pending, enabled, invalid_credentials, credentials_rejected and unavailable. Pending is a legacy state for an account saved before provider approval. Enabled means hosted BYOK is approved and the provider did not reject the credentials when they were saved. invalid_credentials and unavailable remain readable for older records. credentials_rejected means a later provider call rejected the saved access; credential_failure gives a safe cause and the action needed to restore it.

settings
object
required

Non-secret credential fields saved with the credentials, named as in credential_fields. Legacy accounts may return an empty object. Secrets are never returned; credential_hints may return the last four characters and credential_prefixes only a declared public prefix.

credential_version
integer
required

Monotonic version. Contains no key material or key fingerprint; credential_hints and credential_prefixes may return only the last four characters and a declared public prefix, respectively.

Required range: x >= 1
credential_hints
object

Last four characters of saved secret credential fields that contain at least 12 characters. No other key material is returned.

credential_prefixes
object

Declared public prefixes for saved secret credential fields, returned only when the saved value starts with the declared prefix and at least eight characters remain hidden before the last four. No other key material is returned.

credential_failure
object | null

Present when a later provider call rejected the saved credentials or access.

standard_image
object
disconnect
object | null

A removal accepted with wait=false that is still running or was refused; null otherwise.

warnings
object[]

Notices about this connect. Present only on the response that created the account, and only when there is something to say.