post_v1_integrations_provider_connect

Acquires the org's credential for one provider. It has TWO paths and the REQUEST picks which: a "token" key in the body seals that credential directly (verify-before-store), and its absence begins the 3-legged OAuth flow — minting a single-use nonce plus an HMAC-signed state that binds this org to this provider, and answering with the provider's authorize URL for the caller to redirect to.

Fail-closed order, unchanged: no principal → 403; unknown provider → 404; an AdminOnly connector without the caller's own-org admin bit → 403; not configured → 503; KMS not ready → 503 (the flow WILL need to seal a token, so refuse now rather than dead-end at the callback).


Tool	`post_v1_integrations_provider_connect`
Door	`https://api.hanzo.ai/v1/mcp`
Method	`tools/call` (JSON-RPC 2.0)
Arguments	3
Operation	`POST /v1/integrations/{provider}/connect`
Product	integrations

Arguments

Field	Type	Required	Default	Description
`accountId`	`string`	—	—	AccountID is the provider account the credential should be scoped to, for the providers whose Verify needs one (Cloudflare). Ignored by the OAuth path.
`provider`	`string`	—	—	Provider is the connector's registry id, from the :provider path segment.
`token`	`string`	—	—	Token is the customer's provider credential. Its PRESENCE — not its value — is what selects the apikey seal over the OAuth flow for a provider that offers both: {"token":"…"}, even empty, is an apikey attempt (→ verify, which answers the "token required" 400 on an empty value), while a body with no token key (the console Connect button, `hanzo connector add` with no --token) starts OAuth. Read on STDIN by the CLI, never argv; never logged or echoed.

This tool's schema does not declare which fields are required, nor any default, nor any enumerated value set. The columns above are empty because the door publishes nothing there, not because the answer is "none" — where a field is constrained, the constraint is stated in that field's own description.

Call it

A tools/call carries every argument in one flat object — nothing binds to a path or a query string. Every declared argument is shown, because the door marks none of them required.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "post_v1_integrations_provider_connect",
         "arguments": {
           "accountId": "<accountId>",
           "provider": "<provider>",
           "token": "<token>"
         }
       }
     }'

Values are placeholders derived from each field's declared type. tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →

The operation behind it

Operation	Route	Product	Summary
`cloud_post_v1_integrations_provider_connect`	`POST /v1/integrations/{provider}/connect`	integrations	Acquires the org's credential for one provider.

The same capability over plain HTTP is in the integrations API reference, on https://api.hanzo.ai.

All 834 tools · The door · API reference

Generated from tools/list on https://api.hanzo.ai/v1/mcp — 834 tools captured 2026-08-01 (this build read the vendored copy; the door was unreachable).

post_v1_integrations_provider_connect

Arguments

Call it

The operation behind it

On this page