Skip to content
GitmoapAPIBeta
Integrateprovider-connections
POST/groups/{group_id}/provider-connections

Create a provider connection for a group

create_group_connection
  • provider_connection:manage
    A token needs the provider_connection:manage scope: Manage provider connection credentialsGranted by write_api.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

  • Quota · provider connections per scope

    x-gitmoap-quota: {"kind":"enforced","arg":"provider_connections_per_scope"}

Stores, under a name, what a pipeline provider needs to reach an outside service, for use by pipelines in every repository beneath the group. A connection either holds static credentials, checked against the provider's credentials schema and stored encrypted, or names an identity to assume through OIDC federation, which stores no secret and works only with providers that support it. A connection's name is unique per provider within the group, and a group holds a limited number of connections, set by its plan. Answers 501 when this installation has no secret storage configured. Owners of the group.

Parameters

Path
  • group_idGroupId (string · uuid)Group id

Request body

application/json
  • nameProviderConnectionName (string)
  • provider_idProviderId (string)
  • auth_modeConnectionAuthModestatic_credentialsoidc_federationoptionalHow the connection authenticates. Defaults to static_credentials.
  • config_overridesobjectoptional
  • credentialsobjectoptionalThe provider's credentials, in the shape its auth_schema describes. Required for static_credentials; refused for oidc_federation.
  • federation_targetOidcFederationTarget or nulloptionalThe federation target. Required for oidc_federation; absent for static_credentials.
    • The OidcFederationTarget schema
    • cloudaws
    • role_arnRoleArn (string)The IAM role the pipeline assumes.
    • audiencestring or nulloptionalThe audience of the identity token. Defaults to sts.amazonaws.com.
    • regionAwsRegion (string) or nulloptionalThe AWS region for the provider's calls.
Request body exampleSynthesized example
{
"name": "payments-api",
"provider_id": "c1ef4d25-ebe2-4c91-8968-f0a8d1757c96"
}

Responses

201Connection createdapplication/json
  • auth_modeConnectionAuthModestatic_credentialsoidc_federationHow this connection authenticates.
  • created_atstring
  • created_byActorSummary
  • idConnectionId (string · uuid)
  • nameProviderConnectionName (string)
  • provider_idProviderId (string)
  • scope_idstring
  • scope_typeScopeTypegrouprepository
  • secret_refsobjectThe names of the stored credential fields, each with a reference to where it is stored. Never the values. Empty for an oidc_federation connection.
  • config_overridesobjectoptional
  • federation_targetOidcFederationTarget or nulloptionalThe cloud role the connection assumes. Present only when auth_mode is oidc_federation.
    • The OidcFederationTarget schema
    • cloudaws
    • role_arnRoleArn (string)The IAM role the pipeline assumes.
    • audiencestring or nulloptionalThe audience of the identity token. Defaults to sts.amazonaws.com.
    • regionAwsRegion (string) or nulloptionalThe AWS region for the provider's calls.
  • last_rotated_atstring or nulloptional
201 exampleSynthesized example
{
"auth_mode": "static_credentials",
"created_at": "2026-10-08T22:02:06Z",
"created_by": {
"email": "lin@acme.example",
"id": "id-77aa",
"username": "lin",
"avatar_url": "https://gitmoap.example/acme/6d8e7a52"
},
"id": "8bc45f0c-b73b-4d75-9ce6-97929b80b22d",
"name": "payments-api",
"provider_id": "651f3006-f897-4517-b35d-d0e7e26443b7",
"scope_id": "66a464a9-256f-4e0e-a643-2e1c74c0f700",
"scope_type": "group",
"secret_refs": {
"secret_refs": "secret-refs-13bb"
},
"config_overrides": {},
"federation_target": {
"cloud": "aws",
"role_arn": "role-arn-fb60",
"audience": "audience-de02",
"region": "region-5bfb"
},
"last_rotated_at": "2026-10-10T08:35:31Z"
}
400application/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-1df1",
"message": "Pin a page's payload to the build that rendered it"
}
}
401application/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-8a27",
"message": "Inline scalar newtypes but keep their brand"
}
}
403application/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-6f12",
"message": "Inline scalar newtypes but keep their brand"
}
}
404application/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-cb3a",
"message": "Inline scalar newtypes but keep their brand"
}
}
409application/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-7645",
"message": "Inline scalar newtypes but keep their brand"
}
}
422Credentials supplied for an OIDC-federation connectionapplication/json
Error codes
  • UNPROCESSABLE_ENTITYThe request is well-formed but asks for something the resource's rules do not allow; reason says which
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
422 exampleSynthesized example
{
"error": {
"code": "code-2f16",
"message": "Label every synthesized example"
}
}
429Provider-connection limit reached for this groupapplication/json
Error codes
  • TOO_MANY_REQUESTSRetryableA quota, a rate limit or a transfer budget is spent. When the response carries Retry-After, retry after that many seconds
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
429 exampleSynthesized example
{
"error": {
"code": "code-619c",
"message": "Pin a page's payload to the build that rendered it"
}
}
501Provider connections are not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-3b8e",
"message": "Inline scalar newtypes but keep their brand"
}
}

CLI

gitmoap provider-connections create-group-connection

  • --group-ididGroup id (id or group path)
  • --auth-modestatic_credentials | oidc_federationoptionalHow the connection authenticates. Defaults to `static_credentials`.
  • --config-overridesjsonoptional
  • --credentialsjsonoptionalThe provider's credentials, in the shape its `auth_schema` describes. Required for `static_credentials`; refused for `oidc_federation`.
  • --federation-targetjsonoptional
  • --namestring
  • --provider-idstring

Used in these guides