> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # tenantConnectorInstances > List all configured connector instances for current workspace. Returns instances with computed status and sentiment. ## OpenAPI ````yaml /api-reference/openapi.json get /api/vendors/tenant-connector-instances openapi: 3.0.3 info: title: Parable API description: >- The REST API for your Parable workspace: manage connectors and taps, explore your data catalog, upload artifacts, and administer users and roles. version: v1 servers: - url: https://api.askparable.com description: Production security: [] paths: /api/vendors/tenant-connector-instances: get: tags: - vendors summary: tenantConnectorInstances description: |- List all configured connector instances for current workspace. Returns instances with computed status and sentiment. operationId: VendorsTenantConnectorInstancesHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/TenantConnectorInstance' type: array links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: Bad request '500': content: application/json: schema: $ref: '#/components/schemas/Error' description: Internal server error security: - bearerAuth: [] components: schemas: TenantConnectorInstance: description: Instance of a configured connector for a workspace. properties: authenticationConfig: description: The authentication configuration for this connector instance type: object authenticationStrategy: $ref: '#/components/schemas/ConnectorAuthStrategy' description: The authentication strategy used for this connector instance connectionStatus: $ref: '#/components/schemas/TenantConnectorStatusEnum' description: Current status of this connector instance. connectionStatusMessage: description: Human-readable message describing the current connection status. type: string connector: $ref: '#/components/schemas/Connector' description: The connector createdAt: description: ISO8601 datetime string type: string createdBy: description: UUID v4 string as base62 type: string credentialErrorCode: $ref: '#/components/schemas/ValidationErrorCode' description: >- Latest credential validation error code for this connector instance. Mirrors ConnectorCredentialDetail.errorCode so the directory tile can render a fine-grained customer CTA (TokenExpired / InsufficientScopes / AuthFailed / ...) without an extra per-instance lookup. Null whenever the most recent credential validation succeeded or has not yet produced a recognised ValidationErrorCode. credentialMetadataId: description: >- ID of the current credential metadata record for this connector instance. Useful for polling validation status after submitCredentials. type: string credentialStatus: $ref: '#/components/schemas/CredentialStatus' description: >- Status of the most recent credential record for this connector instance. grouping: $ref: '#/components/schemas/ParableVendorGrouping' description: The grouping this instance is configured from hasValidCredentials: description: Whether credentials are configured and valid type: boolean id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string ingestionConfig: description: The ingestion configuration for this connector instance type: object lastSyncAt: description: Last sync timestamp type: string lastSyncStatus: $ref: '#/components/schemas/SyncJobStatus' description: Last sync status name: description: Optional user-facing label for this connector instance. type: string updatedAt: description: ISO8601 datetime string type: string updatedBy: description: UUID v4 string as base62 type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - grouping - connector - connectionStatus - connectionStatusMessage - hasValidCredentials type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object Error: properties: error: type: string type: object ConnectorAuthStrategy: description: |- Authentication strategy row for a connector. Each strategy is persisted as its own record to support stable identity. properties: addressingConfig: $ref: '#/components/schemas/AddressingConfig' description: >- Per-strategy API addressing configuration. Overrides the connector-level addressingConfig when this strategy is active. Variables with source=user_input must resolve from configSchema, this strategy's ingestionConfigSchema, or the connector's ingestionConfigSchema. apiKeyConfig: $ref: '#/components/schemas/ApiKeyAuthConfig' description: API key settings (when type = API_KEY_HEADER or API_KEY_QUERY) basicConfig: $ref: '#/components/schemas/BasicAuthConfig' description: Basic auth settings (when type = BASIC) bearerConfig: $ref: '#/components/schemas/BearerAuthConfig' description: Bearer token settings (when type = BEARER) configSchema: description: Strategy-specific customer config schema type: object createdAt: description: ISO8601 datetime string type: string createdBy: description: UUID v4 string as base62 type: string defaultBaseUrl: description: >- Per-strategy base URL override. Takes precedence over the connector-level defaultBaseUrl when this strategy is active. type: string defaultScopes: description: Default OAuth2 scopes for this auth strategy items: type: string type: array delegatedUserField: description: Ingestion config field name for delegated user email (DWD) type: string docs: description: >- Per-strategy setup documentation (Markdown). When set, the web-app docs pane prefers this over the vendor-grouping docs for the selected auth method. type: string extraHeaders: description: Additional headers to include in all authenticated requests type: object hook: description: Optional hook reference executed for auth strategy behavior type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string ingestionConfigSchema: description: >- Per-strategy ingestion config schema. When set, overrides the connector-level ingestionConfigSchema for workspace connectors using this auth strategy. type: object label: description: Display label for this strategy in setup flows type: string oauth2Config: $ref: '#/components/schemas/OAuth2AuthConfig' description: >- OAuth2 settings (when type = OAUTH2_CLIENT_CREDENTIALS or OAUTH2_REFRESH) preEncodedBasicConfig: $ref: '#/components/schemas/PreEncodedBasicAuthConfig' description: >- Pre-encoded basic auth settings (when type = BASIC with pre-encoded token) type: $ref: '#/components/schemas/AuthMethodEnum' description: Authentication method updatedAt: description: ISO8601 datetime string type: string updatedBy: description: UUID v4 string as base62 type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - type type: object TenantConnectorStatusEnum: description: Operational status of a workspace connector instance. enum: - disabled - sync_failed - manual_validation_required - validation_pending - initial_syncing - update_syncing - sync_queued - idle - sync_partial_success - transform_quality_degraded - schedule_paused - config_invalid - credential_error - internal_error - ingestion_stale type: string Connector: description: Web Types of the Connector, see the db types for main reference properties: addressingConfig: $ref: '#/components/schemas/AddressingConfig' description: >- API addressing configuration. Per-strategy addressingConfig on the active ConnectorAuthStrategy overrides this. apiVersion: description: API version for documentation and compatibility type: string concurrencyTagTemplate: description: >- When set, ingestion uses an extra Prefect concurrency limit per tap from this template. Placeholders: {workspace}, {connector}, {tap}, {instance} (tenant_connector id prefix). Templates omitting {instance} share the limit across all workspace-connector instances of the same type (intended for API-level rate caps). Include {instance} for per-connection throttling. type: string createdAt: description: ISO8601 datetime string type: string createdBy: description: UUID v4 string as base62 type: string defaultBaseUrl: description: Default base URL for API calls (can be overridden per-workspace) type: string description: description: Description of what this connector does type: string effortMetadata: description: >- ── Effort Estimation ──────────────────────────────────────────────── Structured effort estimation metadata (bucket, confidence, breakdown) type: object fieldDiscovery: $ref: '#/components/schemas/FieldDiscoveryConfig' description: >- Configuration for runtime field discovery. When present, wildcard tokens in SOQL/queries are resolved by calling a describe endpoint. id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string inboundAuthStrategies: description: |- Inbound sender verification strategies (collector / push-ingestion connectors only; absent for pull connectors) items: $ref: '#/components/schemas/InboundAuthStrategy' type: array ingestionConfigSchema: description: >- Schema for the required ingestion params for the customer to setup this connector type: object integrationClass: $ref: '#/components/schemas/IntegrationClassEnum' description: High-level integration class determining how data is extracted name: description: Human-readable connector name type: string protocolType: description: API protocol type (rest, graphql, webhook, otlp, agent, ...) type: string rateLimits: $ref: '#/components/schemas/ConnectorRateLimits' description: Global rate limits (can be overridden per-tap) releaseStatus: $ref: '#/components/schemas/ConnectorLifecycleStatusEnum' description: >- ── Lifecycle ────────────────────────────────────────────────────────── setupDocumentation: description: >- ── Customer facing ───────────────────────────────────────────────────── Markdown document for a customer setting up this connector type: string slug: description: >- ── Identity ────────────────────────────────────────────────────────── Unique slug for this connector it is made of up of the first 8 characters of the taps name + _ + 8 random base62 characters type: string supportedAuthStrategies: description: >- ── Composable Components ────────────────────────────────────────────── Supported authentication strategies items: $ref: '#/components/schemas/ConnectorAuthStrategy' type: array taps: description: Available taps (data streams) items: $ref: '#/components/schemas/ConnectorTap' type: array timeoutSeconds: description: |- HTTP request timeout in seconds (default: 30). Increase for APIs that return large payloads slowly (e.g., Workday RaaS custom reports: 30-90s). format: int64 type: integer traversal: $ref: '#/components/schemas/ConnectorTraversalConfig' description: >- Traversal graph defining tap DAG relationships. Omit for flat connectors (all taps are roots with no edges). updatedAt: description: ISO8601 datetime string type: string updatedBy: description: UUID v4 string as base62 type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - slug - name - supportedAuthStrategies - taps - releaseStatus type: object ValidationErrorCode: description: Error category when credential validation fails. enum: - auth_failed - internal_error - insufficient_permissions - expired - config_invalid type: string CredentialStatus: description: >- Credential Types for Workspace Connector Configuration These types define how credentials are stored and referenced for connector authentication. Credentials are stored securely in GCP Secret Manager - only metadata/references are in the DB. These types are created when customers configure connectors through the UI, as part of the workspace connector setup workflow. ============================================================================ Credential Enums ============================================================================ Status of stored credentials. enum: - valid - expired - invalid - pending - unvalidated type: string ParableVendorGrouping: description: >- Grouping for API responses - includes computed fields. Represents a node in the connector hierarchy (can be organizational or a leaf connector). properties: breadcrumbs: description: >- Full path for breadcrumbs (e.g., ['Atlassian', 'Jira', 'Jira Cloud']) items: type: string type: array connectorId: description: |- Reference to Connector entity for leaf groupings. Null for organizational groupings (folders). type: string description: type: string docs: description: |- Documentation content (Markdown). Loaded from docsPath if set. type: string externalVersion: type: string groupingPath: description: >- Slug path from vendor root to this grouping (e.g. 'jira/jira-cloud'). Used to build config URLs on the frontend. Null when not needed. type: string groupings: description: Child groupings items: $ref: '#/components/schemas/ParableVendorGrouping' type: array id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string ingestionConfigSchema: description: |- If connector ID is set, then this value will be set to the ingestion config schema required for that connector type: object integrationClass: $ref: '#/components/schemas/IntegrationClassEnum' description: >- High-level integration class of the connector for leaf groupings (e.g. API pull vs STREAMING push). Null for organizational groupings. Drives the configuration flow variant in the frontend. isLeaf: description: |- Whether this is a leaf node (can be configured). Computed: true if connectorId is set. type: boolean logo: description: Logo for this grouping. Falls back to vendor logo when not set. type: object name: description: An objects name type: string parableVersion: type: string parent: $ref: '#/components/schemas/ParableVendorGrouping' description: Parent grouping (null if top-level under vendor) priority: $ref: '#/components/schemas/ConnectorPriorityEnum' description: >- Priority assigned to this grouping for the current workspace, if any. Set by Parable admins via the admin API. protocolType: description: >- Push-protocol type of the connector for STREAMING leaf groupings (e.g. "otlp", "webhook"). Null for pull connectors and organizational groupings. Drives protocol-specific endpoint setup instructions in the frontend (e.g. OTLP exporter environment variables). type: string releaseStage: $ref: '#/components/schemas/ParableReleaseStageEnum' slug: description: A URL friendly version of a string type: string sortOrder: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer supportedAuthStrategies: description: |- If connector ID is set, then this value will be set to the supported auth strategies required for that connector items: $ref: '#/components/schemas/ConnectorAuthStrategy' type: array supportedInboundAuthStrategies: description: >- If connector ID is set and the connector is a push (STREAMING) connector, the inbound sender-verification strategies it supports. The workspace picks one and supplies its configSchema credentials at setup. items: $ref: '#/components/schemas/InboundAuthStrategy' type: array vendor: $ref: '#/components/schemas/ParableVendor' description: Vendor this belongs to required: - id - slug - name - releaseStage - sortOrder - vendor - groupings - isLeaf - breadcrumbs type: object SyncJobStatus: description: Status of a sync job. enum: - pending - running - completed - failed - cancelled - partial_success type: string AddressingConfig: description: >- API addressing configuration for a connector or auth strategy. Defines the URL template and how each template variable is resolved at runtime. properties: basePath: description: >- Base path appended to host (e.g. /ex/jira/{cloudId}). Must start with /. type: string host: description: >- API hostname. May contain {var} placeholders resolved from typed variables. type: string scheme: description: URL scheme. Defaults to https when omitted by runtime consumers. type: string variables: description: Typed declarations for {var} placeholders in host and basePath. items: $ref: '#/components/schemas/AddressingVariable' type: array type: object ApiKeyAuthConfig: description: Configuration for API key authentication. properties: headerName: description: Header name for API_KEY_HEADER (e.g., 'X-API-Key') type: string queryParam: description: Query parameter name for API_KEY_QUERY type: string type: object BasicAuthConfig: description: Configuration for HTTP basic authentication. properties: passwordField: description: Config field path for password (e.g., 'auth.apiToken') type: string passwordValue: description: >- Static password when the API expects a fixed value (e.g. BambooHR HTTP Basic uses x). Applied when decrypted credentials omit the password field. type: string usernameField: description: Config field path for username (e.g., 'auth.email') type: string required: - usernameField - passwordField type: object BearerAuthConfig: description: Configuration for bearer token authentication. properties: headerName: description: 'Header name (default: ''Authorization'')' type: string tokenField: description: 'Token Field (defaults to: ''token'')' type: string tokenPrefix: description: 'Token prefix (default: ''Bearer'')' type: string type: object OAuth2AuthConfig: description: Configuration for OAuth 2.0 authentication flows. properties: audienceParam: description: Audience parameter (for APIs that require it) type: string authorizeUrl: description: Authorization URL (for authorization code flow) type: string grantType: $ref: '#/components/schemas/OAuthGrantType' description: OAuth2 grant type (e.g. client_credentials, account_credentials) passwordField: description: Credential field name for password (basic_credentials auth method) type: string scopes: description: >- OAuth scopes for the token request (space-joined in the token POST body per RFC 6749) items: type: string type: array tokenEndpoint: description: Token endpoint URL type: string tokenEndpointAuthMethod: $ref: '#/components/schemas/TokenEndpointAuthMethod' description: How credentials are sent to the token endpoint tokenEndpointExtraParams: description: Maps token request param names to credential field names type: object tokenPrefix: description: 'Authorization header prefix (default: Bearer)' type: string tokenRefreshCodes: description: >- HTTP status codes on API responses that trigger an OAuth2 access-token refresh and a single retry of the same request (client-credentials flow). When this field is omitted, ingestion defaults to HTTP 401 as the only refresh trigger (equivalent to a list containing 401), so long paginated syncs can recover after token TTL (for example Microsoft Graph). Pass an explicit empty list to disable HTTP-triggered refresh; proactive refresh near local token expiry may still apply. items: format: double type: number type: array tokenResponsePath: description: 'Dot-separated path to token in response JSON (default: access_token)' type: string usernameField: description: Credential field name for username (basic_credentials auth method) type: string required: - tokenEndpoint type: object PreEncodedBasicAuthConfig: description: |- Configuration for pre-encoded HTTP basic authentication. Uses an already-encoded Base64 token instead of username:password. properties: tokenField: description: Credential field name for the pre-encoded Base64 token type: string required: - tokenField type: object AuthMethodEnum: description: Authentication method for API calls. enum: - bearer - basic - api_key_header - api_key_query - oauth2_client_credentials - oauth2_refresh - google_domain_wide_delegation - oauth2_jwt_bearer - oauth2_auth_code_pkce - session_exchange - session_exchange_jwt - session_exchange_password - custom type: string FieldDiscoveryConfig: description: >- Configuration for runtime field discovery. Some APIs (e.g., Salesforce) use a wildcard token like FIELDS(ALL) that only works below a field-count threshold. This config tells the ingestion engine how to call a describe/schema endpoint, enumerate queryable fields, and substitute the wildcard with the explicit field list before executing queries. properties: endpointTemplate: description: >- Describe endpoint template with {objectName} and {apiVersion} placeholders type: string excludeFieldTypes: description: >- Field types to exclude from the resolved list (e.g., ['address', 'location']) items: type: string type: array fieldArrayPath: description: Path to field array in describe response (e.g., 'fields') type: string fieldNameKey: description: Key for field name in each descriptor object (e.g., 'name') type: string fieldTypeKey: description: Key for field type in each descriptor object (e.g., 'type') type: string includeCondition: $ref: '#/components/schemas/FieldDiscoveryIncludeCondition' description: >- Optional condition for including fields (e.g., only queryable fields) objectNameField: description: 'Tap field that holds the API object name (default: ''objectName'')' type: string wildcardToken: description: Token to replace with resolved field list (e.g., 'FIELDS(ALL)') type: string required: - endpointTemplate - objectNameField - fieldArrayPath - fieldNameKey - fieldTypeKey - wildcardToken type: object InboundAuthStrategy: description: |- Inbound sender verification strategy for a collector (push-ingestion) connector. Web projection; see the db type for main reference. properties: configSchema: description: >- JSON Schema for the verification credentials the workspace must supply at connector setup (secret fields use "x-secret": true) type: object createdAt: description: ISO8601 datetime string type: string createdBy: description: UUID v4 string as base62 type: string handshakeKind: $ref: '#/components/schemas/InboundHandshakeKindEnum' description: >- Subscription-time validation dance performed when the workspace registers the ingest URL in the vendor console id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string label: description: Display label for this strategy in setup flows type: string replayWindowSeconds: description: Maximum accepted age, in seconds, of the timestampHeader value format: int64 type: integer signatureBase: description: >- Template for the string the sender signs. Placeholders: {timestamp}, {body}. Example (Slack): "v0:{timestamp}:{body}" type: string signatureHeader: description: >- Header carrying the sender's signature (when verificationType = HMAC_SHA256) type: string timestampHeader: description: Header carrying the sender's request timestamp for replay protection type: string updatedAt: description: ISO8601 datetime string type: string updatedBy: description: UUID v4 string as base62 type: string verificationType: $ref: '#/components/schemas/InboundVerificationTypeEnum' description: How the collector verifies the sender of a pushed payload required: - id - createdAt - createdBy - updatedAt - updatedBy - verificationType - handshakeKind type: object IntegrationClassEnum: description: >- High-level integration class determining how data is extracted from a connector. Drives protocol module selection in the research pipeline and transport handler routing in the ingestion engine. enum: - api - database - file - streaming - meta_tool - custom type: string ConnectorRateLimits: description: >- Connector Rate Limits Rate limiting and retry configuration for connectors and individual taps. Can be set at the connector level (global) and overridden per-tap. Rate limit configuration for a connector or tap. properties: maxConcurrent: description: Maximum concurrent requests format: double type: number requestsPerSecond: description: Maximum requests per second format: double type: number resetHeader: description: >- Response header containing the Unix epoch reset time (e.g. x-rate-limit-reset for Okta). Used as fallback when Retry-After is absent. type: string retry: $ref: '#/components/schemas/RetryConfig' description: Retry behavior configuration type: object ConnectorLifecycleStatusEnum: enum: - draft - configured - authorized - executable - landing - materialized - modeled - verified - deprecated type: string ConnectorTap: description: |- Definition of a data extraction tap for a connector. A tap represents a single endpoint/entity type that can be extracted. properties: createdAt: description: ISO8601 datetime string type: string createdBy: description: UUID v4 string as base62 type: string customFields: $ref: '#/components/schemas/TapCustomFieldsConfig' description: >- Capture config for dynamic/custom fields (PARABLE-734). Null = capture off. dataKind: $ref: '#/components/schemas/TapDataKindEnum' description: |- Materialization class for this tap's records on the promote path. Null = undeclared; the promote path applies documented defaults. deletionSemantics: $ref: '#/components/schemas/TapDeletionSemanticsEnum' description: >- How deletions are detectable in this tap's source. Null = undeclared. description: description: Human-readable description of what this tap extracts type: string enabledByDefault: description: Whether this tap is enabled by default for new connections type: boolean enabledSince: description: |- Start of the current uninterrupted default-enabled period. Null when disabled or when a legacy enabled period predates tracking. type: string errorBodyRules: description: >- Rules that reclassify HTTP errors from the response body (retry vs skip). items: $ref: '#/components/schemas/ErrorBodyRule' type: array extractionHook: description: Hook executed after extracting response records type: string id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string identityDirectory: description: >- Marks principal/account-directory taps (e.g. Slack users, Okta users). Directory taps are unioned into the account set downstream. type: boolean name: description: Unique name for this tap (e.g., 'repos', 'issues', 'users') type: string objectName: description: >- API object name for field discovery (e.g., 'User', 'Account' for Salesforce SOQL objects) type: string observability: $ref: '#/components/schemas/TapObservabilityConfig' description: >- Observability-only metadata for pre-Silver evidence. This does not mutate Bronze I records; it tells ingestion which raw source fields represent the tap's domain date for OTEL/log evidence. parentContextFields: description: >- Mappings to inject parent record values into tap output records. Used on root taps fed by config fan-out when no traversal edge supplies parent context (e.g. team_id from synthetic parent records). items: $ref: '#/components/schemas/ParentContextFieldMapping' type: array perParentAuth: $ref: '#/components/schemas/TapPerParentAuth' description: >- Per-parent authentication for taps that need a different OAuth subject per parent record (e.g., Google Workspace per-user impersonation). When unset the connector's default auth is used. qualityConfig: $ref: '#/components/schemas/TapQualityConfig' rateLimitOverride: $ref: '#/components/schemas/ConnectorRateLimits' description: Rate limit overrides for this specific tap rateLimits: $ref: '#/components/schemas/ConnectorRateLimits' description: >- Per-tap rate limits (e.g. maxConcurrent) merged over connector defaults. requestHook: description: Hook executed before making transport requests type: string responseExtraction: $ref: '#/components/schemas/ResponseExtractionConfig' description: How to extract records from API responses retentionPolicy: $ref: '#/components/schemas/TapRetentionPolicy' description: >- Source API data retention policy. Null if the source has no retention limit. schema: description: >- The schema describing the shape of the data this tap outputs. Customers render this in the data-catalog UI to enumerate available fields. type: object skipOnHttpStatus: description: >- HTTP status codes to skip gracefully during parent-child fan-out (e.g., [403, 404]) items: format: double type: number type: array sync: $ref: '#/components/schemas/TapSyncConfig' description: Sync strategy and incremental parameters tombstoneMarkerColumn: description: >- Root schema field whose truthy value marks an explicit tombstone record. Required when deletionSemantics is tombstone. type: string transportOptions: description: Prioritized transport options for this tap items: $ref: '#/components/schemas/TapTransportOption' type: array updatedAt: description: ISO8601 datetime string type: string updatedBy: description: UUID v4 string as base62 type: string required: - id - createdAt - createdBy - updatedAt - updatedBy - name - transportOptions - responseExtraction - sync - enabledByDefault - schema - identityDirectory type: object ConnectorTraversalConfig: description: |- Connector Traversal Configuration Formalizes the implicit DAG (parentTap/parentKeyField) into an explicit traversal graph with typed edges. This makes the data extraction order visible at the schema level and enables validation (cycle detection, orphan detection, fan-out limits). Traversal configuration defining the DAG of tap relationships. The ingestion engine uses this to determine extraction order and parent-child data flow. properties: configFanouts: description: >- Maps a multi-value ingestion config field to a URL template variable for root taps. The runtime fans out one API request per value. items: $ref: '#/components/schemas/ConnectorConfigFanout' type: array edges: description: >- Directed edges defining parent-child relationships between taps. Each edge specifies how parent records are used to construct child requests. items: $ref: '#/components/schemas/ConnectorEdge' type: array rootTaps: description: >- Taps with no parent — the entry points for data extraction. These are synced first; their records feed into child taps via edges. items: description: >- A machine identifier for a data tap (lowercase alphanumeric, underscores, and hyphens) type: string type: array required: - rootTaps type: object ConnectorPriorityEnum: description: Priority level assigned to a vendor grouping for a specific workspace. enum: - required - suggested type: string ParableReleaseStageEnum: description: |- Release stage for connector offerings. Determines visibility and access in the connector catalog. enum: - ga - early_access - invite_access - coming_soon type: string ParableVendor: description: |- Vendor for API responses - includes computed fields. Represents a top-level company/product family in the connector catalog. properties: description: type: string groupings: description: Top-level groupings under this vendor items: $ref: '#/components/schemas/ParableVendorGrouping' type: array id: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string logo: description: Logo metadata for display. type: object name: description: An objects name type: string slug: description: A URL friendly version of a string type: string sortOrder: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer required: - id - slug - name - sortOrder - groupings type: object AddressingVariable: description: A single template variable in an AddressingConfig. properties: name: description: Name of the {var} placeholder in host or basePath. type: string oauthResponsePath: description: |- Dot-separated path into the OAuth token response body. Required when source = oauth_response. type: string required: description: Whether a missing value for this variable should halt the sync. type: boolean source: description: 'Resolution source: user_input, oauth_response, or static.' type: string required: - name - source type: object OAuthGrantType: description: OAuth 2.0 grant type for token requests. enum: - client_credentials - authorization_code - refresh_token - account_credentials type: string TokenEndpointAuthMethod: description: How client credentials are sent to the OAuth2 token endpoint. enum: - client_secret_basic - client_secret_post - none - basic_credentials type: string FieldDiscoveryIncludeCondition: description: >- ============================================================================= Field Discovery ============================================================================= Condition for including a field during field discovery. Allows filtering describe-endpoint results by a boolean or enum property. properties: key: description: Field key to check on each field descriptor (e.g., 'queryable') type: string value: description: Required value for inclusion (e.g., true) type: object required: - key - value type: object InboundHandshakeKindEnum: description: |- Subscription-time validation dance a webhook provider performs when the workspace registers the ingest URL in the vendor console. The collector implements each kind exactly once; the set is deliberately bounded. enum: - none - slack_url_verification - ms_graph_validation_token type: string InboundVerificationTypeEnum: description: >- How the collector verifies a push sender (inbound requests to incoming.parable.work). The mirror image of AuthMethodEnum, which covers outbound API calls the platform makes. Each kind is implemented exactly once in the collector service; adding a webhook provider that reuses an existing kind is seed data only. enum: - hmac_sha256 - bearer_token - device_key - none type: string RetryConfig: description: Retry behavior for rate-limited or failed requests. properties: backoffMultiplier: description: Multiplier for exponential backoff between retries format: double type: number maxRetries: description: Maximum number of retries before failing format: double type: number maxRetryTimeSeconds: description: Maximum total retry time in seconds before giving up format: int64 type: integer respectRetryAfter: description: Whether to respect Retry-After headers from the API type: boolean type: object TapCustomFieldsConfig: description: >- Capture config for dynamic/custom fields on the provider-pool promote path (PARABLE-734). Patterns route keys into `_custom_fields`; remaining undeclared keys land in `_raw_unknown_fields` when captureUnknownFields is true. Prefer patterns over per-workspace field ID allowlists. properties: captureUnknownFields: description: |- When true, undeclared keys that do not match known patterns land in `_raw_unknown_fields` instead of being dropped. type: boolean knownCustomFieldKeyPatterns: description: >- Glob-style patterns (prefix `customfield_*`, suffix `*__c`, or exact). items: type: string type: array required: - captureUnknownFields type: object TapDataKindEnum: description: >- Materialization class for a tap's records on the ingestion-to-transformation promote path. Selects how the transformation layer materializes the stream. enum: - snapshot - event - changelog type: string TapDeletionSemanticsEnum: description: How deletions in the source are detectable for a tap. enum: - by_absence - tombstone - undetectable type: string ErrorBodyRule: description: >- Rule for classifying HTTP errors by inspecting the response body. When the HTTP status code matches, a JMESPath expression extracts a value from the body and compares it against retry or skip lists. properties: jmesPath: description: JMESPath expression to extract a value from the response body type: string retryValues: description: Values that indicate the error is transient and should be retried items: type: string type: array skipValues: description: Values that indicate the error is skippable (treat as empty result) items: type: string type: array statusCode: description: HTTP status code this rule applies to format: double type: number required: - statusCode - jmesPath type: object TapObservabilityConfig: description: |- Observability-only metadata for a tap. This metadata is used to produce pre-Silver evidence and must not mutate Bronze I payloads. properties: creditingMode: $ref: '#/components/schemas/TapDomainDateCreditingModeEnum' description: How Bronze I coverage credits calendar days for this tap. domainDatePaths: description: |- Dot-notation paths on the raw source record before envelope fields. Multiple paths act as alternates for polymorphic API shapes. Required when creditingMode is business_date. items: type: string type: array required: - creditingMode type: object ParentContextFieldMapping: description: >- ============================================================================= Tap Definition Types ============================================================================= Mapping from a target field name to a source field name in the parent record. Used to inject parent record values into child records during tap execution. properties: sourceField: description: Field name to read from parent record type: string targetField: description: Field name to set in child records type: string required: - targetField - sourceField type: object TapPerParentAuth: description: >- ============================================================================= Per-Parent Authentication ============================================================================= Per-parent authentication configuration for taps that iterate per-record on a parent tap (e.g., per-user impersonation for Google Workspace Gmail/ Calendar/Meet APIs). When set, the runtime mints a separate OAuth token for each parent record, using the value of `impersonateField` from that record as the subject (the JWT `sub` claim for service account domain-wide delegation), instead of the connector's default admin-impersonation token. Required for Google APIs that only return data for the authenticated user (e.g., `/gmail/v1/users/{email}/threads`, Meet conference records). Without it, calls fall back to admin impersonation and Google rejects per-user URLs with `403 Delegation denied`. properties: impersonateField: description: >- Field name on the parent record whose value is used as the impersonation subject (e.g., `primaryEmail` for Google Workspace user records). Must match a field present on the parent tap's records, including any values propagated through `parentContextFields`. type: string method: description: |- Per-parent authentication strategy. Currently only `service_account` (Google Workspace domain-wide delegation) is supported. type: string quotaUserHeader: description: |- Optional HTTP header name to set the per-user value on each request (e.g., `x-goog-quota-user` so per-user quota is attributed to the impersonated user instead of the service account). type: string required: - method - impersonateField type: object TapQualityConfig: properties: rules: items: $ref: '#/components/schemas/QualityRuleConfig' type: array spc: $ref: '#/components/schemas/TapSpcConfig' required: - rules - spc type: object ResponseExtractionConfig: description: >- ============================================================================= Response Extraction ============================================================================= How to extract records from an API response. properties: primaryKey: description: Primary key field name for deduplication (e.g., 'id') type: string responseFormat: $ref: '#/components/schemas/ResponseFormatEnum' description: >- Wire format of the response body. Defaults to JSON when null. Set to JSONL for newline-delimited JSON responses (one record per line, body is not a single JSON document), e.g. Mixpanel's Raw Event Export API. With JSONL, set responsePath to '@' so each line becomes a record. responsePath: description: |- JMESPath expression to extract records from response. Examples: '@' (response is array), 'data', 'results.items' type: string responsePathFallback: description: >- Fallback JMESPath when the primary responsePath returns null. Handles polymorphic responses where the array may be at a different path (e.g., TestrRail suites: 'suites' normally, 'root_array' for single-suite projects). type: string responseValidation: $ref: '#/components/schemas/ResponseValidation' description: Validation rules for API response success/error handling syntheticPrimaryKey: $ref: '#/components/schemas/SyntheticPrimaryKeyConfig' description: >- Synthetic primary key configuration. When present, generates a unique ID by hashing the specified fields. The primaryKey field becomes the output field name where the hash is stored (e.g., primaryKey: "id"). required: - primaryKey type: object TapRetentionPolicy: description: >- ============================================================================= Retention Policy ============================================================================= Data retention policy for a tap's source API. When set, enables proactive alerting when ingestion gaps risk permanent data loss due to source-side retention expiry. properties: alertThresholdDays: description: |- Alert when remaining coverage buffer drops below this many days. Default: 7 days (alert fires when we are 7 days from losing data). format: int64 type: integer retentionDays: description: |- Maximum number of days the source API retains historical data. After this window, data is permanently unrecoverable. Example: Google Meet API = 30 days, Zoom Reports = 180 days. format: int64 type: integer required: - retentionDays type: object TapSyncConfig: description: >- ============================================================================= Sync Configuration ============================================================================= Sync strategy and incremental parameters for a tap. properties: asyncQuery: $ref: '#/components/schemas/AsyncQueryConfig' description: >- Async query configuration for APIs that use a create-poll-fetch pattern (e.g., Microsoft Purview audit logs). When present, the ingestion engine POSTs to create a query job, polls for completion, then fetches paginated results. cursorField: description: |- Cursor field for incremental sync watermarks (e.g., 'updated_at'). Required when mode = INCREMENTAL. type: string cursorValueFormat: $ref: '#/components/schemas/IncrementalTimeFormatEnum' description: >- Format of raw cursorField values on API records (partial watermark only). Stored control-plane watermarks remain ISO8601. incrementalParams: $ref: '#/components/schemas/IncrementalParamsConfig' description: Configuration for incremental time-based filtering maxLookbackDays: description: >- Maximum lookback days for the initial sync (no watermark). When set, the first-run window is capped to min(defaultLookbackDays, maxLookbackDays). Use for APIs with data retention limits (e.g., Zoom Report API rejects queries older than 12 months). format: int64 type: integer mode: $ref: '#/components/schemas/SyncModeEnum' description: 'Sync mode: FULL extracts all records, INCREMENTAL uses watermarks' scopes: description: >- OAuth scopes required for this tap (e.g., Google Workspace per-service scopes) items: type: string type: array required: - mode type: object TapTransportOption: description: >- ============================================================================= Transport Options ============================================================================= A prioritized transport option for executing a tap. Taps can define multiple options and the runtime chooses by priority. properties: apiType: $ref: '#/components/schemas/ApiTypeEnum' description: API transport type for this option errorBodyRules: description: >- Rules for disambiguating HTTP error responses by inspecting the response body. Allows overriding the default error classification (transient/permanent/skippable) based on status code + body content. items: $ref: '#/components/schemas/ErrorBodyRule' type: array graphqlConfig: $ref: '#/components/schemas/GraphQLEndpointConfig' description: GraphQL endpoint configuration (when apiType = GRAPHQL) pagination: $ref: '#/components/schemas/PaginationConfig' description: Pagination configuration for this transport option paginationHook: description: Optional hook reference for custom pagination behavior type: string priority: description: Execution priority (1 is highest priority) format: double type: number restConfig: $ref: '#/components/schemas/RestEndpointConfig' description: REST endpoint configuration (when apiType = REST) skipOnHttpStatus: description: >- HTTP status codes to skip gracefully for requests made with this transport option (e.g., Notion block fan-out returning 400 for unsupported block types). When unset, tap-level skipOnHttpStatus applies. items: format: double type: number type: array required: - priority - apiType - pagination type: object ConnectorConfigFanout: description: >- Declares how a list-valued ingestion config field drives root-tap fan-out. properties: configField: description: Ingestion config property name (e.g. team_ids). type: string separator: description: >- Separator for legacy string config values. Defaults to comma when omitted. Array config values ignore this field. type: string templateVariable: description: Endpoint placeholder name (e.g. team_id). type: string required: - configField - templateVariable type: object ConnectorEdge: description: >- A directed edge in the tap DAG from a parent tap to a child tap. Defines how records from the parent are used to construct requests for the child. properties: fanOutLimit: description: |- Maximum number of child requests to fan out per parent record. Useful for rate-limit-sensitive connectors. format: double type: number from: description: Parent tap name (source of the edge) type: string parentContextFields: description: >- Mappings to inject parent record values into child records. Each entry maps a target field (set on child) to a source field (read from parent). Enables multi-field context propagation through tap hierarchies. items: $ref: '#/components/schemas/ParentContextFieldMapping' type: array parentEligibility: description: >- Optional eligibility predicates evaluated against each parent record before any child request is planned. All predicates must hold for the parent to be fanned out. `any_of` keeps allowlist semantics (a missing value matches nothing); the comparison operators fail open on a missing field or a value of the wrong type, so an incomplete payload never silently drops data. items: $ref: '#/components/schemas/ParentEligibilityPredicate' type: array parentKeyField: description: >- Field from the parent record used to construct the child tap's request. Examples: 'full_name' (GitHub repos → issues), 'id' (Slack channels → messages) type: string templateVariable: description: >- Template variable name in the child tap's endpoint. If omitted, defaults to parentKeyField. Example: endpoint '/repos/{full_name}/issues' uses templateVariable 'full_name' type: string to: description: Child tap name (target of the edge) type: string required: - from - to - parentKeyField type: object TapDomainDateCreditingModeEnum: description: How Bronze I coverage credits calendar days for a connector tap. enum: - business_date - execution_date - sync_window type: string QualityRuleConfig: description: Discriminated union of all quality rule variants. discriminator: mapping: dupe_rate: $ref: '#/components/schemas/DupeRateRule' no_future_timestamp: $ref: '#/components/schemas/NoFutureTimestampRule' null_rate: $ref: '#/components/schemas/NullRateRule' referential_integrity: $ref: '#/components/schemas/ReferentialIntegrityRule' row_count_not_suspicious: $ref: '#/components/schemas/RowCountNotSuspiciousRule' string_pattern_rate: $ref: '#/components/schemas/StringPatternRateRule' temporal_order: $ref: '#/components/schemas/TemporalOrderRule' timeline_gaps: $ref: '#/components/schemas/TimelineGapsRule' timestamp_coverage: $ref: '#/components/schemas/TimestampCoverageRule' propertyName: type oneOf: - $ref: '#/components/schemas/NullRateRule' - $ref: '#/components/schemas/DupeRateRule' - $ref: '#/components/schemas/TimestampCoverageRule' - $ref: '#/components/schemas/TemporalOrderRule' - $ref: '#/components/schemas/NoFutureTimestampRule' - $ref: '#/components/schemas/TimelineGapsRule' - $ref: '#/components/schemas/StringPatternRateRule' - $ref: '#/components/schemas/ReferentialIntegrityRule' - $ref: '#/components/schemas/RowCountNotSuspiciousRule' TapSpcConfig: properties: minHistoryForViolation: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer trackedSeries: items: $ref: '#/components/schemas/SpcSeriesKind' type: array windowSize: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer required: - windowSize - trackedSeries - minHistoryForViolation type: object ResponseFormatEnum: description: >- Wire format of a successful HTTP response body, controlling how the ingestion engine turns the body into records before responsePath extraction. enum: - json - jsonl type: string ResponseValidation: description: Validation rules for API response handling. properties: errorField: description: Field containing error code/message (e.g., 'error') type: string okField: description: Field indicating success in response body (e.g., 'ok') type: string skippableErrors: description: >- Application-level errors to treat as empty results (e.g., 'channel_not_found') items: type: string type: array transientErrors: description: >- Application-level errors that are transient and should be retried (e.g., 'ratelimited') items: type: string type: array required: - okField - errorField type: object SyntheticPrimaryKeyConfig: description: >- ============================================================================= Synthetic Primary Key Types ============================================================================= Configuration for generating a synthetic primary key by hashing multiple fields. When present on a tap, the engine concatenates the specified fields (JMESPath for nested paths such as id.time), hashes them, and injects the result into the record. Uses outputField when set; otherwise falls back to primaryKey as the output field name. properties: algorithm: $ref: '#/components/schemas/SyntheticKeyAlgorithm' description: 'Hash algorithm (default: sha1)' fields: description: Record fields to concatenate for hash input items: type: string type: array outputField: description: 'Top-level record field for the hash (default: tap primaryKey)' type: string separator: description: 'Separator between field values (default: ''|'')' type: string required: - fields type: object AsyncQueryConfig: description: |- Configuration for asynchronous create-poll-fetch query execution. Used by APIs that require submitting a query, polling for completion, and then fetching results from a separate endpoint. properties: externalLinksPath: description: >- JMESPath to an array of presigned result links on a chunk payload (Databricks EXTERNAL_LINKS disposition). When set, chunk fetch downloads result bytes from those URLs instead of reading rows out of the chunk response. Presigned URLs carry their own credentials, so the download is issued without the connector's Authorization header. type: string failureValue: description: Status value indicating the query failed (optional) type: string failureValues: description: |- Additional terminal failure status values (optional). Merged with failureValue when present so vendors with several terminal failure states (e.g. Databricks FAILED/CANCELED/CLOSED) do not stall until maxPollSeconds. items: type: string type: array maxPollSeconds: description: 'Maximum seconds to poll before treating as a timeout (default: 3600)' format: int64 type: integer pollIntervalSeconds: description: 'Seconds between status poll requests (default: 30)' format: int64 type: integer queryIdPath: description: JMESPath to extract the query ID from the create-query response type: string recordsEndpoint: description: Endpoint template for fetching results (use {queryId} placeholder) type: string recordsPagination: $ref: '#/components/schemas/PaginationConfig' description: Pagination config for the results endpoint recordsQueryParams: description: Query parameters for the results endpoint type: object recordsResponsePath: description: JMESPath to extract records from the results response type: string statusEndpoint: description: Endpoint template for polling status (use {queryId} placeholder) type: string statusPath: description: JMESPath to extract status string from the poll response type: string successValue: description: Status value indicating the query completed successfully type: string required: - queryIdPath - statusEndpoint - statusPath - successValue - recordsEndpoint - recordsResponsePath type: object IncrementalTimeFormatEnum: description: Format for incremental sync time parameters. enum: - iso8601 - iso8601_z - iso8601_seconds_z - unix - unix_millis - unix_micros - date_slash - date type: string IncrementalParamsConfig: description: Configuration for incremental sync time-based filtering. properties: bodyFilterEndPath: description: |- Optional second POST-body path for the window end bound (e.g. monday activity_logs variables.to alongside variables.from). type: string bodyFilterFormat: $ref: '#/components/schemas/IncrementalTimeFormatEnum' description: Format for body filter timestamp value bodyFilterPath: description: Dot-notation path in POST body for time filter injection type: string bodyFilterTemplate: description: >- Template for body filter with {window_start} and {window_end} placeholders type: string defaultLookaheadDays: description: >- Days to extend the sync window end beyond "now" (UTC) for forward-looking taps (e.g. calendar APIs). When set and no explicit backfill end is supplied, window_end becomes now plus min(defaultLookaheadDays, maxLookaheadDays) when maxLookaheadDays is set, else now plus defaultLookaheadDays. Omitted or zero preserves the historical end at "now". format: int64 type: integer filterType: $ref: '#/components/schemas/IncrementalFilterTypeEnum' description: Type of incremental filtering to apply maxLookaheadDays: description: >- Upper bound on forward extension when defaultLookaheadDays is set. Caps first-run and incremental upper bounds the same way maxLookbackDays caps initial lookback. format: int64 type: integer maxWindowDays: description: >- Maximum number of days per sync window. APIs with date range limits (e.g., Microsoft Graph 30 days, Zoom 30 days) are automatically split into sub-windows. format: int64 type: integer queryParam: description: Query parameter for template-based filters (e.g., 'q' for Gmail) type: string queryTemplate: description: Template with {window_start} and {window_end} placeholders type: string sinceFormat: $ref: '#/components/schemas/IncrementalTimeFormatEnum' description: Format for the since parameter value sinceParam: description: Query parameter name for start time filter (e.g., 'since', 'oldest') type: string untilFormat: $ref: '#/components/schemas/IncrementalTimeFormatEnum' description: Format for the until parameter value untilParam: description: Query parameter name for end time filter (e.g., 'until', 'latest') type: string type: object SyncModeEnum: description: Sync strategy for a tap. enum: - full - incremental type: string ApiTypeEnum: description: |- API transport protocol. Determines how requests are constructed and executed. enum: - rest - graphql - database - file - custom type: string GraphQLEndpointConfig: description: |- GraphQL API endpoint configuration. For connectors that use GraphQL APIs (e.g., Linear). properties: endpoint: description: GraphQL endpoint path type: string operationName: description: GraphQL operation name type: string query: description: GraphQL query or mutation string type: string variables: description: Static variables to include in every request type: object required: - endpoint - query type: object PaginationConfig: description: >- ============================================================================= Pagination ============================================================================= Pagination configuration for a tap endpoint. properties: cursor: $ref: '#/components/schemas/CursorPaginationConfig' description: Cursor pagination settings (when type = CURSOR) offset: $ref: '#/components/schemas/OffsetPaginationConfig' description: Offset pagination settings (when type = OFFSET) pageNumber: $ref: '#/components/schemas/PageNumberPaginationConfig' description: Page number pagination settings (when type = PAGE_NUMBER) sessionPage: $ref: '#/components/schemas/SessionPagePaginationConfig' description: Session + page pagination settings (when type = SESSION_PAGE) type: $ref: '#/components/schemas/PaginationTypeEnum' description: Pagination strategy type required: - type type: object RestEndpointConfig: description: >- Connector Tap Definition A tap represents a single data stream (e.g., repos, issues, users). Each tap defines how to extract one entity type from an API. Taps are API-type-aware: REST taps use RestEndpointConfig, GraphQL taps use GraphQLEndpointConfig. ============================================================================= Endpoint Configurations ============================================================================= REST API endpoint configuration. Supports template variables resolved from workspace config or parent tap records. Examples: '/orgs/{orgId}/repos', '/repos/{full_name}/issues' properties: batch: $ref: '#/components/schemas/RestBatchConfig' description: >- Optional batch packer config for Google-style multipart/mixed batch APIs. When set, the runtime packs one sub-request per parent record (built from this RestEndpointConfig's endpoint/method/headers) into a single multipart/mixed POST to `batch.endpoint`. When the tap declares `perParentAuth`, each sub-request gets its own `Authorization` header so it impersonates the parent user (Google domain-wide delegation). When `perParentAuth` is omitted, the outer POST's auth applies to every sub-request -- used for admin-token detail taps such as Drive Docs/Sheets. When unset, the runtime executes one HTTP request per parent record. bodyEncoding: $ref: '#/components/schemas/BodyEncodingEnum' description: >- Serialization for the POST/PUT/PATCH body. Defaults to JSON when null. Set to FORM (application/x-www-form-urlencoded) for APIs that reject a JSON body, e.g. Mixpanel's Engage query API. endpoint: description: |- API endpoint path (supports {variable} templates). Variables are resolved from parent tap records or workspace config. type: string headers: description: Additional headers to include type: object method: $ref: '#/components/schemas/HttpMethodEnum' description: 'HTTP method (default: GET)' parentDataFilterBodyInject: $ref: '#/components/schemas/ParentDataFilterBodyInject' description: >- Optional inject of workspace parentDataFilters values into requestBody. Used by root taps that take an allowlist array (e.g. Purview userPrincipalNameFilters) without depending on a parent tap. parentDataFilterQueryInject: $ref: '#/components/schemas/ParentDataFilterQueryInject' description: >- Optional inject of workspace parentDataFilters values into a query param (typically $filter). Used by root taps that take an allowlist in the query string without depending on a parent tap. pathParamEncodings: description: >- Optional encoding rules for path template placeholders. Keys are placeholder names without braces; values select a runtime encoding (e.g. zoom_meeting_uuid for Zoom meeting instance UUIDs that contain slashes). type: object queryParams: description: Default query parameters to include type: object requestBody: description: Request body template (for POST endpoints, e.g., Notion search) type: object required: - endpoint - method type: object ParentEligibilityPredicate: description: >- One condition a parent record must satisfy to be fanned out to a child tap. A predicate must only encode deterministic expected absence -- a parent the vendor is already known to have no child rows for. It must never encode transient errors, access failures, or merely slow parents; those are retryable and filtering them silently loses data. Operators (validated at frontier planning time, not by the schema, because generated enum fields are not parseable from runtime dicts): any_of field value matches one of `values` (case-insensitive) none_of field value matches none of `values` (case-insensitive) exists field is present and neither null nor empty not_exists field is absent, null, or empty gt gte lt lte numeric field compared against `threshold` length_gt length_gte length of a list or string compared against `threshold` properties: field: description: Parent record field to evaluate. Dotted path for nested fields. type: string operator: description: Comparison to apply to the field value. One of the operators above. type: string threshold: description: >- Operand for the numeric and length operators. Unused by every other operator. format: double type: number values: description: Operand for `any_of` and `none_of`. Unused by every other operator. items: type: string type: array required: - field - operator type: object DupeRateRule: properties: maxRate: format: double type: number type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxRate type: object NoFutureTimestampRule: properties: maxViolations: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxViolations type: object NullRateRule: properties: maxRate: format: double type: number type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxRate type: object ReferentialIntegrityRule: description: 'Quality rule: foreign key must exist in referenced dataset.' properties: localColumn: type: string maxOrphanRate: format: double type: number referencedColumn: type: string referencedDatasetId: type: string type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - localColumn - referencedDatasetId - referencedColumn - maxOrphanRate type: object RowCountNotSuspiciousRule: properties: suspiciousCounts: items: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer type: array type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - suspiciousCounts type: object StringPatternRateRule: properties: column: type: string maxRate: format: double type: number pattern: type: string type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - column - pattern - maxRate type: object TemporalOrderRule: properties: maxViolations: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 type: integer type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxViolations type: object TimelineGapsRule: properties: maxGapDays: description: Signed integer count of days format: int64 type: integer type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - maxGapDays type: object TimestampCoverageRule: properties: minRate: format: double type: number type: $ref: '#/components/schemas/QualityRuleTypeEnum' required: - type - minRate type: object SpcSeriesKind: description: |- Tracked SPC series kind. Also used by TapSpcConfig.trackedSeries to declare which series the cron should monitor. enum: - TABLE_ROW_COUNT - COLUMN_NULL_PCT - COLUMN_VALIDATION_FAILURE_PCT - COLUMN_DISTINCT_COUNT - COLUMN_AVG type: string SyntheticKeyAlgorithm: description: Hash algorithm for generating synthetic primary keys. enum: - sha1 - sha256 type: string IncrementalFilterTypeEnum: description: Type of incremental filtering to apply. enum: - simple - query_template - body_filter type: string CursorPaginationConfig: description: Configuration for cursor-based pagination. properties: cursorBodyPath: description: >- Dot-notation path inside the POST request body where the cursor must be injected for the next page (e.g., 'cursor', 'variables.after'). When set, the cursor is written into the body instead of the query string. Required for APIs that paginate POST endpoints with a body cursor (e.g., Gong /v2/calls/extensive). type: string cursorIsFullUrl: description: >- When true, the cursor value is an absolute URL (e.g., OData @odata.nextLink) type: boolean cursorParam: description: 'Query parameter name for cursor (default: ''cursor'')' type: string cursorPath: description: JMESPath to extract next cursor from response type: string hasMorePath: description: JMESPath to check if more pages exist type: string nextCursorPath: description: JMESPath to extract the next cursor from the nextQuery response. type: string nextDataPath: description: JMESPath to extract records from the nextQuery response. type: string nextQuery: description: >- GraphQL query used to fetch subsequent pages when the API requires a different query to continue a cursor. Example: monday.com fetches the first page via boards { items_page }, then continues with next_items_page(cursor). type: string required: - cursorPath type: object OffsetPaginationConfig: description: Configuration for offset-based pagination. properties: defaultLimit: description: Default page size format: int64 type: integer limitParam: description: 'Query parameter name for limit (default: ''limit'')' type: string maxLimit: description: Maximum page size allowed by API format: int64 type: integer nextPageLinkPath: description: >- When set, offset pagination mirrors TestRail-style responses: continue only while this path is non-null (e.g. `_links.next`), and advance offset by `defaultLimit` per page instead of the returned record count. type: string offsetParam: description: 'Query parameter name for offset (default: ''offset'')' type: string totalPath: description: JMESPath to extract total count type: string required: - defaultLimit type: object PageNumberPaginationConfig: description: Configuration for page number pagination. properties: defaultPageSize: description: Default page size format: int64 type: integer pageParam: description: 'Query parameter name for page (default: ''page'')' type: string pageSizeParam: description: 'Query parameter name for page size (default: ''per_page'')' type: string paramLocation: description: Where page/pageSize travel for POST endpoints (body or query). type: string totalPagesPath: description: JMESPath to extract total pages type: string required: - defaultPageSize type: object SessionPagePaginationConfig: description: Configuration for Mixpanel-style session_id + page pagination. properties: defaultPageSize: description: Default page size used to detect the last page format: int64 type: integer pageParam: description: 'Query/body parameter name for page (default: ''page'')' type: string pagePath: description: JMESPath to extract the current page from the response type: string sessionIdParam: description: 'Query/body parameter name for session id (default: ''session_id'')' type: string sessionIdPath: description: JMESPath to extract session id from the response type: string required: - defaultPageSize type: object PaginationTypeEnum: description: Pagination strategy for API endpoints. enum: - link_header - cursor - offset - page_number - session_page - none type: string RestBatchConfig: description: >- Batch packer configuration for Google-style multipart/mixed batch endpoints (e.g., Gmail https://gmail.googleapis.com/batch/gmail/v1, Drive https://www.googleapis.com/batch/drive/v3). Used to bundle high-cardinality detail fetches (one sub-request per parent record) into a single HTTP round trip. Requires the tap's pagination type to be `none` (one sub-response per parent). `perParentAuth` is optional: when present each sub-request is authed per parent (DWD), when absent the outer POST's auth applies to all sub-requests. properties: endpoint: description: |- Multipart batch endpoint URL. Always invoked with POST and `Content-Type: multipart/mixed; boundary=...`. type: string format: description: >- Batch wire format. Null or absent = Google-style multipart/mixed (default). "json" = JSON batch (e.g., Microsoft Graph $batch, OData $batch). type: string maxSubRequests: description: |- Maximum sub-requests packed into a single multipart body. Google recommends <= 100 sub-requests per batch. Typical value: 50. format: double type: number required: - endpoint - maxSubRequests type: object BodyEncodingEnum: description: Serialization of a POST/PUT/PATCH request body for a REST endpoint. enum: - json - form type: string HttpMethodEnum: description: HTTP method for API calls. enum: - GET - POST - PUT - PATCH - DELETE type: string ParentDataFilterBodyInject: description: |- When set on RestEndpointConfig, the tap (typically a root tap) injects ingestionConfig.parentDataFilters[filterKey].values into requestBody at bodyPath. No parent-tap fan-out or frontier is required. properties: bodyPath: description: >- Top-level requestBody key that receives the values array. Example: 'userPrincipalNameFilters' for Microsoft Purview audit queries. type: string field: description: >- Expected parentDataFilters[filterKey].field. Values are injected as-is when the field matches; field mismatch or empty values skip the tap (fail closed). When the filter key is absent, the body key is omitted (workspace-wide). type: string filterKey: description: Key under ingestionConfig.parentDataFilters (e.g. 'users'). type: string required: - filterKey - bodyPath - field type: object ParentDataFilterQueryInject: description: >- When set on RestEndpointConfig, the tap injects ingestionConfig.parentDataFilters[filterKey].values into a query parameter. Two modes: 1) OData expression (Microsoft): set clauseTemplate + join/combine operators to build a $filter string. 2) Repeated list values (Claude Compliance actor_ids[]): omit clauseTemplate; values are passed as a list on queryParam (doseq-encoded). properties: chunkSize: description: >- Max values per request. Null uses the runtime default (10 for OData mode, 50 for repeated-list mode). Both defaults keep the encoded query string under the common 8KB request-line cap. format: double type: number clauseTemplate: description: >- Per-value clause with '{value}' placeholder for OData expression mode. Example: "userPrincipalName eq '{value}'". Null selects repeated-list mode (values set as a list on queryParam). type: string combineOperator: $ref: '#/components/schemas/ParentDataFilterCombineOperatorEnum' description: |- How to combine the joined clauses with an existing queryParam value (OData mode only). When the query param is absent, only the joined clauses are used. field: description: >- Expected parentDataFilters[filterKey].field. Values are injected when the field matches; field mismatch or empty values skip the tap (fail closed). When the filter key is absent, no inject runs (workspace-wide). type: string filterKey: description: Key under ingestionConfig.parentDataFilters (e.g. 'users'). type: string joinOperator: $ref: '#/components/schemas/ParentDataFilterJoinOperatorEnum' description: How to join multiple value clauses (OData mode only). normalize: $ref: '#/components/schemas/ParentDataFilterNormalizeEnum' description: Optional value normalization before render / inject. queryParam: description: |- Query parameter name that receives the filter. Examples: '$filter' (OData), 'actor_ids[]' (repeated list). type: string required: - filterKey - field - queryParam type: object QualityRuleTypeEnum: description: |- Discriminator literal for the QualityRuleConfig union variants. The wire/storage value is the snake_case form. enum: - null_rate - dupe_rate - timestamp_coverage - temporal_order - no_future_timestamp - timeline_gaps - string_pattern_rate - referential_integrity - row_count_not_suspicious type: string ParentDataFilterCombineOperatorEnum: description: |- How parentDataFilterQueryInject combines joined clauses with an existing query param value (typically a time-window $filter). enum: - and - or type: string ParentDataFilterJoinOperatorEnum: description: How parentDataFilterQueryInject joins multiple per-value clauses. enum: - or - and type: string ParentDataFilterNormalizeEnum: description: |- Optional value normalization before parentDataFilterQueryInject renders clauseTemplate. Unrecognized values must fail at schema validation time (not silently no-op at runtime). enum: - lowercase type: string securitySchemes: bearerAuth: bearerFormat: JWT scheme: bearer type: http ````