Connections lists every vendor account you have given Graft, one card each. A card shows the connection’s name, its vendor slug, its scheme and its status; the hosts the proxy pins its calls to; its scheme parameters; the tools authored against its vendor, each with its read-only, write or destructive badge; and, folded away, its recent vendor calls. When the credential was set is shown. The credential is not.

​
Status

  • connected, with when the credential was set (or, for OAuth, when you consented and when the token was last refreshed).
  • connected, marked via pipedream, for a connection made with one click on Graft Cloud: the card says the account’s token is held at Pipedream, never in Graft, and that every call relays through it. There is no credential to re-enter, so the card has no credential button.
  • awaiting credential: registered, no secret entered yet. Its tools cannot run.
  • awaiting consent and needs re-consent, for an OAuth connection. See OAuth with your own client.
  • revoked, with awaiting reconnection beside it.

​
Rotating a credential

When a key has been rotated at the vendor, choose Re-enter credential on the card. The dialog shows the scheme and the hosts the credential is sent to, renders the scheme’s secret fields, and Save credential replaces the old credential with the new one. Nothing else about the connection changes, and no approval is touched: your standing answers about the vendor’s tools are about the tools, and the credential changing is not a reason to ask again. The agent can start this for you. After a vendor 401 or 403 it calls request_credential with the connection and what the vendor said, and relays a link. The card under Pending actions reads your agent asks to re-enter the credential for <name>, quotes the vendor’s answer in the agent’s words, and takes the new credential. Once you save it, the agent’s waiting call answers connected and it calls the vendor again.

​
Revoking a connection

Revoke on the card, then Revoke connection in the dialog. Because a connection is yours and not any agent’s, a revoke reaches every agent at once:
  • The credential is cleared, and for an OAuth connection the client secret and the tokens with it.
  • Every agent’s approvals for the vendor’s tools are deleted, and every build approval for this connection.
  • Every open ask about this connection is closed.
  • For a connection made through Pipedream, Graft asks Pipedream to delete the account link, then forgets the account id. If Pipedream cannot be reached, everything in Graft is still revoked and the card says pipedream still holds this account, with Retry release; the account id is kept until the retry succeeds, so the retry knows what to release.
The tools themselves stay in the toolbox, marked awaiting reconnection on the card. Nothing is deleted. The confirmation names what was removed: so many tool approvals, so many build approvals, so many open asks.

​
Reconnecting

A revoked connection is still listed, and Reconnect is the way back: the same dialog as re-entering a credential, with a new credential (or, for OAuth, the client secret and then the consent). Once reconnected, its tools are usable again and ask again on their own terms: reads pass, any other tool asks once, and any Ask every time setting went with the withdrawn approvals. The build approval is asked once more before an agent acquires against it. An agent can start the reconnection too. request_credential on a revoked connection produces a card marked revoked, and the re-entry is the reconnection. A revoked connection made through Pipedream has nothing to re-enter. When an agent next asks to connect that vendor, the one-click card comes back, and completing it reconnects the same connection, so the agents that had it in scope keep it.

​
Scope is on the agent’s page

Which agents may use a connection is not decided here. Open an agent under Agents, tick or untick the connection under Scope, and Save scope; it is in effect on the agent’s next call. A connection an agent proposed is already in that agent’s scope; every other agent gets it when you add it.

​
Try it