Hanzo
OpenapiIntegrations

Binds installations the App ALREADY holds to the org the caller is acting in —…

Binds installations the App ALREADY holds to the org the caller is acting in — the reconciliation for a grant that happened outside our connect flow.

POST /v1/integrations/github/claim

Addresshttps://api.hanzo.ai/v1/integrations/github/claim
MethodPOST
Operationpost_integrations_github_claim
AuthAuthorization: Bearer $HANZO_API_KEY

Binds installations the App ALREADY holds to the org the caller is acting in — the reconciliation for a grant that happened outside our connect flow.

An installation IS the grant: GitHub recorded the consent when the App was installed, and our connection row is bookkeeping that never got written because nobody came through our callback. This writes that row from the App's own view, so 23 accounts granted straight from GitHub stop reading as nothing.

The org is taken from the VALIDATED PRINCIPAL and never from the body, because it is the one part GitHub cannot tell us. An installation carries an account login, a type and a repository selection — nothing that names a Hanzo org. So the binding cannot be DERIVED, only asserted, and the only unforgeable assertion available is the org the caller is already acting in. Inferring one from the account name would be a guess the store cannot catch: its key is (org,provider,owner), so a wrong org is a valid row, and a valid row is a mirror pointed at the wrong tenant.

SUPER ADMIN only, for that same reason. A tenant's proof that an account is theirs is GitHub's own consent screen — the connect flow — and without it any org could claim any account the App holds. Platform sudo is already the scope that reads the whole install list, so it is the scope that may bind from it; giving a tenant this verb would hand it every other tenant's repositories.

Idempotent: the row is keyed (org,provider,owner) and connected_at survives an upsert, so claiming twice rebinds the same account to the same org and reports it under already. Re-claiming also REFRESHES the installation id, so an account reinstalled on GitHub — new id, same login — self-heals instead of minting tokens against a dead installation.

Claiming an account another org holds ADDS this org's row and leaves theirs standing, so no org loses an integration it is using.

Request

2 fields, body application/json (required).

FieldInTypeRequiredDescription
accountsbodystring[]Accounts names GitHub logins the App is installed on ("hanzoai").
allbodybooleanAll binds every account the App holds, instead of naming them.

Response

StatusBodyMeaning
200githubClaimOutok

200 body — 2 fields.

FieldInTypeAlwaysDescription
alreadybodystring[]Already were bound before the call and are unchanged by it.
claimedbodystring[]Claimed are the accounts this call bound.

Failure carries the platform error shape — see Errors.

Examples

hanzo integrations github claim

Integrations API · All Hanzo APIs · Interactive reference

How is this guide?

On this page