<!-- llms.txt: https://workos.com/llms.txt -->
<!-- feedback.md: https://workos.com/docs/feedback.md -->

# Data providers

Browse the data providers configured in the environment, manage which ones the organization can use, and connect or disconnect the authenticated user's own accounts.

## List an organization's configurable data providers

List the data providers the token's organization can configure for its members, with the organization's current configuration of each.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query ConfigurableDataProviders($after: String, $before: String, $limit: Int, $order: PaginationOrder) {
  configurableDataProviders(after: $after, before: $before, limit: $limit, order: $order) {
    data {
      authMethods
      availableScopes
      config {
        name
        value
      }
      configFields {
        default
        description
        example
        key
        label
        order
        pattern
        patternFlags
        required
        scope
        secret
      }
      createdAt
      credentials {
        clientId
        credentialsType
        hasCredentials
        redactedClientSecret
        redirectUri
      }
      credentialsType
      defaultScopes
      description
      enabled
      iconDarkUrl
      iconSlug
      iconUrl
      id
      integrationType
      name
      scopes
      slug
      state
      updatedAt
    }
    listMetadata {
      after
      before
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "configurableDataProviders": {
      "data": [
        {
          "authMethods": [
            "authMethods_example"
          ],
          "availableScopes": [
            "availableScopes_example"
          ],
          "config": [
            {
              "name": "name_example",
              "value": "value_example"
            }
          ],
          "configFields": [
            {
              "default": "default_example",
              "description": "description_example",
              "example": "example_example",
              "key": "key_example",
              "label": "label_example",
              "order": 10,
              "pattern": "pattern_example",
              "patternFlags": "patternFlags_example",
              "required": true,
              "scope": "scope_example",
              "secret": true
            }
          ],
          "createdAt": "2024-01-01T00:00:00.000Z",
          "credentials": {
            "clientId": "clientId_example",
            "credentialsType": "credentialsType_example",
            "hasCredentials": true,
            "redactedClientSecret": "redactedClientSecret_example",
            "redirectUri": "redirectUri_example"
          },
          "credentialsType": "credentialsType_example",
          "defaultScopes": [
            "defaultScopes_example"
          ],
          "description": "description_example",
          "enabled": true,
          "iconDarkUrl": "iconDarkUrl_example",
          "iconSlug": "iconSlug_example",
          "iconUrl": "iconUrl_example",
          "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "integrationType": "integrationType_example",
          "name": "name_example",
          "scopes": [
            "scopes_example"
          ],
          "slug": "slug_example",
          "state": "state_example",
          "updatedAt": "2024-01-01T00:00:00.000Z"
        }
      ],
      "listMetadata": {
        "after": "after_example",
        "before": "before_example"
      }
    }
  }
}
```

:::

## Connect a data provider with client credentials

Connect the authenticated user to a data provider with OAuth client credentials the user supplies. Replaces the credentials when the user already has a client-credentials connection to the data provider, so this is both the connect and the reconnect path. The credentials are stored encrypted and never returned.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation ConnectDataProviderWithClientCredentials($input: ConnectDataProviderWithClientCredentialsInput!) {
  connectDataProviderWithClientCredentials(input: $input) {
    __typename
    ... on DataProviderAuthMethodUnsupported {
      authMethod
      supportedAuthMethods
    }
    ... on DataProviderConfigInvalid {
      message
    }
    ... on DataProviderConnected {
      connection {
        accountDisplayName
        accountIdentifier
        apiKeyLast4
        authMethod
        availability
        clientId
        clientSecretLast4
        connectionRole
        createdAt
        dataProviderId
        dataProviderSlug
        establishedByUserId
        id
        organizationId
        scopes
        state
        stateReason
        updatedAt
        userId
      }
    }
    ... on DataProviderConnectionAuthMethodConflict {
      existingAuthMethod
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "connectDataProviderWithClientCredentials": {
      "__typename": "DataProviderAuthMethodUnsupported",
      "authMethod": "authMethod_example",
      "supportedAuthMethods": [
        "supportedAuthMethods_example"
      ]
    }
  }
}
```

:::

## Connect an organization data provider with client credentials

Connect the token's organization to an organization-owned data provider with OAuth client credentials, producing one connection shared by every member. Replaces the credentials when the organization already has a client-credentials connection to the data provider, so this is both the connect and the reconnect path. The credentials are stored encrypted and never returned.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation ConnectOrganizationDataProviderWithClientCredentials($input: ConnectOrganizationDataProviderWithClientCredentialsInput!) {
  connectOrganizationDataProviderWithClientCredentials(input: $input) {
    __typename
    ... on DataProviderAuthMethodUnsupported {
      authMethod
      supportedAuthMethods
    }
    ... on DataProviderConfigInvalid {
      message
    }
    ... on DataProviderConnected {
      connection {
        accountDisplayName
        accountIdentifier
        apiKeyLast4
        authMethod
        availability
        clientId
        clientSecretLast4
        connectionRole
        createdAt
        dataProviderId
        dataProviderSlug
        establishedByUserId
        id
        organizationId
        scopes
        state
        stateReason
        updatedAt
        userId
      }
    }
    ... on DataProviderConnectionAuthMethodConflict {
      existingAuthMethod
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "connectOrganizationDataProviderWithClientCredentials": {
      "__typename": "DataProviderAuthMethodUnsupported",
      "authMethod": "authMethod_example",
      "supportedAuthMethods": [
        "supportedAuthMethods_example"
      ]
    }
  }
}
```

:::

## Start a data provider authorization

Start an OAuth authorization connecting the authenticated user to a data provider. Returns the URL to open in a popup and the `state` to poll with `dataProviderAuthorizationStatus`. Re-authorizing a provider the user is already connected to replaces that connection's credentials once the flow completes, so this is also the reconnect path.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation CreateDataProviderAuthorization($input: CreateDataProviderAuthorizationInput!) {
  createDataProviderAuthorization(input: $input) {
    __typename
    ... on DataProviderAuthorization {
      handoffToken
      redirectToken
      state
      url
    }
    ... on DataProviderAuthorizationUnavailable {
      message
    }
    ... on DataProviderConfigInvalid {
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "createDataProviderAuthorization": {
      "__typename": "DataProviderAuthorization",
      "handoffToken": "handoffToken_example",
      "redirectToken": "redirectToken_example",
      "state": "state_example",
      "url": "url_example"
    }
  }
}
```

:::

## Connect a data provider

Connect the authenticated user to a data provider with an API key the user supplies. Replaces the API key when the user already has an API-key connection to the data provider.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation CreateDataProviderConnection($input: CreateDataProviderConnectionInput!) {
  createDataProviderConnection(input: $input) {
    accountDisplayName
    accountIdentifier
    apiKeyLast4
    authMethod
    availability
    capabilities {
      canReauthorize
      canUpdateCredentials
    }
    clientId
    clientSecretLast4
    config {
      name
      value
    }
    connectionRole
    createdAt
    dataProviderId
    dataProviderSlug
    establishedByUserId
    id
    organizationId
    scopes
    state
    stateReason
    updatedAt
    userId
    warnings {
      code
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "createDataProviderConnection": {
      "accountDisplayName": "accountDisplayName_example",
      "accountIdentifier": "accountIdentifier_example",
      "apiKeyLast4": "apiKeyLast4_example",
      "authMethod": "authMethod_example",
      "availability": "availability_example",
      "capabilities": null,
      "clientId": "clientId_example",
      "clientSecretLast4": "clientSecretLast4_example",
      "config": [
        {
          "name": "name_example",
          "value": "value_example"
        }
      ],
      "connectionRole": "Compatibility",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "dataProviderSlug": "dataProviderSlug_example",
      "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "scopes": [
        "scopes_example"
      ],
      "state": "state_example",
      "stateReason": "stateReason_example",
      "updatedAt": "2024-01-01T00:00:00.000Z",
      "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "warnings": [
        {
          "code": "duplicate_account_display_name",
          "message": "Another connection for this provider and owner has the same label."
        }
      ]
    }
  }
}
```

:::

## Start an organization data provider authorization

Start an OAuth authorization connecting the token's organization to an organization-owned data provider, producing one connection shared by every member. A handoff is always required: the member completing the flow must confirm it explicitly because the resulting connection is not their own.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation CreateOrganizationDataProviderAuthorization($input: CreateOrganizationDataProviderAuthorizationInput!) {
  createOrganizationDataProviderAuthorization(input: $input) {
    __typename
    ... on DataProviderAuthorization {
      handoffToken
      redirectToken
      state
      url
    }
    ... on DataProviderAuthorizationUnavailable {
      message
    }
    ... on DataProviderConfigInvalid {
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "createOrganizationDataProviderAuthorization": {
      "__typename": "DataProviderAuthorization",
      "handoffToken": "handoffToken_example",
      "redirectToken": "redirectToken_example",
      "state": "state_example",
      "url": "url_example"
    }
  }
}
```

:::

## Connect an organization data provider

Connect the token's organization to an organization-owned data provider with an API key, producing one connection shared by every member. Replaces the API key when the organization already has an API-key connection to the data provider.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation CreateOrganizationDataProviderConnection($input: CreateOrganizationDataProviderConnectionInput!) {
  createOrganizationDataProviderConnection(input: $input) {
    accountDisplayName
    accountIdentifier
    apiKeyLast4
    authMethod
    availability
    capabilities {
      canReauthorize
      canUpdateCredentials
    }
    clientId
    clientSecretLast4
    config {
      name
      value
    }
    connectionRole
    createdAt
    dataProviderId
    dataProviderSlug
    establishedByUserId
    id
    organizationId
    scopes
    state
    stateReason
    updatedAt
    userId
    warnings {
      code
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "createOrganizationDataProviderConnection": {
      "accountDisplayName": "accountDisplayName_example",
      "accountIdentifier": "accountIdentifier_example",
      "apiKeyLast4": "apiKeyLast4_example",
      "authMethod": "authMethod_example",
      "availability": "availability_example",
      "capabilities": {
        "canReauthorize": false,
        "canUpdateCredentials": true
      },
      "clientId": "clientId_example",
      "clientSecretLast4": "clientSecretLast4_example",
      "config": [
        {
          "name": "name_example",
          "value": "value_example"
        }
      ],
      "connectionRole": "Compatibility",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "dataProviderSlug": "dataProviderSlug_example",
      "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "scopes": [
        "scopes_example"
      ],
      "state": "state_example",
      "stateReason": "stateReason_example",
      "updatedAt": "2024-01-01T00:00:00.000Z",
      "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "warnings": [
        {
          "code": "duplicate_account_display_name",
          "message": "Another connection for this provider and owner has the same label."
        }
      ]
    }
  }
}
```

:::

## Get an authorization status

Report whether an authorization attempt is still outstanding. Poll this with the `state` returned when the authorization was created while the popup is open; it flips to `connecting: false` once the provider callback has been handled or the attempt expired.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query DataProviderAuthorizationStatus($dataProviderId: ID!, $state: String!) {
  dataProviderAuthorizationStatus(dataProviderId: $dataProviderId, state: $state) {
    connecting
    state
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "dataProviderAuthorizationStatus": {
      "connecting": true,
      "state": "state_example"
    }
  }
}
```

:::

## Get a data provider connection

Return one of the authenticated user's data provider connections by ID.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query DataProviderConnection($id: ID!) {
  dataProviderConnection(id: $id) {
    accountDisplayName
    accountIdentifier
    apiKeyLast4
    authMethod
    availability
    capabilities {
      canReauthorize
      canUpdateCredentials
    }
    clientId
    clientSecretLast4
    config {
      name
      value
    }
    connectionRole
    createdAt
    dataProviderId
    dataProviderSlug
    establishedByUserId
    id
    organizationId
    scopes
    state
    stateReason
    updatedAt
    userId
    warnings {
      code
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "dataProviderConnection": {
      "accountDisplayName": "accountDisplayName_example",
      "accountIdentifier": "accountIdentifier_example",
      "apiKeyLast4": "apiKeyLast4_example",
      "authMethod": "authMethod_example",
      "availability": "availability_example",
      "capabilities": null,
      "clientId": "clientId_example",
      "clientSecretLast4": "clientSecretLast4_example",
      "config": [
        {
          "name": "name_example",
          "value": "value_example"
        }
      ],
      "connectionRole": "Compatibility",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "dataProviderSlug": "dataProviderSlug_example",
      "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "scopes": [
        "scopes_example"
      ],
      "state": "state_example",
      "stateReason": "stateReason_example",
      "updatedAt": "2024-01-01T00:00:00.000Z",
      "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "warnings": null
    }
  }
}
```

:::

## List data provider connections

List the authenticated user's data provider connections, including their status.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query DataProviderConnections($after: String, $before: String, $limit: Int, $order: PaginationOrder) {
  dataProviderConnections(after: $after, before: $before, limit: $limit, order: $order) {
    data {
      accountDisplayName
      accountIdentifier
      apiKeyLast4
      authMethod
      availability
      capabilities {
        canReauthorize
        canUpdateCredentials
      }
      clientId
      clientSecretLast4
      config {
        name
        value
      }
      connectionRole
      createdAt
      dataProviderId
      dataProviderSlug
      establishedByUserId
      id
      organizationId
      scopes
      state
      stateReason
      updatedAt
      userId
      warnings {
        code
        message
      }
    }
    listMetadata {
      after
      before
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "dataProviderConnections": {
      "data": [
        {
          "accountDisplayName": "accountDisplayName_example",
          "accountIdentifier": "accountIdentifier_example",
          "apiKeyLast4": "apiKeyLast4_example",
          "authMethod": "authMethod_example",
          "availability": "availability_example",
          "capabilities": null,
          "clientId": "clientId_example",
          "clientSecretLast4": "clientSecretLast4_example",
          "config": [
            {
              "name": "name_example",
              "value": "value_example"
            }
          ],
          "connectionRole": "Compatibility",
          "createdAt": "2024-01-01T00:00:00.000Z",
          "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "dataProviderSlug": "dataProviderSlug_example",
          "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "scopes": [
            "scopes_example"
          ],
          "state": "state_example",
          "stateReason": "stateReason_example",
          "updatedAt": "2024-01-01T00:00:00.000Z",
          "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "warnings": null
        }
      ],
      "listMetadata": {
        "after": "after_example",
        "before": "before_example"
      }
    }
  }
}
```

:::

## Get a data provider

Return a data provider by ID within the token's environment.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query DataProvider($id: ID!) {
  dataProvider(id: $id) {
    authMethods
    capabilities {
      addConnectionMethods
      canAddConnection
    }
    config {
      name
      value
    }
    configFields {
      default
      description
      example
      key
      label
      order
      pattern
      patternFlags
      required
      scope
      secret
    }
    createdAt
    credentialsType
    description
    enabled
    iconDarkUrl
    iconSlug
    iconUrl
    id
    integrationType
    name
    scopes
    slug
    state
    updatedAt
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "dataProvider": {
      "authMethods": [
        "authMethods_example"
      ],
      "capabilities": {
        "addConnectionMethods": [
          "api_key"
        ],
        "canAddConnection": true
      },
      "config": [
        {
          "name": "name_example",
          "value": "value_example"
        }
      ],
      "configFields": [
        {
          "default": "default_example",
          "description": "description_example",
          "example": "example_example",
          "key": "key_example",
          "label": "label_example",
          "order": 10,
          "pattern": "pattern_example",
          "patternFlags": "patternFlags_example",
          "required": true,
          "scope": "scope_example",
          "secret": true
        }
      ],
      "createdAt": "2024-01-01T00:00:00.000Z",
      "credentialsType": "credentialsType_example",
      "description": "description_example",
      "enabled": true,
      "iconDarkUrl": "iconDarkUrl_example",
      "iconSlug": "iconSlug_example",
      "iconUrl": "iconUrl_example",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "integrationType": "integrationType_example",
      "name": "name_example",
      "scopes": [
        "scopes_example"
      ],
      "slug": "slug_example",
      "state": "state_example",
      "updatedAt": "2024-01-01T00:00:00.000Z"
    }
  }
}
```

:::

## List data providers

List the data providers configured in the token's environment.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query DataProviders($after: String, $before: String, $limit: Int, $order: PaginationOrder) {
  dataProviders(after: $after, before: $before, limit: $limit, order: $order) {
    data {
      authMethods
      capabilities {
        addConnectionMethods
        canAddConnection
      }
      config {
        name
        value
      }
      configFields {
        default
        description
        example
        key
        label
        order
        pattern
        patternFlags
        required
        scope
        secret
      }
      createdAt
      credentialsType
      description
      enabled
      iconDarkUrl
      iconSlug
      iconUrl
      id
      integrationType
      name
      scopes
      slug
      state
      updatedAt
    }
    listMetadata {
      after
      before
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "dataProviders": {
      "data": [
        {
          "authMethods": [
            "authMethods_example"
          ],
          "capabilities": {
            "addConnectionMethods": [
              "api_key"
            ],
            "canAddConnection": true
          },
          "config": [
            {
              "name": "name_example",
              "value": "value_example"
            }
          ],
          "configFields": [
            {
              "default": "default_example",
              "description": "description_example",
              "example": "example_example",
              "key": "key_example",
              "label": "label_example",
              "order": 10,
              "pattern": "pattern_example",
              "patternFlags": "patternFlags_example",
              "required": true,
              "scope": "scope_example",
              "secret": true
            }
          ],
          "createdAt": "2024-01-01T00:00:00.000Z",
          "credentialsType": "credentialsType_example",
          "description": "description_example",
          "enabled": true,
          "iconDarkUrl": "iconDarkUrl_example",
          "iconSlug": "iconSlug_example",
          "iconUrl": "iconUrl_example",
          "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "integrationType": "integrationType_example",
          "name": "name_example",
          "scopes": [
            "scopes_example"
          ],
          "slug": "slug_example",
          "state": "state_example",
          "updatedAt": "2024-01-01T00:00:00.000Z"
        }
      ],
      "listMetadata": {
        "after": "after_example",
        "before": "before_example"
      }
    }
  }
}
```

:::

## Disconnect a data provider

Disconnect one of the authenticated user's data provider connections, revoking the stored credentials.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation DeleteDataProviderConnection($id: ID!) {
  deleteDataProviderConnection(id: $id)
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "deleteDataProviderConnection": "deleteDataProviderConnection_01EHWNCE74X7JSDV0X3SZ3KJNY"
  }
}
```

:::

## Disconnect an organization data provider

Disconnect one of the token organization's shared data provider connections, revoking the stored credentials for every member.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation DeleteOrganizationDataProviderConnection($id: ID!) {
  deleteOrganizationDataProviderConnection(id: $id)
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "deleteOrganizationDataProviderConnection": "deleteOrganizationDataProviderConnection_01EHWNCE74X7JSDV0X3SZ3KJNY"
  }
}
```

:::

## List an organization's data providers

List the data providers the token's organization connects on behalf of all its members, with the organization's shared connection when it has one.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query OrganizationDataProviders($after: String, $before: String, $limit: Int, $order: PaginationOrder) {
  organizationDataProviders(after: $after, before: $before, limit: $limit, order: $order) {
    data {
      authMethods
      availableScopes
      capabilities {
        addConnectionMethods
        canAddConnection
        canConfigure
        canConnect
        canDisconnect
        canReauthorize
        canUpdateCredentials
      }
      config {
        name
        value
      }
      configFields {
        default
        description
        example
        key
        label
        order
        pattern
        patternFlags
        required
        scope
        secret
      }
      configured
      connectedAccounts {
        accountDisplayName
        accountIdentifier
        apiKeyLast4
        authMethod
        availability
        clientId
        clientSecretLast4
        connectionRole
        createdAt
        dataProviderId
        dataProviderSlug
        establishedByUserId
        id
        organizationId
        scopes
        state
        stateReason
        updatedAt
        userId
      }
      connection {
        accountDisplayName
        accountIdentifier
        apiKeyLast4
        authMethod
        availability
        clientId
        clientSecretLast4
        connectionRole
        createdAt
        dataProviderId
        dataProviderSlug
        establishedByUserId
        id
        organizationId
        scopes
        state
        stateReason
        updatedAt
        userId
      }
      createdAt
      credentials {
        clientId
        credentialsType
        hasCredentials
        redactedClientSecret
        redirectUri
      }
      credentialsType
      defaultScopes
      description
      disabledSource
      enabled
      hasCredentials
      iconDarkUrl
      iconSlug
      iconUrl
      id
      integrationType
      name
      scopes
      slug
      state
      updatedAt
    }
    listMetadata {
      after
      before
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "organizationDataProviders": {
      "data": [
        {
          "authMethods": [
            "authMethods_example"
          ],
          "availableScopes": [
            "availableScopes_example"
          ],
          "capabilities": {
            "addConnectionMethods": [
              "api_key"
            ],
            "canAddConnection": true,
            "canConfigure": true,
            "canConnect": true,
            "canDisconnect": true,
            "canReauthorize": true,
            "canUpdateCredentials": true
          },
          "config": [
            {
              "name": "name_example",
              "value": "value_example"
            }
          ],
          "configFields": [
            {
              "default": "default_example",
              "description": "description_example",
              "example": "example_example",
              "key": "key_example",
              "label": "label_example",
              "order": 10,
              "pattern": "pattern_example",
              "patternFlags": "patternFlags_example",
              "required": true,
              "scope": "scope_example",
              "secret": true
            }
          ],
          "configured": true,
          "connectedAccounts": [
            {
              "accountDisplayName": "accountDisplayName_example",
              "accountIdentifier": "accountIdentifier_example",
              "apiKeyLast4": "apiKeyLast4_example",
              "authMethod": "authMethod_example",
              "availability": "availability_example",
              "clientId": "clientId_example",
              "clientSecretLast4": "clientSecretLast4_example",
              "connectionRole": "Compatibility",
              "createdAt": "2024-01-01T00:00:00.000Z",
              "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "dataProviderSlug": "dataProviderSlug_example",
              "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "scopes": [
                "scopes_example"
              ],
              "state": "state_example",
              "stateReason": "stateReason_example",
              "updatedAt": "2024-01-01T00:00:00.000Z",
              "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "warnings": null
            }
          ],
          "connection": {
            "accountDisplayName": "accountDisplayName_example",
            "accountIdentifier": "accountIdentifier_example",
            "apiKeyLast4": "apiKeyLast4_example",
            "authMethod": "authMethod_example",
            "availability": "availability_example",
            "clientId": "clientId_example",
            "clientSecretLast4": "clientSecretLast4_example",
            "connectionRole": "Compatibility",
            "createdAt": "2024-01-01T00:00:00.000Z",
            "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
            "dataProviderSlug": "dataProviderSlug_example",
            "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
            "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
            "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
            "scopes": [
              "scopes_example"
            ],
            "state": "state_example",
            "stateReason": "stateReason_example",
            "updatedAt": "2024-01-01T00:00:00.000Z",
            "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
            "warnings": null
          },
          "createdAt": "2024-01-01T00:00:00.000Z",
          "credentials": {
            "clientId": "clientId_example",
            "credentialsType": "credentialsType_example",
            "hasCredentials": true,
            "redactedClientSecret": "redactedClientSecret_example",
            "redirectUri": "redirectUri_example"
          },
          "credentialsType": "credentialsType_example",
          "defaultScopes": [
            "defaultScopes_example"
          ],
          "description": "description_example",
          "disabledSource": "disabledSource_example",
          "enabled": true,
          "hasCredentials": true,
          "iconDarkUrl": "iconDarkUrl_example",
          "iconSlug": "iconSlug_example",
          "iconUrl": "iconUrl_example",
          "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "integrationType": "integrationType_example",
          "name": "name_example",
          "scopes": [
            "scopes_example"
          ],
          "slug": "slug_example",
          "state": "state_example",
          "updatedAt": "2024-01-01T00:00:00.000Z"
        }
      ],
      "listMetadata": {
        "after": "after_example",
        "before": "before_example"
      }
    }
  }
}
```

:::

## Set a data provider's configuration

Write a data provider's configuration for the token's organization: whether the organization's members can connect it, the scopes it requests, the organization's own OAuth client credentials, and any non-secret configuration values the provider declares. Fields left out are unchanged. Supersedes `setDataProviderEnabled` for anything beyond toggling `enabled`.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation SetDataProviderConfiguration($input: SetDataProviderConfigurationInput!) {
  setDataProviderConfiguration(input: $input) {
    __typename
    ... on DataProviderConfigInvalid {
      message
    }
    ... on DataProviderConfiguration {
      availableScopes
      config {
        name
        value
      }
      dataProviderId
      dataProviderSlug
      enabled
      hasCredentials
      organizationId
      scopes
      updatedAt
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "setDataProviderConfiguration": {
      "__typename": "DataProviderConfigInvalid",
      "message": "message_example"
    }
  }
}
```

:::

## Enable or disable a data provider

Enable or disable a data provider for the token's organization. Disabling it hides the data provider from the organization's users and stops new connections; existing connections stay readable so they can be disconnected.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation SetDataProviderEnabled($input: SetDataProviderEnabledInput!) {
  setDataProviderEnabled(input: $input) {
    authMethods
    capabilities {
      addConnectionMethods
      canAddConnection
    }
    config {
      name
      value
    }
    configFields {
      default
      description
      example
      key
      label
      order
      pattern
      patternFlags
      required
      scope
      secret
    }
    createdAt
    credentialsType
    description
    enabled
    iconDarkUrl
    iconSlug
    iconUrl
    id
    integrationType
    name
    scopes
    slug
    state
    updatedAt
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "setDataProviderEnabled": {
      "authMethods": [
        "authMethods_example"
      ],
      "capabilities": {
        "addConnectionMethods": [
          "api_key"
        ],
        "canAddConnection": true
      },
      "config": [
        {
          "name": "name_example",
          "value": "value_example"
        }
      ],
      "configFields": [
        {
          "default": "default_example",
          "description": "description_example",
          "example": "example_example",
          "key": "key_example",
          "label": "label_example",
          "order": 10,
          "pattern": "pattern_example",
          "patternFlags": "patternFlags_example",
          "required": true,
          "scope": "scope_example",
          "secret": true
        }
      ],
      "createdAt": "2024-01-01T00:00:00.000Z",
      "credentialsType": "credentialsType_example",
      "description": "description_example",
      "enabled": true,
      "iconDarkUrl": "iconDarkUrl_example",
      "iconSlug": "iconSlug_example",
      "iconUrl": "iconUrl_example",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "integrationType": "integrationType_example",
      "name": "name_example",
      "scopes": [
        "scopes_example"
      ],
      "slug": "slug_example",
      "state": "state_example",
      "updatedAt": "2024-01-01T00:00:00.000Z"
    }
  }
}
```

:::

## Set an organization data provider's configuration

Write an organization-owned data provider's configuration for the token's organization: whether the organization's shared connection is enabled, the scopes it requests, the organization's own OAuth client credentials, and any non-secret configuration values the provider declares. Fields left out are unchanged.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation SetOrganizationDataProviderConfiguration($input: SetOrganizationDataProviderConfigurationInput!) {
  setOrganizationDataProviderConfiguration(input: $input) {
    __typename
    ... on DataProviderConfigInvalid {
      message
    }
    ... on DataProviderConfiguration {
      availableScopes
      config {
        name
        value
      }
      dataProviderId
      dataProviderSlug
      enabled
      hasCredentials
      organizationId
      scopes
      updatedAt
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "setOrganizationDataProviderConfiguration": {
      "__typename": "DataProviderConfigInvalid",
      "message": "message_example"
    }
  }
}
```

:::

## List an organization's shared data providers

List the data providers the token's organization has connected for all its members, with the shared connections the caller may use. Available to any active member of the organization.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query SharedDataProviders($after: String, $before: String, $limit: Int, $order: PaginationOrder, $supportsMultipleConnections: Boolean) {
  sharedDataProviders(after: $after, before: $before, limit: $limit, order: $order, supportsMultipleConnections: $supportsMultipleConnections) {
    data {
      connectedAccounts {
        authMethod
        availability
        connectionRole
        createdAt
        dataProviderId
        dataProviderSlug
        id
        state
        updatedAt
      }
      createdAt
      description
      iconDarkUrl
      iconSlug
      iconUrl
      id
      integrationType
      name
      slug
      updatedAt
    }
    listMetadata {
      after
      before
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "sharedDataProviders": {
      "data": [
        {
          "connectedAccounts": [
            {
              "authMethod": "authMethod_example",
              "availability": "availability_example",
              "connectionRole": "Compatibility",
              "createdAt": "2024-01-01T00:00:00.000Z",
              "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "dataProviderSlug": "dataProviderSlug_example",
              "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
              "state": "state_example",
              "updatedAt": "2024-01-01T00:00:00.000Z"
            }
          ],
          "createdAt": "2024-01-01T00:00:00.000Z",
          "description": "description_example",
          "iconDarkUrl": "iconDarkUrl_example",
          "iconSlug": "iconSlug_example",
          "iconUrl": "iconUrl_example",
          "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "integrationType": "integrationType_example",
          "name": "name_example",
          "slug": "slug_example",
          "updatedAt": "2024-01-01T00:00:00.000Z"
        }
      ],
      "listMetadata": {
        "after": "after_example",
        "before": "before_example"
      }
    }
  }
}
```

:::

## Rename a data provider connection

Update the label of one of the authenticated user's exact connections in the token's organization scope, without changing credentials or identity. Duplicate labels produce advisory warnings, not errors.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation UpdateDataProviderConnectionLabel($input: UpdateDataProviderConnectionLabelInput!) {
  updateDataProviderConnectionLabel(input: $input) {
    connection {
      accountDisplayName
      accountIdentifier
      apiKeyLast4
      authMethod
      availability
      capabilities {
        canReauthorize
        canUpdateCredentials
      }
      clientId
      clientSecretLast4
      config {
        name
        value
      }
      connectionRole
      createdAt
      dataProviderId
      dataProviderSlug
      establishedByUserId
      id
      organizationId
      scopes
      state
      stateReason
      updatedAt
      userId
      warnings {
        code
        message
      }
    }
    warnings {
      code
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "updateDataProviderConnectionLabel": {
      "connection": {
        "accountDisplayName": "accountDisplayName_example",
        "accountIdentifier": "accountIdentifier_example",
        "apiKeyLast4": "apiKeyLast4_example",
        "authMethod": "authMethod_example",
        "availability": "availability_example",
        "capabilities": {
          "canReauthorize": false,
          "canUpdateCredentials": true
        },
        "clientId": "clientId_example",
        "clientSecretLast4": "clientSecretLast4_example",
        "config": [
          {
            "name": "name_example",
            "value": "value_example"
          }
        ],
        "connectionRole": "Compatibility",
        "createdAt": "2024-01-01T00:00:00.000Z",
        "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "dataProviderSlug": "dataProviderSlug_example",
        "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "scopes": [
          "scopes_example"
        ],
        "state": "state_example",
        "stateReason": "stateReason_example",
        "updatedAt": "2024-01-01T00:00:00.000Z",
        "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "warnings": null
      },
      "warnings": [
        {
          "code": "duplicate_account_display_name",
          "message": "Another connection for this provider and owner has the same label."
        }
      ]
    }
  }
}
```

:::

## Rename an organization data provider connection

Update the label of one of the token organization's exact shared connections without changing credentials or identity. Requires organization connection write permission; session users must be active members. Duplicate labels produce advisory warnings, not errors.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation UpdateOrganizationDataProviderConnectionLabel($input: UpdateDataProviderConnectionLabelInput!) {
  updateOrganizationDataProviderConnectionLabel(input: $input) {
    connection {
      accountDisplayName
      accountIdentifier
      apiKeyLast4
      authMethod
      availability
      capabilities {
        canReauthorize
        canUpdateCredentials
      }
      clientId
      clientSecretLast4
      config {
        name
        value
      }
      connectionRole
      createdAt
      dataProviderId
      dataProviderSlug
      establishedByUserId
      id
      organizationId
      scopes
      state
      stateReason
      updatedAt
      userId
      warnings {
        code
        message
      }
    }
    warnings {
      code
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "updateOrganizationDataProviderConnectionLabel": {
      "connection": {
        "accountDisplayName": "accountDisplayName_example",
        "accountIdentifier": "accountIdentifier_example",
        "apiKeyLast4": "apiKeyLast4_example",
        "authMethod": "authMethod_example",
        "availability": "availability_example",
        "capabilities": {
          "canReauthorize": false,
          "canUpdateCredentials": true
        },
        "clientId": "clientId_example",
        "clientSecretLast4": "clientSecretLast4_example",
        "config": [
          {
            "name": "name_example",
            "value": "value_example"
          }
        ],
        "connectionRole": "Compatibility",
        "createdAt": "2024-01-01T00:00:00.000Z",
        "dataProviderId": "dataProviderId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "dataProviderSlug": "dataProviderSlug_example",
        "establishedByUserId": "establishedByUserId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "organizationId": "organizationId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "scopes": [
          "scopes_example"
        ],
        "state": "state_example",
        "stateReason": "stateReason_example",
        "updatedAt": "2024-01-01T00:00:00.000Z",
        "userId": "userId_01EHWNCE74X7JSDV0X3SZ3KJNY",
        "warnings": null
      },
      "warnings": [
        {
          "code": "duplicate_account_display_name",
          "message": "Another connection for this provider and owner has the same label."
        }
      ]
    }
  }
}
```

:::

### Query configurableDataProviders

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `after` | String | No |  |
| `before` | String | No |  |
| `limit` | Int | No |  |
| `order` | PaginationOrder | No | Enum represents the pagination order. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data` | [ConfigurableDataProvider!]! | A data provider members connect individually, with the token's organization's configuration of it. |
| `listMetadata` | ListMetadata! |  |

### Mutation connectDataProviderWithClientCredentials

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A display name for the connection. Omit to preserve the existing label; null clears it. |
| `clientId` | String! | Yes | The OAuth client ID issued by the data provider. Only data providers whose `authMethods` include `client_credentials` can be connected this way. |
| `clientSecret` | String! | Yes | The OAuth client secret issued by the data provider. Write-only: it is stored encrypted and never returned. |
| `config` | [DataProviderConfigEntryInput!] | No | Values for the provider's connection configuration fields. |
| `connectedAccountId` | ID | No | The exact connection to reauthorize. Required with Reauthorize and forbidden otherwise. |
| `connectionIntent` | ConnectionIntent | No | Set to Add to create another connection. Omit for permanent compatibility behavior. When additional connections are unavailable for the environment, Add succeeds only when the owner has no connection for this data provider and otherwise fails with the error "Multiple connections are not available." Use canAddConnection and addConnectionMethods for current availability; writes recheck the provider, actor, gate, and connection cap. |
| `dataProviderId` | ID! | Yes | The data provider to connect the authenticated user to. |
| `idempotencyKey` | String | No | Makes retries of an Add return the connection the first attempt created instead of creating another. Reuse the same key for every retry of one user action. A matching retry within 24 hours returns the existing connection; reusing the key for a different owner, data provider, or authentication method, or after 24 hours while that connection exists, fails with idempotency_key_conflict. Ignored unless connectionIntent is Add. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `DataProviderAuthMethodUnsupported` | DataProviderAuthMethodUnsupported | The data provider cannot be connected the requested way — for example client credentials for a provider that only supports OAuth. |
| `DataProviderConfigInvalid` | DataProviderConfigInvalid | The supplied configuration does not satisfy the provider's declared fields. |
| `DataProviderConnected` | DataProviderConnected | The connection was created or its credentials were replaced. |
| `DataProviderConnectionAuthMethodConflict` | DataProviderConnectionAuthMethodConflict | The connection owner already has a connection to this data provider that authenticates differently, so it must be disconnected first. |

### Mutation connectOrganizationDataProviderWithClientCredentials

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A display name for the connection. Omit to preserve the existing label; null clears it. |
| `clientId` | String! | Yes | The OAuth client ID issued by the data provider. Only data providers whose `authMethods` include `client_credentials` can be connected this way. |
| `clientSecret` | String! | Yes | The OAuth client secret issued by the data provider, shared by every member of the organization. Write-only: it is stored encrypted and never returned. |
| `config` | [DataProviderConfigEntryInput!] | No | Values for the provider's connection configuration fields. |
| `connectedAccountId` | ID | No | The exact connection to reauthorize. Required with Reauthorize and forbidden otherwise. |
| `connectionIntent` | ConnectionIntent | No | Set to Add to create another connection. Omit for permanent compatibility behavior. When additional connections are unavailable for the environment, Add succeeds only when the owner has no connection for this data provider and otherwise fails with the error "Multiple connections are not available." Use canAddConnection and addConnectionMethods for current availability; writes recheck the provider, actor, gate, and connection cap. |
| `dataProviderId` | ID! | Yes | The organization-owned data provider to connect (`organizationDataProviders`). |
| `idempotencyKey` | String | No | Makes retries of an Add return the connection the first attempt created instead of creating another. Reuse the same key for every retry of one user action. A matching retry within 24 hours returns the existing connection; reusing the key for a different owner, data provider, or authentication method, or after 24 hours while that connection exists, fails with idempotency_key_conflict. Ignored unless connectionIntent is Add. |
| `userId` | ID | No | The organization member the credentials are attributed to. With a user session token, omit it to use the session user, or pass that same user; any other user is rejected. With an application credential token, it is required and must name an active member of the token organization. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `DataProviderAuthMethodUnsupported` | DataProviderAuthMethodUnsupported | The data provider cannot be connected the requested way — for example client credentials for a provider that only supports OAuth. |
| `DataProviderConfigInvalid` | DataProviderConfigInvalid | The supplied configuration does not satisfy the provider's declared fields. |
| `DataProviderConnected` | DataProviderConnected | The connection was created or its credentials were replaced. |
| `DataProviderConnectionAuthMethodConflict` | DataProviderConnectionAuthMethodConflict | The connection owner already has a connection to this data provider that authenticates differently, so it must be disconnected first. |

### Mutation createDataProviderAuthorization

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A display name for the connection. Omit to preserve the existing label; null clears it. |
| `config` | [DataProviderConfigEntryInput!] | No | Values for the provider's connect-time configuration fields. Omit when the provider declares none. |
| `connectedAccountId` | ID | No | The exact connection to reauthorize. Required with Reauthorize and forbidden otherwise. |
| `connectionIntent` | ConnectionIntent | No | Add another connection or reauthorize one exact connection. Omit for permanent compatibility behavior. When additional connections are unavailable for the environment, Add succeeds only when the owner has no connection for this data provider and otherwise returns DataProviderAuthorizationUnavailable. Use canAddConnection and addConnectionMethods for current availability; writes recheck the provider, actor, gate, and connection cap. |
| `dataProviderId` | ID! | Yes | The data provider to authorize for the authenticated user. It must be one the user can connect (`dataProviders`). |
| `requireHandoff` | Boolean | No | Request a confirmation step at the end of the flow, returning a `handoffToken` the client must complete. Defaults to false. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `DataProviderAuthorization` | DataProviderAuthorization | A started authorization: the URL to open and the state to poll while the user completes it. |
| `DataProviderAuthorizationUnavailable` | DataProviderAuthorizationUnavailable | The data provider cannot start an authorization right now — most often because the organization has not supplied its own OAuth credentials yet. |
| `DataProviderConfigInvalid` | DataProviderConfigInvalid | The supplied configuration does not satisfy the provider's declared fields. |

### Mutation createDataProviderConnection

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A display name for the connection. Omit to preserve the existing label; null clears it. |
| `apiKey` | String! | Yes | The API key issued by the data provider. Only data providers whose `authMethods` include `api_key` can be connected this way; OAuth providers are connected through the widget's authorization flow. |
| `connectedAccountId` | ID | No | The exact connection to reauthorize. Required with Reauthorize and forbidden otherwise. |
| `connectionIntent` | ConnectionIntent | No | Set to Add to create another connection. Omit for permanent compatibility behavior. When additional connections are unavailable for the environment, Add succeeds only when the owner has no connection for this data provider and otherwise fails with the error "Multiple connections are not available." Use canAddConnection and addConnectionMethods for current availability; writes recheck the provider, actor, gate, and connection cap. |
| `dataProviderId` | ID! | Yes | The data provider to connect the authenticated user to. |
| `idempotencyKey` | String | No | Makes retries of an Add return the connection the first attempt created instead of creating another. Reuse the same key for every retry of one user action. A matching retry within 24 hours returns the existing connection; reusing the key for a different owner, data provider, or authentication method, or after 24 hours while that connection exists, fails with idempotency_key_conflict. Ignored unless connectionIntent is Add. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `accountDisplayName` | String | A mutable, non-unique display name for this connection. |
| `accountIdentifier` | String | A best-effort provider account identifier used for correlation, not connection selection. |
| `apiKeyLast4` | String | The last four characters of the API key of an `api_key` connection, to recognise it by. The key itself is never returned. |
| `authMethod` | String! | How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. |
| `availability` | String! | Whether the connection can be used right now: `available`, or `needs_admin_attention` when it must be re-authorized first. |
| `capabilities` | DataProviderConnectionCapabilities | Actions available on this exact organization-owned connection. Null for user-owned connections; member row-action behavior is unchanged. |
| `clientId` | String | The OAuth client ID of a `client_credentials` connection. Null for other auth methods. |
| `clientSecretLast4` | String | The last four characters of the OAuth client secret of a `client_credentials` connection, to recognise it by. The secret itself is never returned. |
| `config` | [DataProviderConfigEntry!]! | The stored, provider-declared connection-scope configuration values for any authentication method, excluding secret fields. Empty when no stored values can be disclosed. |
| `connectionRole` | DataInstallationConnectionRole! | Whether this is the compatibility connection or a standard connection. |
| `createdAt` | DateTime! |  |
| `dataProviderId` | ID! | The data provider this connection was created for. |
| `dataProviderSlug` | String! | The slug of the connected data provider. |
| `establishedByUserId` | ID | The user whose authorization established the connection. Null when the connection is developer-managed or its establisher is unknown, and after the establishing member left the organization (see `stateReason`). |
| `id` | ID! |  |
| `organizationId` | ID |  |
| `scopes` | [String!]! | The OAuth scopes granted for this connection. |
| `state` | String! | The status of the connection: `connected` or `needs_reauthorization`. |
| `stateReason` | String | Why WorkOS put the connection in its current `state`, e.g. `establishing_member_membership_ended` when the member who established an organization-owned connection left the organization. Null when there is no WorkOS-recorded reason. Additional values may be added. |
| `updatedAt` | DateTime! |  |
| `userId` | ID |  |
| `warnings` | [DataProviderConnectionLabelWarning!] | Non-blocking warnings about the saved label from a credential write that supplied accountDisplayName. Empty when no duplicate exists; null on reads or when the label was omitted. |

### Mutation createOrganizationDataProviderAuthorization

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A display name for the connection. Omit to preserve the existing label; null clears it. |
| `config` | [DataProviderConfigEntryInput!] | No | Values for the provider's connect-time configuration fields. Omit when the provider declares none. |
| `connectedAccountId` | ID | No | The exact connection to reauthorize. Required with Reauthorize and forbidden otherwise. |
| `connectionIntent` | ConnectionIntent | No | Add another connection or reauthorize one exact connection. Omit for permanent compatibility behavior. When additional connections are unavailable for the environment, Add succeeds only when the owner has no connection for this data provider and otherwise returns DataProviderAuthorizationUnavailable. Use canAddConnection and addConnectionMethods for current availability; writes recheck the provider, actor, gate, and connection cap. |
| `dataProviderId` | ID! | Yes | The organization-owned data provider to authorize (`organizationDataProviders`). |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `DataProviderAuthorization` | DataProviderAuthorization | A started authorization: the URL to open and the state to poll while the user completes it. |
| `DataProviderAuthorizationUnavailable` | DataProviderAuthorizationUnavailable | The data provider cannot start an authorization right now — most often because the organization has not supplied its own OAuth credentials yet. |
| `DataProviderConfigInvalid` | DataProviderConfigInvalid | The supplied configuration does not satisfy the provider's declared fields. |

### Mutation createOrganizationDataProviderConnection

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A display name for the connection. Omit to preserve the existing label; null clears it. |
| `apiKey` | String! | Yes | The API key issued by the data provider, shared by every member of the organization. Only data providers whose `authMethods` include `api_key` can be connected this way. Write-only: it is stored encrypted and never returned. |
| `connectedAccountId` | ID | No | The exact connection to reauthorize. Required with Reauthorize and forbidden otherwise. |
| `connectionIntent` | ConnectionIntent | No | Set to Add to create another connection. Omit for permanent compatibility behavior. When additional connections are unavailable for the environment, Add succeeds only when the owner has no connection for this data provider and otherwise fails with the error "Multiple connections are not available." Use canAddConnection and addConnectionMethods for current availability; writes recheck the provider, actor, gate, and connection cap. |
| `dataProviderId` | ID! | Yes | The organization-owned data provider to connect (`organizationDataProviders`). |
| `idempotencyKey` | String | No | Makes retries of an Add return the connection the first attempt created instead of creating another. Reuse the same key for every retry of one user action. A matching retry within 24 hours returns the existing connection; reusing the key for a different owner, data provider, or authentication method, or after 24 hours while that connection exists, fails with idempotency_key_conflict. Ignored unless connectionIntent is Add. |
| `userId` | ID | No | The organization member the credentials are attributed to. With a user session token, omit it to use the session user, or pass that same user; any other user is rejected. With an application credential token, it is required and must name an active member of the token organization. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `accountDisplayName` | String | A mutable, non-unique display name for this connection. |
| `accountIdentifier` | String | A best-effort provider account identifier used for correlation, not connection selection. |
| `apiKeyLast4` | String | The last four characters of the API key of an `api_key` connection, to recognise it by. The key itself is never returned. |
| `authMethod` | String! | How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. |
| `availability` | String! | Whether the connection can be used right now: `available`, or `needs_admin_attention` when it must be re-authorized first. |
| `capabilities` | DataProviderConnectionCapabilities | Actions available on this exact organization-owned connection. Null for user-owned connections; member row-action behavior is unchanged. |
| `clientId` | String | The OAuth client ID of a `client_credentials` connection. Null for other auth methods. |
| `clientSecretLast4` | String | The last four characters of the OAuth client secret of a `client_credentials` connection, to recognise it by. The secret itself is never returned. |
| `config` | [DataProviderConfigEntry!]! | The stored, provider-declared connection-scope configuration values for any authentication method, excluding secret fields. Empty when no stored values can be disclosed. |
| `connectionRole` | DataInstallationConnectionRole! | Whether this is the compatibility connection or a standard connection. |
| `createdAt` | DateTime! |  |
| `dataProviderId` | ID! | The data provider this connection was created for. |
| `dataProviderSlug` | String! | The slug of the connected data provider. |
| `establishedByUserId` | ID | The user whose authorization established the connection. Null when the connection is developer-managed or its establisher is unknown, and after the establishing member left the organization (see `stateReason`). |
| `id` | ID! |  |
| `organizationId` | ID |  |
| `scopes` | [String!]! | The OAuth scopes granted for this connection. |
| `state` | String! | The status of the connection: `connected` or `needs_reauthorization`. |
| `stateReason` | String | Why WorkOS put the connection in its current `state`, e.g. `establishing_member_membership_ended` when the member who established an organization-owned connection left the organization. Null when there is no WorkOS-recorded reason. Additional values may be added. |
| `updatedAt` | DateTime! |  |
| `userId` | ID |  |
| `warnings` | [DataProviderConnectionLabelWarning!] | Non-blocking warnings about the saved label from a credential write that supplied accountDisplayName. Empty when no duplicate exists; null on reads or when the label was omitted. |

### Query dataProviderAuthorizationStatus

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `dataProviderId` | ID! | Yes | The data provider the authorization was started for. |
| `state` | String! | Yes | The `state` returned when the authorization was created. Must match exactly. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connecting` | Boolean! | True while the attempt is outstanding. It becomes false once the provider callback has been handled or the attempt expired, so a client that sees false reloads the connection to learn the outcome. |
| `state` | String! | The `state` that was polled. |

### Query dataProviderConnection

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | ID! | Yes |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `accountDisplayName` | String | A mutable, non-unique display name for this connection. |
| `accountIdentifier` | String | A best-effort provider account identifier used for correlation, not connection selection. |
| `apiKeyLast4` | String | The last four characters of the API key of an `api_key` connection, to recognise it by. The key itself is never returned. |
| `authMethod` | String! | How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. |
| `availability` | String! | Whether the connection can be used right now: `available`, or `needs_admin_attention` when it must be re-authorized first. |
| `capabilities` | DataProviderConnectionCapabilities | Actions available on this exact organization-owned connection. Null for user-owned connections; member row-action behavior is unchanged. |
| `clientId` | String | The OAuth client ID of a `client_credentials` connection. Null for other auth methods. |
| `clientSecretLast4` | String | The last four characters of the OAuth client secret of a `client_credentials` connection, to recognise it by. The secret itself is never returned. |
| `config` | [DataProviderConfigEntry!]! | The stored, provider-declared connection-scope configuration values for any authentication method, excluding secret fields. Empty when no stored values can be disclosed. |
| `connectionRole` | DataInstallationConnectionRole! | Whether this is the compatibility connection or a standard connection. |
| `createdAt` | DateTime! |  |
| `dataProviderId` | ID! | The data provider this connection was created for. |
| `dataProviderSlug` | String! | The slug of the connected data provider. |
| `establishedByUserId` | ID | The user whose authorization established the connection. Null when the connection is developer-managed or its establisher is unknown, and after the establishing member left the organization (see `stateReason`). |
| `id` | ID! |  |
| `organizationId` | ID |  |
| `scopes` | [String!]! | The OAuth scopes granted for this connection. |
| `state` | String! | The status of the connection: `connected` or `needs_reauthorization`. |
| `stateReason` | String | Why WorkOS put the connection in its current `state`, e.g. `establishing_member_membership_ended` when the member who established an organization-owned connection left the organization. Null when there is no WorkOS-recorded reason. Additional values may be added. |
| `updatedAt` | DateTime! |  |
| `userId` | ID |  |
| `warnings` | [DataProviderConnectionLabelWarning!] | Non-blocking warnings about the saved label from a credential write that supplied accountDisplayName. Empty when no duplicate exists; null on reads or when the label was omitted. |

### Query dataProviderConnections

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `after` | String | No |  |
| `before` | String | No |  |
| `limit` | Int | No |  |
| `order` | PaginationOrder | No | Enum represents the pagination order. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data` | [DataProviderConnection!]! | A connection between a data provider and a user or organization. |
| `listMetadata` | ListMetadata! |  |

### Query dataProvider

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | ID! | Yes |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authMethods` | [String!]! | How accounts authenticate with this data provider. |
| `capabilities` | DataProviderCapabilities! | Advisory explicit-add availability for the token-scoped owner. Writes still check authorization and creation policy. |
| `config` | [DataProviderConfigEntry!]! | The non-secret configuration values pinned for the token's organization (or by the developer, for a provider whose credentials the developer manages). |
| `configFields` | [DataProviderConfigField!]! | The configuration fields the provider declares. |
| `createdAt` | DateTime! |  |
| `credentialsType` | String! | Who supplies the OAuth application: `shared` (WorkOS), `custom` (the developer), or `organization` (the organization itself). |
| `description` | String |  |
| `enabled` | Boolean! | Whether the data provider is enabled for the token's organization: it must be enabled in the environment and not disabled by the organization's override. |
| `iconDarkUrl` | String | The URL of the provider logo for dark backgrounds, when one is served. |
| `iconSlug` | String | The slug of the provider's icon in the widget icon set. Falls back to the provider type. |
| `iconUrl` | String | The URL of the provider logo for light backgrounds, when one is served. |
| `id` | ID! |  |
| `integrationType` | String! | The provider type this data provider was created from. |
| `name` | String! | The display name of the data provider. |
| `scopes` | [String!] | The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. |
| `slug` | String! | The slug of the data provider. |
| `state` | String! | The configuration state of the data provider: `valid`, `invalid`, or `requested`. |
| `updatedAt` | DateTime! |  |

### Query dataProviders

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `after` | String | No |  |
| `before` | String | No |  |
| `limit` | Int | No |  |
| `order` | PaginationOrder | No | Enum represents the pagination order. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data` | [DataProvider!]! | A third-party data provider configured for the current environment. |
| `listMetadata` | ListMetadata! |  |

### Mutation deleteDataProviderConnection

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | ID! | Yes |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `deleteDataProviderConnection` | ID! |  |

### Mutation deleteOrganizationDataProviderConnection

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | ID! | Yes |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `deleteOrganizationDataProviderConnection` | ID! |  |

### Query organizationDataProviders

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `after` | String | No |  |
| `before` | String | No |  |
| `limit` | Int | No |  |
| `order` | PaginationOrder | No | Enum represents the pagination order. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data` | [OrganizationDataProvider!]! | A data provider the token's organization connects on behalf of all its members. |
| `listMetadata` | ListMetadata! |  |

### Mutation setDataProviderConfiguration

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `clientId` | String | No | The organization's own OAuth client ID. Must be supplied together with `clientSecret`. |
| `clientSecret` | String | No | The organization's own OAuth client secret. Write-only: it is stored encrypted and never returned; clients read `hasCredentials` instead. |
| `config` | [DataProviderConfigEntryInput!] | No | Non-secret configuration values declared by the provider. |
| `dataProviderId` | ID! | Yes | The data provider to configure for the token's organization. Configuration always applies to the token's organization; it cannot be set for another one. |
| `enabled` | Boolean | No | Whether the organization's users can see and connect the data provider. |
| `scopes` | [String!] | No | The scopes the organization requests. Only providers where the organization brings its own OAuth credentials may widen beyond the defaults. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `DataProviderConfigInvalid` | DataProviderConfigInvalid | The supplied configuration does not satisfy the provider's declared fields. |
| `DataProviderConfiguration` | DataProviderConfiguration | A data provider's configuration for the token's organization, excluding secret values. |

### Mutation setDataProviderEnabled

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `dataProviderId` | ID! | Yes |  |
| `enabled` | Boolean! | Yes | Whether the data provider is available to the organization the token was issued for. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authMethods` | [String!]! | How accounts authenticate with this data provider. |
| `capabilities` | DataProviderCapabilities! | Advisory explicit-add availability for the token-scoped owner. Writes still check authorization and creation policy. |
| `config` | [DataProviderConfigEntry!]! | The non-secret configuration values pinned for the token's organization (or by the developer, for a provider whose credentials the developer manages). |
| `configFields` | [DataProviderConfigField!]! | The configuration fields the provider declares. |
| `createdAt` | DateTime! |  |
| `credentialsType` | String! | Who supplies the OAuth application: `shared` (WorkOS), `custom` (the developer), or `organization` (the organization itself). |
| `description` | String |  |
| `enabled` | Boolean! | Whether the data provider is enabled for the token's organization: it must be enabled in the environment and not disabled by the organization's override. |
| `iconDarkUrl` | String | The URL of the provider logo for dark backgrounds, when one is served. |
| `iconSlug` | String | The slug of the provider's icon in the widget icon set. Falls back to the provider type. |
| `iconUrl` | String | The URL of the provider logo for light backgrounds, when one is served. |
| `id` | ID! |  |
| `integrationType` | String! | The provider type this data provider was created from. |
| `name` | String! | The display name of the data provider. |
| `scopes` | [String!] | The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. |
| `slug` | String! | The slug of the data provider. |
| `state` | String! | The configuration state of the data provider: `valid`, `invalid`, or `requested`. |
| `updatedAt` | DateTime! |  |

### Mutation setOrganizationDataProviderConfiguration

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `clientId` | String | No | The organization's own OAuth client ID. Must be supplied together with `clientSecret`. |
| `clientSecret` | String | No | The organization's own OAuth client secret. Write-only: it is stored encrypted and never returned; clients read `hasCredentials` instead. |
| `config` | [DataProviderConfigEntryInput!] | No | Non-secret configuration values declared by the provider. |
| `dataProviderId` | ID! | Yes | The organization-owned data provider to configure (`organizationDataProviders`). Configuration always applies to the token's organization; it cannot be set for another one. |
| `enabled` | Boolean | No | Whether the organization's shared connection to the data provider is enabled. |
| `scopes` | [String!] | No | The scopes the organization requests. Only providers where the organization brings its own OAuth credentials may widen beyond the defaults. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `DataProviderConfigInvalid` | DataProviderConfigInvalid | The supplied configuration does not satisfy the provider's declared fields. |
| `DataProviderConfiguration` | DataProviderConfiguration | A data provider's configuration for the token's organization, excluding secret values. |

### Query sharedDataProviders

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `after` | String | No |  |
| `before` | String | No |  |
| `limit` | Int | No |  |
| `order` | PaginationOrder | No | Enum represents the pagination order. |
| `supportsMultipleConnections` | Boolean | No | Whether the caller can present more than one shared connection per provider. When omitted or false, only the compatibility connection of each provider is returned, as for callers that predate multiple connections. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data` | [SharedDataProvider!]! | A data provider the token's organization has connected on behalf of all its members, with the shared connections a member may use. |
| `listMetadata` | ListMetadata! |  |

### Mutation updateDataProviderConnectionLabel

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A non-unique label of at most 255 Unicode code points, preserved exactly. Omit to preserve the current label; null clears it. Does not change the account identifier. |
| `id` | ID! | Yes | The exact connection to rename. No other connection is selected if this ID is missing or out of scope. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connection` | DataProviderConnection! | The updated connection. Credentials, identity, connection role, and state are unchanged. |
| `warnings` | [DataProviderConnectionLabelWarning!]! | Advisory warnings for the supplied label. Empty when no label was supplied or no exact duplicate exists for this provider and owner. |

### Mutation updateOrganizationDataProviderConnectionLabel

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `accountDisplayName` | String | No | A non-unique label of at most 255 Unicode code points, preserved exactly. Omit to preserve the current label; null clears it. Does not change the account identifier. |
| `id` | ID! | Yes | The exact connection to rename. No other connection is selected if this ID is missing or out of scope. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connection` | DataProviderConnection! | The updated connection. Credentials, identity, connection role, and state are unchanged. |
| `warnings` | [DataProviderConnectionLabelWarning!]! | Advisory warnings for the supplied label. Empty when no label was supplied or no exact duplicate exists for this provider and owner. |