@opengeni/api-router 3.1.3-canary.38890816741001 → 3.2.2

package/src/mcp/action-schema-imports.gen.ts

@@ -1,6 +1,6 @@
 // Generated by scripts/public-api/action-catalog.ts. Do not edit.
 // Named imports keep unrelated response and tool validators out of the API graph.
-import { AcceptOrganizationInvitationRequest, AcceptOrganizationRecoveryCustodyRequest, AcknowledgeStreamRequest, ActivateCodexRealtimeConnectionRequest, ActivateCompanyProfileRevisionRequest, ActivatePreferenceRegistryRevisionRequest, ActivateWorkspaceInstructionPolicyRequest, AddDocumentRequest, AddWorkspaceMemberRequest, AgentInstructionReviewRequest, AgentLearningContext, ApiIntegrationOAuthStartRequest, AppendArchivedSessionEventsRequest, ApplySessionGoalRevisionRequest, ApproveSlackUserLinkAccessRequest, ArtifactCatalogKind, AtlassianLifecycleActionRequest, AttachViewerRequest, BeginSessionRealtimeRequest, BrowserActionRequest, BrowserDomReadRequest, BrowserDownloadSaveRequest, BrowserOpenTargetRequest, BrowserSessionAttachmentRequest, BrowserSessionLifecycleRequest, ChangeMachineAudienceRequest, ChangePreferenceRegistryScopeRequest, ClaudeSubscriptionOAuthCompleteRequest, ClaudeSubscriptionOAuthStartRequest, ClaudeSubscriptionSetupTokenRequest, ClearWorkspaceAllowanceRequest, CodexAppsDesignationRequest, CodexRealtimeWebrtcRequest, CodexSourceRequest, CompanyProfileDiffRequest, ComputerActionRequest, ComputerNativeCallRequest, ComputerSessionAttachmentRequest, ComputerSessionLifecycleRequest, ConfigureOrganizationRecoveryPolicyRequest, CorrectPreferenceRegistryRequest, CreateAdditionalOrganizationRequest, CreateApiKeyRequest, CreateAutomationSourceRequest, CreateAutomationTriggerRequest, CreateBillingPortalRequest, CreateBrowserIdentityRequest, CreateBrowserSessionRequest, CreateCapabilityCatalogItemRequest, CreateChannelRequest, CreateCheckoutRequest, CreateComputerSessionRequest, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFeedbackRequest, CreateFileUploadRequest, CreateInteractionInterventionRequest, CreateKnowledgeDropRequest, CreateNetworkRouteRequest, CreateOrganizationApiKeyRequest, CreateOrganizationInvitationRequest, CreateOrganizationProviderCustomModelRequest, CreateOrganizationRequest, CreateOrganizationServiceAccountRequest, CreateOrganizationWebhookRequest, CreateOrganizationWorkspaceRequest, CreatePersonalApiKeyRequest, CreatePrReviewAppRegistrationRequest, CreatePrReviewRepositoryBindingRequest, CreatePreferenceRegistryProposalRequest, CreateRigRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateSiteAuthConnectionRequest, CreateWorkspaceArtifactRequest, CreateWorkspaceGatewayCustomModelRequest, CreateWorkspaceInstructionPolicyDraftRequest, CreateWorkspaceInstructionPolicyOnboardingProposalRequest, CreateWorkspaceOpenRouterCustomModelRequest, CreateWorkspaceOpperCustomModelRequest, CreateWorkspaceRequest, CreateWorkspaceWebhookRequest, DeactivatePreferenceRegistryRequest, DeleteOrganizationProviderCustomModelRequest, DeleteSessionQueueItemRequest, DeleteWorkspaceGatewayCustomModelRequest, DeleteWorkspaceOpenRouterCustomModelRequest, DeleteWorkspaceOpperCustomModelRequest, DeviceEnrollmentApproveRequest, DisableOrganizationRecoveryPolicyRequest, EditSessionQueueItemRequest, EnableCapabilityRequest, EndSessionRealtimeRequest, EnsureWorkspaceRequest, ExternalAuthInteractiveRequest, ExternalAuthRunRequest, FikenInstallRequest, FikenOAuthStartRequest, FileListRequest, ForkSessionRequest, FsDeleteRequest, FsListBatchRequest, FsListRequest, FsMkdirRequest, FsMoveRequest, FsReadRequest, FsWriteRequest, GatewayRealtimeConnectRequest, GetMyUsageRequest, GetUsageRequest, GitDiffRequest, GitLogRequest, GitReadBatchRequest, GitShowRequest, GitStatusRequest, GrantSessionAdminAccessRequest, GrantWorkspaceCreditsRequest, ImportArchivedSessionRequest, ImportLegacyWorkspaceInstructionPolicyDraftRequest, InboxItem, InboxSettings, InsightsRange, InstallApiIntegrationRequest, InstallLibrarySkillRequest, InstallPluginRequest, InstallSkillRequest, IssueUserResourceGrantRequest, KnowledgeEntryBatchReviewRequest, KnowledgeEntryListRequest, KnowledgeEntryRestoreRequest, KnowledgeEntryReviewRequest, KnowledgeEntrySaveRequest, KnowledgeReviewBatchListRequest, KnowledgeSavePreparationRequest, MachineAudiencePreviewRequest, McpConnectionDecision, MemberNotificationsSetting, MemorySlackPublicationActionRequest, MintEnrollTokenRequest, ModelConnectionAccessPolicy, MoveDocumentRequest, MoveSessionQueueItemRequest, MutateIntegrationFacetRequest, OAuthStartRequest, OpenGeniSlackBotInstallRequest, OpenMachinePrivacySettingsRequest, OrganizationModelProviderKind, OrganizationRecoveryOperationCommandRequest, OrganizationUsagePeriod, PrepareSlackUserLinkAccessRequest, PreviewApiIntegrationRequest, PreviewPluginRequest, PreviewSkillImportRequest, ProposeRigChangeRequest, PtyCloseRequest, PtyOpenRequest, PtyResizeRequest, PtyWriteRequest, PublishBrowserRevisionRequest, PublishSandboxFileArtifactRequest, PublishWorkspaceArtifactVersionRequest, PutOrganizationCredentialProviderRequest, PutOrganizationWorkspaceMemberRequest, PutWorkspaceCredentialProviderRequest, ReclassifyDocumentAuthorityRequest, RefreshScheduledTaskAccessRequest, RejectPreferenceRegistryProposalRequest, RejectSessionGoalRevisionRequest, RemoveEnrollmentRequest, RenewSessionRealtimeRequest, ReorderChannelsRequest, ReportAuthRunRequest, ResolveInteractionInterventionRequest, RetryOrganizationUserSetupDeliveryRequest, RevokeOrganizationInvitationRequest, RevokeOrganizationModelProviderConnectionRequest, RevokeOrganizationWorkspaceMemberRequest, RollbackCompanyProfileRequest, RollbackSessionGoalRevisionRequest, RollbackWorkspaceArtifactRequest, RollbackWorkspaceInstructionPolicyRequest, RotateSessionMcpCredentialsRequest, RunDocumentDefaultCollectionBackfillRequest, SandboxRecoveryRequest, SaveAtlassianSourcesRequest, SaveComposerDraftRequest, SaveNewSessionDraftRequest, SessionCodexAccountPinRequest, SessionControlRequest, SessionHumanInputRequest, SessionInboxMute, SessionMessageSearchRequest, SessionRetryRequest, SessionScopeSubjectId, SessionStatus, SessionVisibility, SetMemberAllowanceRequest, SetSessionModelAccountChoiceRequest, SetSessionUsageLimitRequest, SetWorkspaceAllowanceRequest, SetWorkspaceArtifactStatusRequest, SetWorkspaceDefaultRigRequest, SiteDataCollectionDefinitionRequest, SiteDataImportRequest, SiteDataQueryRequest, SiteDataWriteRequest, SiteLimitProfile, SitePublishWarningFix, SiteSqlExportFormat, SiteSqlImportRequest, SiteSqlMigrationRequest, SiteSqlQueryDefinitionRequest, SiteSqlRunRequest, SiteSqlSettingsRequest, SiteSqlStatementRequest, SiteTakedownRequest, SlackUserLinkAccessMutationRequest, SocialOAuthStartRequest, StartAuthRunRequest, StartOrganizationRecoveryOperationRequest, SteerSessionQueueItemRequest, SubmitComposerDraftRequest, SubscriptionAccountRenameRequest, SubscriptionAccountToggleRequest, SubscriptionConnectPollRequest, SubscriptionRotationSettingsRequest, SupergrokConnectStartRequest, SupersedePreferenceRegistryRequest, SwapActiveSandboxRequest, SyncSessionRealtimeLedgerRequest, TerminalExecRequest, TriggerAutomationManuallyRequest, UninstallApiIntegrationRequest, UninstallPluginRequest, UninstallSkillRequest, UpdateAutomationSourceRequest, UpdateAutomationTriggerRequest, UpdateBrowserIdentityRequest, UpdateChannelRequest, UpdateCompanyProfileAgentPolicyRequest, UpdateCompanyProfileRequest, UpdateConnectionRequest, UpdateConnectorToolPermissionsRequest, UpdateGitHubActionPolicyRequest, UpdateMachineOperationPolicyRequest, UpdateMemorySlackPublicationConfigurationRequest, UpdateModelAccountPreferencesRequest, UpdateNetworkRouteRequest, UpdateOpenGeniSlackBotOrganizationAccess, UpdateOrganizationAgentAdminAccessRequest, UpdateOrganizationApiKeyRequest, UpdateOrganizationIntegrationPolicyRequest, UpdateOrganizationMcpConnectionRequest, UpdateOrganizationMemberRequest, UpdateOrganizationModelAccountSettingsRequest, UpdateOrganizationModelDefaultsRequest, UpdateOrganizationNameRequest, UpdateOrganizationPrivacySettingsRequest, UpdateOrganizationPrivateSessionSettingsRequest, UpdateOrganizationRetentionPolicyRequest, UpdateOrganizationServiceAccountRequest, UpdateOrganizationWebhookRequest, UpdateOrganizationWorkspaceRequest, UpdatePrReviewAppRegistrationRequest, UpdatePrReviewRepositoryBindingRequest, UpdateRigRequest, UpdateScheduledTaskRequest, UpdateSessionAgentRequest, UpdateSessionArchiveRequest, UpdateSessionAttentionRequest, UpdateSessionChannelRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpToolPermissionsRequest, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionRetentionRequest, UpdateSessionSkillsRequest, UpdateSessionToolPolicyRequest, UpdateSessionVisibilityRequest, UpdateSiteAuthConnectionRequest, UpdateSlackChannelRoutesRequest, UpdateVideoGenerationPolicyRequest, UpdateWorkspaceArtifactVisibilityRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelAccountSettingsRequest, UpdateWorkspaceModelPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, UpdateWorkspaceWebhookRequest, UpsertIntegrationFacetRequest, UpsertOrganizationModelProviderConnectionRequest, UpsertSitePublicationRequest, VerifyAuthRunRequest, ViewerHeartbeatRequest, WorkClaimSubjectType, WorkspaceInstructionPolicyDiffRequest, WorkspacePauseTimerRequest } from "@opengeni/contracts";
+import { AcceptOrganizationInvitationRequest, AcceptOrganizationRecoveryCustodyRequest, AcknowledgeStreamRequest, ActivateCodexRealtimeConnectionRequest, ActivateCompanyProfileRevisionRequest, ActivatePreferenceRegistryRevisionRequest, ActivateWorkspaceInstructionPolicyRequest, AddDocumentRequest, AddWorkspaceMemberRequest, AgentInstructionReviewRequest, AgentLearningContext, ApiIntegrationOAuthStartRequest, AppendArchivedSessionEventsRequest, ApplySessionGoalRevisionRequest, ApproveSlackUserLinkAccessRequest, ArtifactCatalogKind, AtlassianLifecycleActionRequest, AttachViewerRequest, BeginSessionRealtimeRequest, BrowserActionRequest, BrowserDomReadRequest, BrowserDownloadSaveRequest, BrowserOpenTargetRequest, BrowserSessionAttachmentRequest, BrowserSessionLifecycleRequest, ChangeMachineAudienceRequest, ChangePreferenceRegistryScopeRequest, ClaudeSubscriptionOAuthCompleteRequest, ClaudeSubscriptionOAuthStartRequest, ClaudeSubscriptionSetupTokenRequest, ClearWorkspaceAllowanceRequest, CodexAppsDesignationRequest, CodexRealtimeWebrtcRequest, CodexSourceRequest, CompanyProfileDiffRequest, ComputerActionRequest, ComputerNativeCallRequest, ComputerSessionAttachmentRequest, ComputerSessionLifecycleRequest, ConfigureOrganizationRecoveryPolicyRequest, CorrectPreferenceRegistryRequest, CreateAdditionalOrganizationRequest, CreateApiKeyRequest, CreateAutomationSourceRequest, CreateAutomationTriggerRequest, CreateBillingPortalRequest, CreateBrowserIdentityRequest, CreateBrowserSessionRequest, CreateCapabilityCatalogItemRequest, CreateChannelRequest, CreateCheckoutRequest, CreateComputerSessionRequest, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFeedbackRequest, CreateFileUploadRequest, CreateInteractionInterventionRequest, CreateKnowledgeDropRequest, CreateNetworkRouteRequest, CreateOrganizationApiKeyRequest, CreateOrganizationInvitationRequest, CreateOrganizationProviderCustomModelRequest, CreateOrganizationRequest, CreateOrganizationServiceAccountRequest, CreateOrganizationWebhookRequest, CreateOrganizationWorkspaceRequest, CreatePersonalApiKeyRequest, CreatePrReviewAppRegistrationRequest, CreatePrReviewRepositoryBindingRequest, CreatePreferenceRegistryProposalRequest, CreateRigRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateSiteAuthConnectionRequest, CreateWorkspaceArtifactRequest, CreateWorkspaceGatewayCustomModelRequest, CreateWorkspaceInstructionPolicyDraftRequest, CreateWorkspaceInstructionPolicyOnboardingProposalRequest, CreateWorkspaceOpenRouterCustomModelRequest, CreateWorkspaceOpperCustomModelRequest, CreateWorkspaceRequest, CreateWorkspaceWebhookRequest, DeactivatePreferenceRegistryRequest, DeleteOrganizationProviderCustomModelRequest, DeleteSessionQueueItemRequest, DeleteWorkspaceGatewayCustomModelRequest, DeleteWorkspaceOpenRouterCustomModelRequest, DeleteWorkspaceOpperCustomModelRequest, DeviceEnrollmentApproveRequest, DisableOrganizationRecoveryPolicyRequest, EditSessionQueueItemRequest, EnableCapabilityRequest, EndSessionRealtimeRequest, EnsureWorkspaceRequest, ExternalAuthInteractiveRequest, ExternalAuthRunRequest, FikenInstallRequest, FikenOAuthStartRequest, FileListRequest, ForkSessionRequest, FsDeleteRequest, FsListBatchRequest, FsListRequest, FsMkdirRequest, FsMoveRequest, FsReadRequest, FsWriteRequest, GatewayRealtimeConnectRequest, GetMyUsageRequest, GetUsageRequest, GitDiffRequest, GitLogRequest, GitReadBatchRequest, GitShowRequest, GitStatusRequest, GrantSessionAdminAccessRequest, GrantWorkspaceCreditsRequest, ImportArchivedSessionRequest, ImportLegacyWorkspaceInstructionPolicyDraftRequest, InboxItem, InboxSettings, InsightsRange, InstallApiIntegrationRequest, InstallLibrarySkillRequest, InstallPluginRequest, InstallSkillRequest, InstallVaultProviderRequest, IssueUserResourceGrantRequest, KnowledgeEntryBatchReviewRequest, KnowledgeEntryListRequest, KnowledgeEntryRestoreRequest, KnowledgeEntryReviewRequest, KnowledgeEntrySaveRequest, KnowledgeReviewBatchListRequest, KnowledgeSavePreparationRequest, MachineAudiencePreviewRequest, McpConnectionDecision, MemberNotificationsSetting, MemorySlackPublicationActionRequest, MintEnrollTokenRequest, ModelConnectionAccessPolicy, MoveDocumentRequest, MoveSessionQueueItemRequest, MutateIntegrationFacetRequest, OAuthStartRequest, OpenGeniSlackBotInstallRequest, OpenMachinePrivacySettingsRequest, OrganizationModelProviderKind, OrganizationRecoveryOperationCommandRequest, OrganizationUsagePeriod, PrepareSlackUserLinkAccessRequest, PreviewApiIntegrationRequest, PreviewPluginRequest, PreviewSkillImportRequest, ProposeRigChangeRequest, PtyCloseRequest, PtyOpenRequest, PtyResizeRequest, PtyWriteRequest, PublishBrowserRevisionRequest, PublishSandboxFileArtifactRequest, PublishWorkspaceArtifactVersionRequest, PutOrganizationCredentialProviderRequest, PutOrganizationWorkspaceMemberRequest, PutWorkspaceCredentialProviderRequest, ReclassifyDocumentAuthorityRequest, RefreshScheduledTaskAccessRequest, RejectPreferenceRegistryProposalRequest, RejectSessionGoalRevisionRequest, RemoveEnrollmentRequest, RenewSessionRealtimeRequest, ReorderChannelsRequest, ReplaceVaultProviderCredentialsRequest, ReportAuthRunRequest, ResolveInteractionInterventionRequest, RetryOrganizationUserSetupDeliveryRequest, RevokeOrganizationInvitationRequest, RevokeOrganizationModelProviderConnectionRequest, RevokeOrganizationWorkspaceMemberRequest, RollbackCompanyProfileRequest, RollbackSessionGoalRevisionRequest, RollbackWorkspaceArtifactRequest, RollbackWorkspaceInstructionPolicyRequest, RotateSessionMcpCredentialsRequest, RunDocumentDefaultCollectionBackfillRequest, SandboxRecoveryRequest, SaveAtlassianSourcesRequest, SaveComposerDraftRequest, SaveNewSessionDraftRequest, SessionCodexAccountPinRequest, SessionControlRequest, SessionHumanInputRequest, SessionInboxMute, SessionMessageSearchRequest, SessionRetryRequest, SessionScopeSubjectId, SessionStatus, SessionVisibility, SetMemberAllowanceRequest, SetSessionModelAccountChoiceRequest, SetSessionUsageLimitRequest, SetWorkspaceAllowanceRequest, SetWorkspaceArtifactStatusRequest, SetWorkspaceDefaultRigRequest, SiteDataCollectionDefinitionRequest, SiteDataImportRequest, SiteDataQueryRequest, SiteDataWriteRequest, SiteLimitProfile, SitePublishWarningFix, SiteSqlExportFormat, SiteSqlImportRequest, SiteSqlMigrationRequest, SiteSqlQueryDefinitionRequest, SiteSqlRunRequest, SiteSqlSettingsRequest, SiteSqlStatementRequest, SiteTakedownRequest, SlackUserLinkAccessMutationRequest, SocialOAuthStartRequest, StartAuthRunRequest, StartOrganizationRecoveryOperationRequest, SteerSessionQueueItemRequest, SubmitComposerDraftRequest, SubscriptionAccountRenameRequest, SubscriptionAccountToggleRequest, SubscriptionConnectPollRequest, SubscriptionRotationSettingsRequest, SupergrokConnectStartRequest, SupersedePreferenceRegistryRequest, SwapActiveSandboxRequest, SyncSessionRealtimeLedgerRequest, TerminalExecRequest, TriggerAutomationManuallyRequest, UninstallApiIntegrationRequest, UninstallPluginRequest, UninstallSkillRequest, UpdateAutomationSourceRequest, UpdateAutomationTriggerRequest, UpdateBrowserIdentityRequest, UpdateChannelRequest, UpdateCompanyProfileAgentPolicyRequest, UpdateCompanyProfileRequest, UpdateConnectionRequest, UpdateConnectorToolPermissionsRequest, UpdateGitHubActionPolicyRequest, UpdateMachineOperationPolicyRequest, UpdateMemorySlackPublicationConfigurationRequest, UpdateModelAccountPreferencesRequest, UpdateNetworkRouteRequest, UpdateOpenGeniSlackBotOrganizationAccess, UpdateOrganizationAgentAdminAccessRequest, UpdateOrganizationApiKeyRequest, UpdateOrganizationIntegrationPolicyRequest, UpdateOrganizationMcpConnectionRequest, UpdateOrganizationMemberRequest, UpdateOrganizationModelAccountSettingsRequest, UpdateOrganizationModelDefaultsRequest, UpdateOrganizationNameRequest, UpdateOrganizationPrivacySettingsRequest, UpdateOrganizationPrivateSessionSettingsRequest, UpdateOrganizationRetentionPolicyRequest, UpdateOrganizationServiceAccountRequest, UpdateOrganizationWebhookRequest, UpdateOrganizationWorkspaceRequest, UpdatePrReviewAppRegistrationRequest, UpdatePrReviewRepositoryBindingRequest, UpdateRigRequest, UpdateScheduledTaskRequest, UpdateSessionAgentRequest, UpdateSessionArchiveRequest, UpdateSessionAttentionRequest, UpdateSessionChannelRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpToolPermissionsRequest, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionRetentionRequest, UpdateSessionSkillsRequest, UpdateSessionToolPolicyRequest, UpdateSessionVisibilityRequest, UpdateSiteAuthConnectionRequest, UpdateSlackChannelRoutesRequest, UpdateVideoGenerationPolicyRequest, UpdateWorkspaceArtifactVisibilityRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelAccountSettingsRequest, UpdateWorkspaceModelPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, UpdateWorkspaceWebhookRequest, UpsertIntegrationFacetRequest, UpsertOrganizationModelProviderConnectionRequest, UpsertSitePublicationRequest, VerifyAuthRunRequest, ViewerHeartbeatRequest, WorkClaimSubjectType, WorkspaceInstructionPolicyDiffRequest, WorkspacePauseTimerRequest } from "@opengeni/contracts";
 
 export const ACTION_REQUEST_SCHEMAS: Readonly<Record<string, unknown>> = {
   AcceptOrganizationInvitationRequest,
@@ -129,6 +129,7 @@ export const ACTION_REQUEST_SCHEMAS: Readonly<Record<string, unknown>> = {
   InstallLibrarySkillRequest,
   InstallPluginRequest,
   InstallSkillRequest,
+  InstallVaultProviderRequest,
   IssueUserResourceGrantRequest,
   KnowledgeEntryBatchReviewRequest,
   KnowledgeEntryListRequest,
@@ -174,6 +175,7 @@ export const ACTION_REQUEST_SCHEMAS: Readonly<Record<string, unknown>> = {
   RemoveEnrollmentRequest,
   RenewSessionRealtimeRequest,
   ReorderChannelsRequest,
+  ReplaceVaultProviderCredentialsRequest,
   ReportAuthRunRequest,
   ResolveInteractionInterventionRequest,
   RetryOrganizationUserSetupDeliveryRequest,

package/src/routes/connections.ts

@@ -89,6 +89,7 @@ import {
   listOwnConnectionAccountsForGrant,
   hasReservedFikenMetadata,
   ONEPASSWORD_CREDENTIAL_ROLE,
+  EXTERNAL_VAULT_CREDENTIAL_ROLE,
   hasReservedOpenGeniSlackBotMetadata,
   isOpenGeniSlackBotConnection,
   openGeniSlackBotMetadata,
@@ -1043,6 +1044,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
             c.req.param("connectionId"),
             grant.subjectId,
           );
+          assertNotReservedExternalVaultMetadata(existing?.metadata);
           if (existing && isOpenGeniSlackBotConnection(existing)) {
             const destination = ConnectorDocumentDestinationSelection.safeParse(
               payload.metadata?.documentDestination,
@@ -1359,6 +1361,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!existing) {
       throw new HTTPException(404, { message: "connection not found" });
     }
+    assertNotReservedExternalVaultMetadata(existing.metadata);
     const expectedVersion = c.req.query("expectedVersion");
     if (expectedVersion !== undefined) {
       if (!/^[1-9]\d*$/.test(expectedVersion) || !Number.isSafeInteger(Number(expectedVersion))) {
@@ -1973,6 +1976,7 @@ function assertNotReservedFikenMetadata(metadata: Record<string, unknown> | unde
 }
 
 function assertNotReservedOnePasswordMetadata(metadata: Record<string, unknown> | undefined): void {
+  assertNotReservedExternalVaultMetadata(metadata);
   if (metadata?.credentialRole === ONEPASSWORD_CREDENTIAL_ROLE) {
     throw new HTTPException(422, {
       message: "1Password connections are created by the verified 1Password install flow",
@@ -1980,6 +1984,19 @@ function assertNotReservedOnePasswordMetadata(metadata: Record<string, unknown>
   }
 }
 
+function assertNotReservedExternalVaultMetadata(
+  metadata: Record<string, unknown> | undefined,
+): void {
+  if (
+    metadata?.credentialRole === EXTERNAL_VAULT_CREDENTIAL_ROLE ||
+    metadata?.vaultProvider !== undefined
+  ) {
+    throw new HTTPException(422, {
+      message: "Vault connections are managed through the verified vault connection flow",
+    });
+  }
+}
+
 function assertNotReservedApiIntegrationOAuthMetadata(
   metadata: Record<string, unknown> | undefined,
 ): void {