Connect an external account
Stores a manual API key for the signed-in user and activates it in the workspace the connect flow started in. The caller must be a member of that workspace. Providers Snoze installs through OAuth or an app installation (GitHub, Slack, Google, Discord, ...) are refused here: their accounts are provisioned by the install callback from provider-verified material. A manual key is always a personal `api_key` credential: it cannot be shared with the workspace (`shareWithWorkspace: true` is a validation error) and an automation pinned to it only sends it to the hosts listed in `allowedHosts`. Reconnecting the same provider account replaces the stored secret, bumps its secret version and clears its failure state rather than creating a duplicate.
apiKeyAuthorizationBearer <snoze_sk_…>Workspace API key created in Workspace settings → API keys. Scopes on the key bound what it can read and write.
workspaceId*stringapplication/json- body
provider*stringexternalAccountId*stringlabel*stringsecret*scopes?array<string>|nullmanifest?|nullallowedHosts?array<string>|nullshareWithWorkspace?boolean|nullSuccess
application/json- response
data*curl -X POST 'https://api.snoze.dev/v1/workspaces/string/connected-accounts' \ -H 'Content-Type: application/json' \ -d '{ "provider": "string", "externalAccountId": "string", "label": "string", "secret": {}}'{ "data": { "id": "string", "provider": "string", "label": "string", "authKind": "oauth", "shareable": true, "hasSecret": true, "health": "unknown", "failureReason": "revoked", "scopes": [ "string" ], "activeWorkspaceIds": [ "string" ], "sharedWorkspaceIds": [ "string" ], "createdAt": "string", "updatedAt": "string" }}List my connected accounts
Returns every external account the signed-in user has connected, across all of their workspaces, with the workspaces each one is currently active in. Account-scoped rather than workspace-scoped: these credentials carry with the person, not the workspace. Encrypted secret material is never returned, only whether a secret is present and the account's health.
Activate or deactivate one of my accounts here
Turns the caller's own connected account on or off for this workspace. Only the owner may change their own grant, and only in a workspace they belong to. `sharedWithWorkspace` is independent of `enabled`: omitting it leaves sharing as it is, `true` additionally requires `integrations:write` and is rejected for credentials the provider did not hand over as an org-owned installation. Turning a grant off, or un-sharing it, immediately drops every cached reachability answer that resolved through it, so shared surfaces stop rendering on the next read rather than at the next cache expiry.