@opengeni/api-router 3.1.3-canary.38890816741001 → 3.3.0

package/src/mcp/action-catalog.gen.ts

@@ -1281,7 +1281,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -1289,6 +1292,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -1306,6 +1310,28 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": []
   },
+  {
+    "id": "DELETE /v1/workspaces/:workspaceId/vault-providers/connections/:connectionId",
+    "method": "DELETE",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId",
+    "request": [],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "DELETE /v1/workspaces/:workspaceId/vaults/:vaultId",
     "method": "DELETE",
@@ -1313,7 +1339,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -1321,6 +1350,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -1511,7 +1541,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -1519,6 +1552,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -1810,8 +1844,11 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     ],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "EnsureWorkspaceResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -1819,6 +1856,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -2074,7 +2112,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -2082,6 +2123,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -2092,7 +2134,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -2100,6 +2145,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -2238,7 +2284,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -2246,6 +2295,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -2287,6 +2337,28 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "ToolGatewayDeclarationsResponse"
     ]
   },
+  {
+    "id": "GET /v1/workspaces/:workspaceId/vault-providers/connections",
+    "method": "GET",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections",
+    "request": [],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "GET /v1/workspaces/:workspaceId/vaults",
     "method": "GET",
@@ -2294,7 +2366,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -2302,6 +2377,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -2312,7 +2388,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -2320,6 +2399,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -2349,7 +2429,22 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "method": "GET",
     "path": "/v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance",
     "request": [],
-    "response": []
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
   },
   {
     "id": "GET /v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance/state",
@@ -2363,7 +2458,22 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "method": "GET",
     "path": "/v1/workspaces/external/:workspaceSource/:workspaceExternalId/usage",
     "request": [],
-    "response": []
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
   },
   {
     "id": "GET /v1/workspaces/external/:workspaceSource/:workspaceExternalId/usage/me",
@@ -2585,7 +2695,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "ConnectionMetadata",
       "ConnectionResponse",
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -2593,6 +2706,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -3355,7 +3469,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -3363,6 +3480,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary",
       "Workspace"
     ]
@@ -3686,7 +3804,21 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "ImportArchivedSessionRequest"
     ],
     "response": [
-      "ImportArchivedSessionResponse"
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "ImportArchivedSessionResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
     ]
   },
   {
@@ -5101,7 +5233,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5109,6 +5244,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5234,7 +5370,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5242,6 +5381,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5252,7 +5392,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5260,6 +5403,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5511,6 +5655,52 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "ToolGatewayTargetApprovalResponse"
     ]
   },
+  {
+    "id": "POST /v1/workspaces/:workspaceId/vault-providers/connections",
+    "method": "POST",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections",
+    "request": [
+      "InstallVaultProviderRequest"
+    ],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
+  {
+    "id": "POST /v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/verify",
+    "method": "POST",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/verify",
+    "request": [],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "POST /v1/workspaces/:workspaceId/vaults",
     "method": "POST",
@@ -5518,7 +5708,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5526,6 +5719,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5578,7 +5772,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5586,6 +5783,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5796,7 +5994,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5804,6 +6005,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5837,7 +6039,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -5845,6 +6050,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary"
     ]
   },
@@ -5855,12 +6061,51 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     "request": [],
     "response": []
   },
+  {
+    "id": "PUT /v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/credentials",
+    "method": "PUT",
+    "path": "/v1/workspaces/:workspaceId/vault-providers/connections/:connectionId/credentials",
+    "request": [
+      "ReplaceVaultProviderCredentialsRequest"
+    ],
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
+  },
   {
     "id": "PUT /v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance",
     "method": "PUT",
     "path": "/v1/workspaces/external/:workspaceSource/:workspaceExternalId/allowance",
     "request": [],
-    "response": []
+    "response": [
+      "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
+      "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
+      "OnePasswordConnectionSummary",
+      "ProviderVaultMeta",
+      "RevealVaultFieldResponse",
+      "SessionSecretsView",
+      "VaultFieldVersionMeta",
+      "VaultItem",
+      "VaultItemSummary",
+      "VaultProviderConnectionSummary",
+      "VaultSummary"
+    ]
   },
   {
     "id": "PUT /v1/workspaces/external/:workspaceSource/:workspaceExternalId/members/:subjectId/allowance",
@@ -7858,7 +8103,10 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
     ],
     "response": [
       "DisconnectOnePasswordResponse",
+      "DisconnectVaultProviderResponse",
       "InstallOnePasswordResponse",
+      "InstallVaultProviderResponse",
+      "ListVaultProviderConnectionsResponse",
       "OnePasswordConnectionSummary",
       "ProviderVaultMeta",
       "RevealVaultFieldResponse",
@@ -7866,6 +8114,7 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "VaultFieldVersionMeta",
       "VaultItem",
       "VaultItemSummary",
+      "VaultProviderConnectionSummary",
       "VaultSummary",
       "Workspace"
     ]

package/src/mcp/action-descriptions.ts

@@ -24,6 +24,36 @@ const PROVIDERS: Record<string, string> = {
 };
 
 const RULES: Rule[] = [
+  {
+    method: "GET",
+    pattern: /\/vault-providers\/connections$/,
+    text: () =>
+      "List connected password managers and deployment availability: 1Password, Proton Pass, Keeper, Bitwarden and external vaults. Returns connection metadata and setup status, not secret values; does not contact providers.",
+  },
+  {
+    method: "POST",
+    pattern: /\/vault-providers\/connections$/,
+    text: () =>
+      "Connect Proton Pass, Keeper Secrets Manager, a customer-controlled Bitwarden bridge or an external vault. Set ownership and provider-specific credentials. Saved-but-pending setup returns a connection ID; register it with a remote host if needed, then verify using the saved credentials.",
+  },
+  {
+    method: "PUT",
+    pattern: /\/vault-providers\/connections\/:connectionId\/credentials$/,
+    text: () =>
+      "Replace a connected password manager's credentials without changing its vault links. The same upstream account must verify successfully; pending verification keeps the previously working credential. Never repeat a consumed Keeper one-time token.",
+  },
+  {
+    method: "POST",
+    pattern: /\/vault-providers\/connections\/:connectionId\/verify$/,
+    text: () =>
+      "Finish a pending vault connection using its already saved credentials. Checks the provider and discovers available vaults without resubmitting a Keeper bootstrap token or remote signing key.",
+  },
+  {
+    method: "DELETE",
+    pattern: /\/vault-providers\/connections\/:connectionId$/,
+    text: () =>
+      "Disconnect a password manager and unlink its local vault mirrors. Removes Opengeni's stored access; never deletes upstream vaults or items.",
+  },
   {
     method: "GET",
     pattern: /\/(codex|claude|supergrok)\/accounts$/,
@@ -276,9 +306,9 @@ const RULES: Rule[] = [
   },
 ];
 
-/** Actions that must carry a description (subscription and model settings). */
+/** Actions that must carry a description (subscriptions, models and vault connections). */
 export const DESCRIBED_ACTION_PATH =
-  /\/(codex|claude|supergrok)(\/|$)|\/model-providers\/|\/model-connections\/|\/model-account-settings(\/|$)/;
+  /\/(codex|claude|supergrok)(\/|$)|\/model-providers\/|\/model-connections\/|\/model-account-settings(\/|$)|\/vault-providers\//;
 
 function scopeOf(path: string): string {
   return path.startsWith("/v1/organizations/") ? "for the organization" : "in a workspace";