Connectors Marketplace API

Auth: API key or session token — FlexibleAuthGuard on every route. See Authentication. Entitlement: marketplace. Permissions: connectors:read (reads), connectors:write (publish/delete), connectors:admin (test execute).

The admin surface for the declarative connector runtime — publish connector definitions, manage credential lifecycle, and run governed agent execution against third-party APIs. See the Connectors Marketplace product page.

Surfaces. The admin …/execute endpoint is pre-governance and admin-gated — for validating a connector config only. The governed agent path is …/invoke and the virtual MCP server; both run the full NHI/JIT + Guardian + DLP/masking governance pipeline.

Request flow

Connector definitions

• POST /v1/connectors/:connector/:operation/execute — connectors:admin. Pre-governance test execute (validate config only).
• GET /v1/connectors/:connector — connectors:read. Fetch a definition (org-owned overrides global).
• POST /v1/connectors — connectors:write. Publish a definition.
• DELETE /v1/connectors/:connector — connectors:write. Remove an org-owned override.

Credential lifecycle

• POST /v1/connectors/:connector/credentials — connectors:write. Store a credential (API key, basic, NHI). Secrets are encrypted at rest and never re-readable in cleartext.
• POST /v1/connectors/:connector/credentials/:credId/rotate — connectors:write. Rotate with an overlap window.
• DELETE /v1/connectors/:connector/credentials/:credId — connectors:write. Revoke.

OAuth

• GET /v1/connectors/:connector/oauth/authorize — start the OAuth dance.
• GET /v1/connectors/:connector/oauth/callback — exchange the code; Trinitite stores the refresh token and refreshes on schedule.

Governed agent execution

POST /v1/connectors/:connector/:operation/invoke — connectors:read

The governed path. Runs the full pipeline — NHI/JIT identity, Guardian verdict, DLP/masking on inputs/outputs, receipt minting — before the third-party call. Returns the operation result plus a dlir_receipt_id.

Virtual MCP server

GET /v1/connectors/:connector/mcp/manifest + the MCP tool-call endpoints expose the connector as a virtual MCP server, so an MCP client sees a governed, marketplace-installed tool exactly like a native one. See the MCP Gateway API.

Errors

HTTP	error.code	When
402	entitlement_missing	Org lacks marketplace.
404	not_found	Connector / operation / credential does not exist.
422	unprocessable_entity	Missing required properties in params.
502	bad_gateway	Third-party call failed after retries.

---

→ Connectors Marketplace — the product overview. → Connector SDK — author a connector definition. → MCP Gateway API — the virtual MCP server surface.