connector is an app id out of the catalogue, so a setup starts with a search:
listApps
GET /v1/connections/apps. Searches the catalogue by name, id or description. Each row carries the slug that connector takes and an auth array saying which setup paths work — managed_oauth needs no credentials of your own. next_cursor is opaque, not a row id.
getApp
GET /v1/connections/apps/{slug}. Adds default_tools (the operations pinned when you name none) and connect_fields (what connect will still be asked for). not_found for an id the catalogue does not know — this is what replaced the old connector enum.
createAuthConfig
POST /v1/connections/auth_configs. AuthConfigCreate is { connector, auth?, scopes?, tools?, client_id? }, where connector is an app slug. tools pins the callable operations — omitted, the app’s default_tools are pinned, and anything outside the pin is refused at the provider. Org-level and shared across every identity that connects that app.
listAuthConfigs
GET /v1/connections/auth_configs.
deleteAuthConfig
DELETE /v1/connections/auth_configs/{id}.
connect
POST /v1/connections. Mints a connected account and its Connect Link; the account starts initiated with a connect_link to hand to the person who authorizes it. fields carries the config’s connect_fields — omitted, the hosted page asks the person instead. Requires billing:write — a managed account is a per-account charge at the provider.
list
GET /v1/connections, optionally filtered to one persona.
get
GET /v1/connections/{id}. This read is the refresh — status is reconciled against the provider before answering. States: initiated → active | failed, and disconnected once revoked; connect_link is present only while initiated. There is no connection.* webhook yet, so polling this is how you learn that a person finished authorizing.
disconnect
DELETE /v1/connections/{id}. Revoke: the provider drops the stored credential and every later call through the connection is refused.