Connection

What It Models

A connection records the link to one provider account. It holds the verified account identity, adapter release pin, safe authentication metadata and operational health that determine whether a call can use that account. Its routing choices live in bindings rather than in the account link itself.

Identity and Attributes

A connection’s configuration identifier is unique within its workspace and remains stable after renaming. Credential records receive generated identifiers. Each circuit combines a deployment and connection.

A permanent configuration identifier accompanies the editable name, labels and optional business unit. The connection references its installation and the adapter release verified for that account. Status distinguishes authentication, verification, usable operation, degradation, reauthorization, suspension and final disconnection. Authentication must use a method declared by the pinned release, including entered credentials, OAuth or a platform account. This reference selects the credential whose value is held in secret storage. Visible metadata includes method, configuration time, permitted hint, expiries, scopes and recent refresh or use. Verification saves the provider’s account reference, feature support and classification as live or test. The latest check and eligible completed calls supply recent health, success share and latency figures. Connection settings must satisfy the pinned release’s declared form. Successful calls can record one notice per warning code, retaining recurrence counts for thirty days. Each deployment and connection has a closed, open or half-open breaker with its probe timing and failure history. Declared limits can be lowered by an operator writer, and provider retry-after responses temporarily reduce admission. Disconnection or discard records retain the responsible actor, time and reason. Editing account configuration uses the connection version the person read.

Relationships

Each connection refers to one installation and one release of its integration.. The installation contains the link, whose row remains after disconnection.. Any number of bindings and executions can name a connection.. A current binding reference blocks closing the connection.. Each declared notification kind can have one endpoint on the connection.. Verification provisions endpoints and disconnection disables them..

Invariants

Named service transitions govern connection status, and disconnected has no outgoing transition. Within an installation, a provider account can appear on only one connection that has not been disconnected. Every current binding that references a connection blocks its disconnection, without an override. An account link with no successful verification can be discarded so abandoned setup does not block uninstallation. Credential reads expose safe metadata; secret values are excluded from stored record fields and response logging. Credential leases identify their execution and adapter, last five minutes by default, cannot exceed sixty minutes and refuse suspended connections. Replacing a credential requests deletion of the old secret with a seven-day recovery window; scheduling failure can delay cleanup, and destroyed records cannot return to use. A connection has at most one open job of each check kind; another request receives the existing verification or health job. The documented breaker opens after five consecutive unavailable or timeout outcomes, initially waits sixty seconds and doubles failed-probe waits to a fifteen-minute ceiling. A release update changes the connection pin only after verification succeeds for the same provider account.

How It Is Stored and Shared

The integrations service stores connections and credential metadata; secret values remain in secret storage. Check jobs retain their own steps and events. The examined table declarations and service predicates separate workspace records, while provider operations cross the external boundary through the adapter. This object has no custom-field declaration.

Open Design Questions

The attention summary and queue disagree about deliberate suspension. Circuit thresholds depend partly on process-local counts. OAuth acceptance, operator rate-limit controls and deletion of retained secrets still need decisions or connected proof.