scalekit-sdk-python 2.11.0__tar.gz → 2.13.0__tar.gz

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scalekit-sdk-python
-Version: 2.11.0
+Version: 2.13.0
 Summary: Scalekit official Python SDK
 Home-page: https://github.com/scalekit-inc/scalekit-sdk-python
 Author: Team Scalekit
@@ -11,22 +11,22 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: grpcio>=1.64.1
-Requires-Dist: protobuf<7.0.0,>=5.29.5
+Requires-Dist: grpcio<2.0,>=1.81.0
+Requires-Dist: protobuf<8.0.0,>=5.29.5
 Requires-Dist: google>=3.0
-Requires-Dist: requests>=2.32.3
-Requires-Dist: PyJWT>=2.12.0
+Requires-Dist: requests>=2.34.0
+Requires-Dist: PyJWT>=2.13.0
 Requires-Dist: cffi>=1.15.1
-Requires-Dist: cryptography<47,==46.0.6
-Requires-Dist: setuptools<81.0,>=78.1.1
-Requires-Dist: grpcio-status<1.67,>=1.64
+Requires-Dist: cryptography<49,>=46.0.6
+Requires-Dist: setuptools<83.0,>=82.0.1
+Requires-Dist: grpcio-status<2.0,>=1.81.0
 Requires-Dist: protoc-gen-openapiv2>=0.0.1
-Requires-Dist: googleapis-common-protos>=1.72.0
+Requires-Dist: googleapis-common-protos>=1.75.0
 Requires-Dist: deprecation>=2.1.0
-Requires-Dist: python-dotenv~=1.1.1
-Requires-Dist: Faker~=25.8.0
-Requires-Dist: pydantic>=2.10.6
-Requires-Dist: mcp>=1.23.0
+Requires-Dist: python-dotenv<2.0,>=1.2.2
+Requires-Dist: Faker<41.0,>=33.0.0
+Requires-Dist: pydantic>=2.13.4
+Requires-Dist: mcp>=1.27.2
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/_version.py

@@ -1,3 +1,3 @@
 # Single source of truth for the SDK version.
 # Import this in setup.py and scalekit/core.py — never hardcode the version elsewhere.
-__version__ = "2.11.0"
+__version__ = "2.13.0"

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/actions/actions.py

@@ -791,10 +791,22 @@ class ActionClient:
                 organization_id=organization_id,
                 user_id=user_id
             )
-            
-            # If we found it, convert the GetConnectedAccountAuthResponse to CreateConnectedAccountResponse format
+
+            # True upsert: if credentials were supplied, apply them regardless of
+            # the account's current status (PENDING_AUTH, ACTIVE, EXPIRED, DISCONNECTED).
+            if authorization_details:
+                update_response = self.update_connected_account(
+                    connection_name=connection_name,
+                    identifier=identifier,
+                    authorization_details=authorization_details,
+                    organization_id=organization_id,
+                    user_id=user_id,
+                    api_config=api_config
+                )
+                return CreateConnectedAccountResponse(connected_account=update_response.connected_account)
+
             return CreateConnectedAccountResponse(connected_account=existing_response.connected_account)
-            
+
         except ScalekitNotFoundException:
             # Connected account doesn't exist, create a new one
             return self.create_connected_account(
@@ -806,6 +818,9 @@ class ActionClient:
                 api_config=api_config
             )
 
+    #: Alias for :meth:`get_or_create_connected_account` — preferred name for upsert semantics.
+    upsert_connected_account = get_or_create_connected_account
+
     def update_connected_account(
         self,
         connection_name: str,

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/actions/models/custom_provider.py

@@ -84,11 +84,11 @@ class AuthField(BaseModel):
         :rtype: AuthField
         """
         return cls(
-            field_name=d.get("field_name", ""),
-            label=d.get("label", ""),
-            input_type=d.get("input_type", "text"),
-            hint=d.get("hint", ""),
-            required=d.get("required", False),
+            field_name=d.get("field_name") or "",
+            label=d.get("label") or "",
+            input_type=d.get("input_type") or "text",
+            hint=d.get("hint") or "",
+            required=d.get("required") or False,
         )
 
 

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/actions/models/requests/create_connected_account_request.py

@@ -5,7 +5,8 @@ from scalekit.v1.connected_accounts.connected_accounts_pb2 import (
     AuthorizationDetails,
     OauthToken,
     StaticAuth,
-    GoogleDWDAuth
+    GoogleDWDAuth,
+    TrustedIDPAuth
 )
 from google.protobuf import struct_pb2
 
@@ -55,7 +56,19 @@ class CreateConnectedAccountRequest(BaseModel):
                 raise ValueError("authorization_details.google_dwd.subject is required")
             google_dwd = GoogleDWDAuth(subject=subject)
             auth_details = AuthorizationDetails(google_dwd=google_dwd)
-        
+
+        elif self.authorization_details and "trusted_idp" in self.authorization_details:
+            idp_data = self.authorization_details["trusted_idp"]
+            if not isinstance(idp_data, dict):
+                raise ValueError("authorization_details.trusted_idp must be an object")
+            trusted_idp = TrustedIDPAuth(
+                db_user=idp_data.get("db_user", ""),
+                access_key_id=idp_data.get("access_key_id", ""),
+                secret_access_key=idp_data.get("secret_access_key", ""),
+                session_token=idp_data.get("session_token", ""),
+            )
+            auth_details = AuthorizationDetails(trusted_idp=trusted_idp)
+
         # Handle api_config if provided
         api_config_struct = None
         if self.api_config:

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/actions/models/requests/update_connected_account_request.py

@@ -5,7 +5,8 @@ from scalekit.v1.connected_accounts.connected_accounts_pb2 import (
     AuthorizationDetails,
     OauthToken,
     StaticAuth,
-    GoogleDWDAuth
+    GoogleDWDAuth,
+    TrustedIDPAuth
 )
 from google.protobuf import struct_pb2
 
@@ -57,6 +58,18 @@ class UpdateConnectedAccountRequest(BaseModel):
             google_dwd = GoogleDWDAuth(subject=subject)
             auth_details = AuthorizationDetails(google_dwd=google_dwd)
 
+        elif self.authorization_details and "trusted_idp" in self.authorization_details:
+            idp_data = self.authorization_details["trusted_idp"]
+            if not isinstance(idp_data, dict):
+                raise ValueError("authorization_details.trusted_idp must be an object")
+            trusted_idp = TrustedIDPAuth(
+                db_user=idp_data.get("db_user", ""),
+                access_key_id=idp_data.get("access_key_id", ""),
+                secret_access_key=idp_data.get("secret_access_key", ""),
+                session_token=idp_data.get("session_token", ""),
+            )
+            auth_details = AuthorizationDetails(trusted_idp=trusted_idp)
+
         # Handle api_config if provided
         api_config_struct = None
         if self.api_config:

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/actions/models/responses/get_connected_account_auth_response.py

@@ -68,6 +68,15 @@ class ConnectedAccount(BaseModel):
                     "token_expires_at": dwd.token_expires_at.ToDatetime() if dwd.HasField("token_expires_at") else None,
                 }
                 authorization_details["google_dwd"] = dwd_dict
+            elif which == "trusted_idp":
+                idp = proto_account.authorization_details.trusted_idp
+                authorization_details["trusted_idp"] = {
+                    "db_user": idp.db_user,
+                    "access_key_id": idp.access_key_id,
+                    "secret_access_key": idp.secret_access_key,
+                    "session_token": idp.session_token,
+                    "expiry": idp.expiry.ToDatetime() if idp.HasField("expiry") else None,
+                }
 
         # Convert api_config protobuf Struct to dict
         api_config_dict = None

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/common/exceptions.py

@@ -103,11 +103,41 @@ class ScalekitServerException(ScalekitException):
                 if not self._error_code:
                     self._error_code = info.error_code
 
+    @staticmethod
+    def _extract_error_code(error: grpc.RpcError) -> str | None:
+        """ Extract error_code from gRPC trailing metadata without constructing a full exception """
+        from grpc_status import rpc_status
+        try:
+            status = rpc_status.from_call(error)
+            if status is None:
+                return None
+            for detail in status.details:
+                info = ErrorInfo()
+                detail.Unpack(info)
+                if info.error_code:
+                    return info.error_code
+        except Exception:
+            pass
+        return None
+
     @staticmethod
     def promote(error: Response | grpc.RpcError):
         """ Promote a ScalekitServerException (Response or RpcError) to a specific error type """
         grpc_status = HTTP_TO_GRPC.get(error.status_code) if isinstance(error, Response) else error.code()
 
+        # Check for upstream provider errors signaled by error_code == "TOOL_ERROR"
+        if isinstance(error, grpc.RpcError):
+            error_code = ScalekitServerException._extract_error_code(error)
+            if error_code == "TOOL_ERROR":
+                if grpc_status == StatusCode.RESOURCE_EXHAUSTED:
+                    return ScalekitToolRateLimitException(error)
+                elif grpc_status == StatusCode.UNAUTHENTICATED:
+                    return ScalekitToolUnauthorizedException(error)
+                elif grpc_status == StatusCode.PERMISSION_DENIED:
+                    return ScalekitToolForbiddenException(error)
+                else:
+                    return ScalekitToolException(error)
+
         if grpc_status == StatusCode.INVALID_ARGUMENT:
             return ScalekitBadRequestException(error)
         elif grpc_status == StatusCode.FAILED_PRECONDITION:
@@ -258,3 +288,52 @@ class ScalekitCancelledException(ScalekitServerException):
 class ScalekitUnknownException(ScalekitServerException):
     def __init__(self, error: Response | grpc.RpcError):
         super().__init__(error)
+
+
+class ScalekitToolException(ScalekitServerException):
+    """ Base class for upstream provider tool errors (error_code == 'TOOL_ERROR') """
+    def __init__(self, error: Response | grpc.RpcError):
+        super().__init__(error)
+        # Extract ToolErrorInfo from the unpacked ErrorInfo details
+        self._tool_error_code = None
+        self._tool_error_message = None
+        self._execution_id = None
+        for info in self._unpacked_details:
+            if info.HasField("tool_error_info"):
+                self._tool_error_code = info.tool_error_info.tool_error_code or None
+                self._tool_error_message = info.tool_error_info.tool_error_message or None
+                self._execution_id = info.tool_error_info.execution_id or None
+                break
+
+    @property
+    def tool_error_code(self):
+        """ Provider-specific error code from tool execution """
+        return self._tool_error_code
+
+    @property
+    def tool_error_message(self):
+        """ Provider-specific error message from tool execution """
+        return self._tool_error_message
+
+    @property
+    def execution_id(self):
+        """ Execution ID for the tool call that failed """
+        return self._execution_id
+
+
+class ScalekitToolRateLimitException(ScalekitToolException, ScalekitTooManyRequestsException):
+    """ Provider returned 429/rate-limit during tool execution """
+    def __init__(self, error: Response | grpc.RpcError):
+        ScalekitToolException.__init__(self, error)
+
+
+class ScalekitToolUnauthorizedException(ScalekitToolException, ScalekitUnauthorizedException):
+    """ Provider returned 401/unauthorized during tool execution """
+    def __init__(self, error: Response | grpc.RpcError):
+        ScalekitToolException.__init__(self, error)
+
+
+class ScalekitToolForbiddenException(ScalekitToolException, ScalekitForbiddenException):
+    """ Provider returned 403/forbidden during tool execution """
+    def __init__(self, error: Response | grpc.RpcError):
+        ScalekitToolException.__init__(self, error)

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/core.py

@@ -10,7 +10,7 @@ from urllib.parse import urlparse
 from cryptography.hazmat.primitives import serialization
 from scalekit._version import __version__ as _sdk_version
 from scalekit.common.scalekit import GrantType
-from scalekit.common.exceptions import ScalekitServerException, ScalekitException
+from scalekit.common.exceptions import ScalekitServerException, ScalekitException, ScalekitTooManyRequestsException
 
 TRequest = TypeVar("TRequest")
 TResponse = TypeVar("TResponse")
@@ -163,12 +163,22 @@ class CoreClient:
             )
             return resp
         except grpc.RpcError as exp:
+            # Check for upstream provider errors first — never retry, never refresh M2M
+            error_code = ScalekitServerException._extract_error_code(exp)
+            if error_code == "TOOL_ERROR":
+                raise ScalekitServerException.promote(exp)
+
             if exp.code() == grpc.StatusCode.UNAUTHENTICATED:
+                if retry <= 0:
+                    raise ScalekitServerException.promote(exp)
                 try:
                     self.__authenticate_client()
                     return self.grpc_exec(func, data, retry=retry-1)
                 except Exception as refresh_exp:
                     raise ScalekitServerException.promote(exp)
+            elif exp.code() == grpc.StatusCode.RESOURCE_EXHAUSTED:
+                # Surface Scalekit rate-limits immediately — retrying triples the damage
+                raise ScalekitServerException.promote(exp)
             elif retry > 0:
                 return self.grpc_exec(func, data, retry=retry - 1)
             else:

{scalekit_sdk_python-2.11.0 → scalekit_sdk_python-2.13.0}/scalekit/v1/connected_accounts/connected_accounts_pb2.py

@@ -22,7 +22,7 @@ from protoc_gen_openapiv2.options import annotations_pb2 as protoc__gen__openapi
 from scalekit.v1.options import options_pb2 as scalekit_dot_v1_dot_options_dot_options__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n7scalekit/v1/connected_accounts/connected_accounts.proto\x12\x1escalekit.v1.connected_accounts\x1a\x1b\x62uf/validate/validate.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1bgoogle/api/visibility.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a.protoc-gen-openapiv2/options/annotations.proto\x1a!scalekit/v1/options/options.proto\"\x8e\x10\n\x1cListConnectedAccountsRequest\x12\xb1\x01\n\x0forganization_id\x18\x01 \x01(\tB\x82\x01\x92\x41v2]Filter by organization ID. Returns only connected accounts associated with this organization.J\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12\x91\x01\n\x07user_id\x18\x02 \x01(\tBs\x92\x41g2MFilter by user ID. Returns only connected accounts associated with this user.J\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdf\x01\n\tconnector\x18\x03 \x01(\tB\xbb\x01\x92\x41\x99\x01\x32\x8c\x01\x46ilter by connector type (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xdb\x01\n\nidentifier\x18\x04 \x01(\tB\xb5\x01\x92\x41\xa8\x01\x32\x91\x01\x46ilter by account identifier. The unique identifier for the connected account within the third-party service (e.g., email address, workspace ID).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12\x9d\x01\n\x08provider\x18\x05 \x01(\tB\x80\x01\x92\x41t2hFilter by OAuth provider. The authentication provider name such as \'google\', \'microsoft\', \'github\', etc.J\x08\"google\"\xbaH\x06r\x04\x10\x00\x18\x32R\x08provider\x12\x9b\x01\n\tpage_size\x18\x06 \x01(\rB~\x92\x41r2lMaximum number of connected accounts to return per page. Must be between 0 and 100. Default is typically 10.J\x02\x31\x30\xbaH\x06*\x04\x10\x64(\x00R\x08pageSize\x12\xcb\x01\n\npage_token\x18\x07 \x01(\tB\xab\x01\x92\x41\x9e\x01\x32\x83\x01Pagination token from a previous response. Use the next_page_token value from ListConnectedAccountsResponse to fetch the next page.J\x16\"eyJvZmZzZXQiOjEwfQ==\"\xbaH\x06r\x04\x10\x00\x18\x64R\tpageToken\x12\xa7\x01\n\x05query\x18\x08 \x01(\tB\x90\x01\x92\x41\x83\x01\x32qText search query to filter connected accounts by name, identifier, or other searchable fields. Case-insensitive.J\x0e\"john@example\"\xbaH\x06r\x04\x10\x00\x18\x64R\x05query\x12\xb8\x02\n\x10\x63onnection_names\x18\t \x03(\tB\x8c\x02\x92\x41\xe3\x01\x32\xc8\x01\x46ilter by one or more connection names (exact match). Returns connected accounts belonging to any of the specified connections. Max 20 names per request. Cannot be combined with the `connector` field.J\x13[\"notion\", \"slack\"]\xa0\x01\x14\xbaH\"\x92\x01\x1f\x10\x14\"\x1br\x19\x10\x01\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$R\x0f\x63onnectionNames:\xb7\x01\xbaH\xb3\x01\x1a\xb0\x01\n&connector_or_connection_names_not_both\x12Jconnector and connection_names are mutually exclusive \xe2\x80\x94 provide only one\x1a:!(has(this.connector) && this.connection_names.size() > 0)B\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifier\"\xbb\x06\n\x1dListConnectedAccountsResponse\x12\xdc\x01\n\x12\x63onnected_accounts\x18\x01 \x03(\x0b\x32\x37.scalekit.v1.connected_accounts.ConnectedAccountForListBt\x92\x41q2oList of connected accounts matching the filter criteria. Excludes sensitive authorization details for security.R\x11\x63onnectedAccounts\x12\x99\x01\n\ntotal_size\x18\x02 \x01(\rBz\x92\x41w2pTotal count of connected accounts matching the filter criteria across all pages. Use for calculating pagination.J\x03\x31\x30\x30R\ttotalSize\x12\xd2\x01\n\x0fnext_page_token\x18\x03 \x01(\tB\xa9\x01\x92\x41\x9c\x01\x32\x81\x01Pagination token for retrieving the next page. Empty if this is the last page. Pass this value to page_token in the next request.J\x16\"eyJvZmZzZXQiOjIwfQ==\"\xbaH\x06r\x04\x10\x00\x18 R\rnextPageToken\x12\xc9\x01\n\x0fprev_page_token\x18\x04 \x01(\tB\xa0\x01\x92\x41\x93\x01\x32}Pagination token for retrieving the previous page. Empty if this is the first page. Pass this value to page_token to go back.J\x12\"eyJvZmZzZXQiOjB9\"\xbaH\x06r\x04\x10\x00\x18 R\rprevPageToken\"\xe0\x06\n\x1eSearchConnectedAccountsRequest\x12\xb9\x01\n\x05query\x18\x01 \x01(\tB\xa2\x01\x92\x41\x91\x01\x32\x86\x01Search term to match against connected account identifiers, providers, or connectors. Must be at least 3 characters. Case insensitive.J\x06google\xbaH\nr\x05\x10\x03\x18\xc8\x01\xc8\x01\x01R\x05query\x12\x85\x01\n\tpage_size\x18\x02 \x01(\rBh\x92\x41^2XMaximum number of connected accounts to return per page. Value must be between 1 and 30.J\x02\x33\x30\xbaH\x04*\x02\x18\x1eR\x08pageSize\x12\xa5\x01\n\npage_token\x18\x03 \x01(\tB\x85\x01\x92\x41\x81\x01\x32\x61Token from a previous response for pagination. Provide this to retrieve the next page of results.J\x1c\x65yJwYWdlIjoyLCJsaW1pdCI6MzB9R\tpageToken\x12i\n\rconnection_id\x18\x04 \x01(\tBD\x92\x41\x38\x32*Connection ID to filter connected accountsJ\n\"conn_123\"\xbaH\x06r\x04\x10\x00\x18 R\x0c\x63onnectionId:\xe6\x01\x92\x41\xe2\x01\n\x9c\x01*\x19Search Connected Accounts2\x7fSearch for connected accounts in your environment using a text query that matches against identifiers, providers, or connectors2Aquery=google&page_size=30&page_token=eyJwYWdlIjoyLCJsaW1pdCI6MzB9\"\x87\x05\n\x1fSearchConnectedAccountsResponse\x12\xcc\x01\n\x12\x63onnected_accounts\x18\x01 \x03(\x0b\x32\x37.scalekit.v1.connected_accounts.ConnectedAccountForListBd\x92\x41\x61\x32_List of connected accounts matching the search query. Excludes sensitive authorization details.R\x11\x63onnectedAccounts\x12l\n\ntotal_size\x18\x02 \x01(\rBM\x92\x41J2CTotal count of accounts matching the search query across all pages.J\x03\x31\x30\x30R\ttotalSize\x12\x91\x01\n\x0fnext_page_token\x18\x03 \x01(\tBi\x92\x41]2CPagination token for the next page. Empty if this is the last page.J\x16\"eyJvZmZzZXQiOjMwfQ==\"\xbaH\x06r\x04\x10\x00\x18 R\rnextPageToken\x12\x92\x01\n\x0fprev_page_token\x18\x04 \x01(\tBj\x92\x41^2HPagination token for the previous page. Empty if this is the first page.J\x12\"eyJvZmZzZXQiOjB9\"\xbaH\x06r\x04\x10\x00\x18 R\rprevPageToken\"\xa0\x08\n\x1d\x43reateConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12\xbd\x02\n\x11\x63onnected_account\x18\x05 \x01(\x0b\x32\x36.scalekit.v1.connected_accounts.CreateConnectedAccountB\xd7\x01\x92\x41\xcd\x01\x32*Details of the connected account to createJ\x9e\x01{ \"authorization_type\": \"OAUTH2\", \"authorization_details\": { \"oauth_token\": { \"access_token\": \"...\", \"refresh_token\": \"...\", \"scopes\": [\"read\", \"write\"] } } }\xbaH\x03\xc8\x01\x01R\x10\x63onnectedAccountB\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifier\"\x8d\x02\n\x1e\x43reateConnectedAccountResponse\x12\xea\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountB\x8a\x01\x92\x41\x86\x01\x32\x83\x01The newly created connected account with its unique identifier, status, and complete authorization details including access tokens.R\x10\x63onnectedAccount\"\x90\t\n\x1dUpdateConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12g\n\x02id\x18\x06 \x01(\tBR\x92\x41\x41\x32\x35Unique identifier for the connected account to updateJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x12\xbd\x02\n\x11\x63onnected_account\x18\x05 \x01(\x0b\x32\x36.scalekit.v1.connected_accounts.UpdateConnectedAccountB\xd7\x01\x92\x41\xcd\x01\x32*Details of the connected account to updateJ\x9e\x01{ \"authorization_type\": \"OAUTH2\", \"authorization_details\": { \"oauth_token\": { \"access_token\": \"...\", \"refresh_token\": \"...\", \"scopes\": [\"read\", \"write\"] } } }\xbaH\x03\xc8\x01\x01R\x10\x63onnectedAccountB\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_id\"\xf7\x01\n\x1eUpdateConnectedAccountResponse\x12\xd4\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountBu\x92\x41r2pThe updated connected account with refreshed credentials, new token expiry, and modified configuration settings.R\x10\x63onnectedAccount\"\xd0\x06\n\x1d\x44\x65leteConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12g\n\x02id\x18\x05 \x01(\tBR\x92\x41\x41\x32\x35Unique identifier for the connected account to deleteJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x42\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_id\" \n\x1e\x44\x65leteConnectedAccountResponse\"\xdf\t\n&GetMagicLinkForConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12]\n\x02id\x18\x05 \x01(\tBH\x92\x41\x37\x32+Unique identifier for the connected accountJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x12\xcf\x01\n\x05state\x18\x07 \x01(\tB\xb3\x01\x92\x41\xa5\x01\x32wOptional opaque state value. State added to the user verify redirect URL query params to validate the user verificationJ*\"QVNDSUFyY2hhYml0dGVyXzE2ODQ5NzIwNzI0NTY=\"\xbaH\x07r\x05\x10\x00\x18\x80\x04H\x05R\x05state\x88\x01\x01\x12\x9d\x01\n\x0fuser_verify_url\x18\x08 \x01(\tBp\x92\x41T2\"B2B app\'s user verify redirect URLJ.\"https://app.yourapp.com/user/verify/callback\"\xbaH\x16r\x14\x10\x00\x18\x80\x10\x32\r^$|^https?://H\x06R\ruserVerifyUrl\x88\x01\x01\x42\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_idB\x08\n\x06_stateB\x12\n\x10_user_verify_url\"\x9c\x02\n\'GetMagicLinkForConnectedAccountResponse\x12r\n\x04link\x18\x01 \x01(\tB^\x92\x41[2%Authentication link for the connectorJ2\"https://notion.com/oauth/authorize?client_id=...\"R\x04link\x12}\n\x06\x65xpiry\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampBI\x92\x41\x46\x32,Expiry timestamp for the authentication linkJ\x16\"2024-03-20T15:04:05Z\"R\x06\x65xpiry\"\xeb\x02\n!VerifyConnectedAccountUserRequest\x12\xc8\x01\n\x0f\x61uth_request_id\x18\x01 \x01(\tB\x9f\x01\x92\x41\x8e\x01\x32`Auth request ID as base64url-encoded opaque token from the user verify redirect URL query paramsJ*\"QVNDSUFyY2hhYml0dGVyXzE2ODQ5NzIwNzI0NTY=\"\xe0\x41\x02\xbaH\x07r\x05\x10\x01\x18\xe8\x07R\rauthRequestId\x12{\n\nidentifier\x18\x02 \x01(\tB[\x92\x41K25Current logged in user\'s connected account identifierJ\x12\"user@example.com\"\xe0\x41\x02\xbaH\x07r\x05\x10\x01\x18\xc8\x01R\nidentifier\"\xd3\x01\n\"VerifyConnectedAccountUserResponse\x12\xac\x01\n\x1dpost_user_verify_redirect_url\x18\x01 \x01(\tBj\x92\x41g29URL to redirect the user to after successful verificationJ*\"https://env1.example.com/connect/success\"R\x19postUserVerifyRedirectUrl\"\xcf\x06\n&GetConnectedAccountByIdentifierRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12]\n\x02id\x18\x05 \x01(\tBH\x92\x41\x37\x32+Unique identifier for the connected accountJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x42\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_id\"\xbe\x02\n\'GetConnectedAccountByIdentifierResponse\x12\x92\x02\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountB\xb2\x01\x92\x41\xae\x01\x32\xab\x01The connected account with complete details including sensitive authorization credentials (access tokens, refresh tokens, scopes). Handle with appropriate access controls.R\x10\x63onnectedAccount\"\xe3\x13\n\x10\x43onnectedAccount\x12\xbc\x01\n\nidentifier\x18\x01 \x01(\tB\x9b\x01\x92\x41\x97\x01\x32\x80\x01The unique identifier for this account in the third-party service. Typically an email address, user ID, or workspace identifier.J\x12\"user@example.com\"R\nidentifier\x12\xaa\x01\n\x08provider\x18\x02 \x01(\tB\x8d\x01\x92\x41\x89\x01\x32}OAuth provider name (e.g., \'google\', \'microsoft\', \'github\'). Identifies which authentication service manages this connection.J\x08\"google\"R\x08provider\x12\xe4\x01\n\x06status\x18\x03 \x01(\x0e\x32/.scalekit.v1.connected_accounts.ConnectorStatusB\x9a\x01\x92\x41\x96\x01\x32\x93\x01\x43urrent status of the connected account. Indicates if the account is active, expired, pending authorization, or pending user identity verification.R\x06status\x12\xe9\x01\n\x12\x61uthorization_type\x18\x04 \x01(\x0e\x32-.scalekit.v1.connected_accounts.ConnectorTypeB\x8a\x01\x92\x41\x86\x01\x32\x83\x01Type of authorization mechanism used. Specifies whether this connection uses OAuth, API keys, bearer tokens, or other auth methods.R\x11\x61uthorizationType\x12\x81\x02\n\x15\x61uthorization_details\x18\x05 \x01(\x0b\x32\x34.scalekit.v1.connected_accounts.AuthorizationDetailsB\x95\x01\x92\x41\x91\x01\x32\x8e\x01Sensitive authentication credentials including access tokens, refresh tokens, and scopes. Contains either OAuth tokens or static auth details.R\x14\x61uthorizationDetails\x12\xce\x01\n\x10token_expires_at\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x87\x01\x92\x41\x83\x01\x32iExpiration timestamp for the access token. After this time, the token must be refreshed or re-authorized.J\x16\"2024-12-31T23:59:59Z\"R\x0etokenExpiresAt\x12\xc9\x01\n\nupdated_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x8d\x01\x92\x41\x89\x01\x32oTimestamp when this connected account was last modified. Updated whenever credentials or configuration changes.J\x16\"2024-03-20T15:04:05Z\"R\tupdatedAt\x12\xae\x01\n\tconnector\x18\x08 \x01(\tB\x8f\x01\x92\x41\x8b\x01\x32\x7f\x43onnector identifier (e.g., \'notion\', \'slack\', \'salesforce\'). Indicates which third-party application this account connects to.J\x08\"notion\"R\tconnector\x12\xcd\x01\n\x0clast_used_at\x18\t \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x8e\x01\x92\x41\x8a\x01\x32pTimestamp when this connected account was last used to make an API call. Useful for tracking active connections.J\x16\"2024-03-20T14:30:00Z\"R\nlastUsedAt\x12\x98\x01\n\x02id\x18\n \x01(\tB\x87\x01\x92\x41v2\\Unique Scalekit-generated identifier for this connected account. Always prefixed with \'ca_\'.J\x16\"ca_24834495392086178\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_R\x02id\x12\xc6\x01\n\rconnection_id\x18\x0b \x01(\tB\xa0\x01\x92\x41\x93\x01\x32wReference to the parent connection configuration. Links this account to a specific connector setup in your environment.J\x18\"conn_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x0c\x63onnectionId\x12\x89\x02\n\napi_config\x18\x0c \x01(\x0b\x32\x17.google.protobuf.StructB\xd0\x01\x92\x41\xcc\x01\x32xOptional JSON configuration for connector-specific API settings such as rate limits, custom endpoints, or feature flags.JP{\"rate_limit\": 1000, \"timeout\": 30, \"base_url\": \"https://api.custom-domain.com\"}R\tapiConfig\"\x9a\x06\n\x16\x43reateConnectedAccount\x12\xae\x03\n\x15\x61uthorization_details\x18\x05 \x01(\x0b\x32\x34.scalekit.v1.connected_accounts.AuthorizationDetailsB\xc2\x02\x92\x41\xbe\x02\x32\xcd\x01Optional authentication credentials for the connected account. Include OAuth tokens (access_token, refresh_token, scopes) or static auth details (API keys, bearer tokens). Can be provided later via update.Jl{\"oauth_token\": {\"access_token\": \"ya29.a0...\", \"refresh_token\": \"1//0g...\", \"scopes\": [\"email\", \"profile\"]}}R\x14\x61uthorizationDetails\x12\x98\x02\n\napi_config\x18\x0b \x01(\x0b\x32\x17.google.protobuf.StructB\xdf\x01\x92\x41\xdb\x01\x32\x86\x01Optional JSON configuration for connector-specific API settings such as rate limits, custom API endpoints, timeouts, or feature flags.JP{\"rate_limit\": 1000, \"timeout\": 30, \"base_url\": \"https://api.custom-domain.com\"}R\tapiConfigJ\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x04\x10\x05J\x04\x08\x06\x10\x07J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tJ\x04\x08\t\x10\nJ\x04\x08\n\x10\x0b\"\xbc\x05\n\x16UpdateConnectedAccount\x12\x8d\x03\n\x15\x61uthorization_details\x18\x05 \x01(\x0b\x32\x34.scalekit.v1.connected_accounts.AuthorizationDetailsB\xa1\x02\x92\x41\x9d\x02\x32\x99\x01Updated authentication credentials. Provide new OAuth tokens (e.g., after refresh) or updated static auth details. Only included fields will be modified.J\x7f{\"oauth_token\": {\"access_token\": \"ya29.new_token...\", \"refresh_token\": \"1//0g...\", \"scopes\": [\"email\", \"profile\", \"calendar\"]}}R\x14\x61uthorizationDetails\x12\xe1\x01\n\napi_config\x18\n \x01(\x0b\x32\x17.google.protobuf.StructB\xa8\x01\x92\x41\xa4\x01\x32}Updated JSON configuration for API-specific settings. Merges with existing configuration - only provided fields are modified.J#{\"rate_limit\": 2000, \"timeout\": 60}R\tapiConfigJ\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x04\x10\x05J\x04\x08\x06\x10\x07J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tJ\x04\x08\t\x10\n\"\xe0\x08\n\x17\x43onnectedAccountForList\x12{\n\nidentifier\x18\x01 \x01(\tB[\x92\x41X2BThe unique identifier for this account in the third-party service.J\x12\"user@example.com\"R\nidentifier\x12]\n\x08provider\x18\x02 \x01(\tBA\x92\x41>22OAuth provider name (e.g., \'google\', \'microsoft\').J\x08\"google\"R\x08provider\x12h\n\x06status\x18\x03 \x01(\x0e\x32/.scalekit.v1.connected_accounts.ConnectorStatusB\x1f\x92\x41\x1c\x32\x1a\x43urrent connection status.R\x06status\x12\x80\x01\n\x12\x61uthorization_type\x18\x04 \x01(\x0e\x32-.scalekit.v1.connected_accounts.ConnectorTypeB\"\x92\x41\x1f\x32\x1d\x41uthorization mechanism type.R\x11\x61uthorizationType\x12~\n\x10token_expires_at\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampB8\x92\x41\x35\x32\x1bToken expiration timestamp.J\x16\"2024-12-31T23:59:59Z\"R\x0etokenExpiresAt\x12t\n\nupdated_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampB9\x92\x41\x36\x32\x1cLast modification timestamp.J\x16\"2024-03-20T15:04:05Z\"R\tupdatedAt\x12\x42\n\tconnector\x18\x08 \x01(\tB$\x92\x41!2\x15\x43onnector identifier.J\x08\"notion\"R\tconnector\x12p\n\x0clast_used_at\x18\t \x01(\x0b\x32\x1a.google.protobuf.TimestampB2\x92\x41/2\x15Last usage timestamp.J\x16\"2024-03-20T14:30:00Z\"R\nlastUsedAt\x12Q\n\x02id\x18\n \x01(\tBA\x92\x41>2$Unique connected account identifier.J\x16\"ca_24834495392086178\"R\x02id\x12w\n\rconnection_id\x18\x0b \x01(\tBR\x92\x41\x46\x32*Parent connection configuration reference.J\x18\"conn_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x0c\x63onnectionIdJ\x04\x08\x05\x10\x06\"\x8f\x02\n\x14\x41uthorizationDetails\x12M\n\x0boauth_token\x18\x01 \x01(\x0b\x32*.scalekit.v1.connected_accounts.OauthTokenH\x00R\noauthToken\x12M\n\x0bstatic_auth\x18\x02 \x01(\x0b\x32*.scalekit.v1.connected_accounts.StaticAuthH\x00R\nstaticAuth\x12N\n\ngoogle_dwd\x18\x03 \x01(\x0b\x32-.scalekit.v1.connected_accounts.GoogleDWDAuthH\x00R\tgoogleDwdB\t\n\x07\x64\x65tails\"\xd8\x04\n\rGoogleDWDAuth\x12\x88\x01\n\x07subject\x18\x01 \x01(\tBn\x92\x41k2UEmail address of the Google Workspace user to impersonate via Domain-Wide Delegation.J\x12\"user@example.com\"R\x07subject\x12\x91\x01\n\x0c\x61\x63\x63\x65ss_token\x18\x02 \x01(\tBn\x92\x41h2POAuth access token acquired via the jwt-bearer grant. Present in responses only.J\x14\"ya29.a0AfH6SMBx...\"\xe0\x41\x03R\x0b\x61\x63\x63\x65ssToken\x12\x9d\x01\n\x06scopes\x18\x03 \x03(\tB\x84\x01\x92\x41~2>OAuth scopes granted to this token. Present in responses only.J<[\"openid\", \"https://www.googleapis.com/auth/userinfo.email\"]\xe0\x41\x03R\x06scopes\x12\x87\x01\n\x10token_expires_at\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampBA\x92\x41;29When the access token expires. Present in responses only.\xe0\x41\x03R\x0etokenExpiresAt\"\xdc\x05\n\nOauthToken\x12\xa0\x01\n\x0c\x61\x63\x63\x65ss_token\x18\x01 \x01(\tB}\x92\x41z2bOAuth access token for API requests. Typically short-lived and must be refreshed after expiration.J\x14\"ya29.a0AfH6SMBx...\"R\x0b\x61\x63\x63\x65ssToken\x12\xae\x01\n\rrefresh_token\x18\x02 \x01(\tB\x88\x01\x92\x41\x84\x01\x32nOAuth refresh token for obtaining new access tokens. Long-lived and used to maintain persistent authorization.J\x12\"1//0gHJxZ-Lb2...\"R\x0crefreshToken\x12\xe1\x01\n\x06scopes\x18\x03 \x03(\tB\xc8\x01\x92\x41\xc4\x01\x32\\List of granted OAuth scopes defining the permissions and access levels for this connection.Jd[\"https://www.googleapis.com/auth/drive.readonly\", \"https://www.googleapis.com/auth/userinfo.email\"]R\x06scopes\x12\x95\x01\n\x06\x64omain\x18\x04 \x01(\tB}\x92\x41z2iAssociated domain for workspace or organization-scoped OAuth connections (e.g., Google Workspace domain).J\r\"example.com\"R\x06\x64omain\"\xf4\x01\n\nStaticAuth\x12\xe5\x01\n\x07\x64\x65tails\x18\x01 \x01(\x0b\x32\x17.google.protobuf.StructB\xb1\x01\x92\x41\xad\x01\x32zFlexible JSON structure containing static credentials. Format varies by connector type (API key, username/password, etc.).J/{\"api_key\": \"sk_live_...\", \"api_secret\": \"...\"}R\x07\x64\x65tails\"\x83\x02\n\x1aGetConnectedAccountRequest\x12\xe4\x01\n\x02id\x18\x01 \x01(\tB\xd3\x01\x92\x41\xc6\x01\x32\xab\x01Unique identifier for the connected account. Always prefixed with \'ca_\'. If omitted (via the /this path), the connected account is resolved from the current token context.J\x16\"ca_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x02id\"\xc5\x01\n\x1bGetConnectedAccountResponse\x12\xa5\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountBF\x92\x41\x43\x32\x41The connected account with its details and authentication status.R\x10\x63onnectedAccount\"\xb2\x01\n!DisconnectConnectedAccountRequest\x12\x8c\x01\n\x02id\x18\x01 \x01(\tB|\x92\x41p2VUnique identifier for the connected account to disconnect. Always prefixed with \'ca_\'.J\x16\"ca_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x02id\"\xc6\x01\n\"DisconnectConnectedAccountResponse\x12\x9f\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountB@\x92\x41=2;The connected account with its updated DISCONNECTED status.R\x10\x63onnectedAccount\"\x17\n\x15GetRedirectUrlRequest\"\xb9\x01\n\x16GetRedirectUrlResponse\x12\x9e\x01\n\x0credirect_url\x18\x01 \x01(\tB{\x92\x41x2AThe URL to redirect the user to in the connected accounts portal.J3\"https://app.example.com/portal/connected-accounts\"R\x0bredirectUrl*\x8b\x01\n\x0f\x43onnectorStatus\x12!\n\x1d\x43ONNECTION_STATUS_UNSPECIFIED\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\x0b\n\x07\x45XPIRED\x10\x02\x12\x10\n\x0cPENDING_AUTH\x10\x03\x12\x18\n\x14PENDING_VERIFICATION\x10\x04\x12\x10\n\x0c\x44ISCONNECTED\x10\x05*\xb3\x01\n\rConnectorType\x12\x1f\n\x1b\x43ONNECTION_TYPE_UNSPECIFIED\x10\x00\x12\t\n\x05OAUTH\x10\x01\x12\x0b\n\x07\x41PI_KEY\x10\x02\x12\x0e\n\nBASIC_AUTH\x10\x03\x12\x10\n\x0c\x42\x45\x41RER_TOKEN\x10\x04\x12\n\n\x06\x43USTOM\x10\x05\x12\t\n\x05\x42\x41SIC\x10\x06\x12\r\n\tOAUTH_M2M\x10\x07\x12\x11\n\rTRELLO_OAUTH1\x10\x08\x12\x0e\n\nGOOGLE_DWD\x10\t2\x93W\n\x17\x43onnectedAccountService\x12\xde\x06\n\x15ListConnectedAccounts\x12<.scalekit.v1.connected_accounts.ListConnectedAccountsRequest\x1a=.scalekit.v1.connected_accounts.ListConnectedAccountsResponse\"\xc7\x05\x92\x41\x9b\x05\n\x12\x43onnected Accounts\x12\x17List connected accounts\x1a\x9a\x02Retrieves a paginated list of connected accounts for third-party integrations. Filter by organization, user, connector type, provider, or identifier. Returns OAuth tokens, API keys, and connection status for each account. Use pagination tokens to navigate through large result sets.J\xaf\x01\n\x03\x32\x30\x30\x12\xa7\x01\nbSuccessfully retrieved the list of connected accounts with their authentication details and status\x12\x41\n?\x1a=.scalekit.v1.connected_accounts.ListConnectedAccountsResponseJY\n\x03\x34\x30\x30\x12R\nPInvalid request - occurs when query parameters are malformed or validation failsJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02\x1c\x12\x1a/api/v1/connected_accounts\x12\xe0\x06\n\x17SearchConnectedAccounts\x12>.scalekit.v1.connected_accounts.SearchConnectedAccountsRequest\x1a?.scalekit.v1.connected_accounts.SearchConnectedAccountsResponse\"\xc3\x05\x92\x41\x90\x05\n\x12\x43onnected Accounts\x12\x19Search connected accounts\x1a\x99\x02Search for connected accounts in your environment using a text query that matches against identifiers, providers, or connectors. The search performs case-insensitive matching across account details. Returns paginated results with account status and authentication type information.J\x99\x01\n\x03\x32\x30\x30\x12\x91\x01\nJSuccessfully retrieved matching connected accounts with pagination support\x12\x43\nA\x1a?.scalekit.v1.connected_accounts.SearchConnectedAccountsResponseJc\n\x03\x34\x30\x30\x12\\\nZInvalid request - query parameter is too short (minimum 3 characters) or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02#\x12!/api/v1/connected_accounts:search\x12\xfe\x07\n\x16\x43reateConnectedAccount\x12=.scalekit.v1.connected_accounts.CreateConnectedAccountRequest\x1a>.scalekit.v1.connected_accounts.CreateConnectedAccountResponse\"\xe4\x06\x92\x41\xb5\x06\n\x12\x43onnected Accounts\x12\x1a\x43reate a connected account\x1a\xdf\x02\x43reates a new connected account with OAuth tokens or API credentials for third-party service integration. Supply authorization details including access tokens, refresh tokens, scopes, and optional API configuration. The account can be scoped to an organization or user. Returns the created account with its unique identifier and authentication status.J\xa4\x01\n\x03\x32\x30\x31\x12\x9c\x01\nVConnected account created successfully with authentication credentials stored securely\x12\x42\n@\x1a>.scalekit.v1.connected_accounts.CreateConnectedAccountResponseJg\n\x03\x34\x30\x30\x12`\n^Invalid request - missing required fields, invalid authorization details, or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJM\n\x03\x34\x30\x39\x12\x46\nDConflict - connected account with the same identifier already exists\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02\x1f\"\x1a/api/v1/connected_accounts:\x01*\x12\xf0\x07\n\x16UpdateConnectedAccount\x12=.scalekit.v1.connected_accounts.UpdateConnectedAccountRequest\x1a>.scalekit.v1.connected_accounts.UpdateConnectedAccountResponse\"\xd6\x06\x92\x41\xa6\x06\n\x12\x43onnected Accounts\x12$Update connected account credentials\x1a\xd2\x02Updates authentication credentials and configuration for an existing connected account. Modify OAuth tokens, refresh tokens, access scopes, or API configuration settings. Specify the account by ID, or by combination of organization/user, connector, and identifier. Returns the updated account with new token expiry and status information.J\x9a\x01\n\x03\x32\x30\x30\x12\x92\x01\nLConnected account updated successfully with new credentials or configuration\x12\x42\n@\x1a>.scalekit.v1.connected_accounts.UpdateConnectedAccountResponseJg\n\x03\x34\x30\x30\x12`\n^Invalid request - missing required fields, invalid authorization details, or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJK\n\x03\x34\x30\x34\x12\x44\nBConnected account not found - the specified account does not exist\x82\xb5\x18\x03\x18\xc4\x01\x82\xd3\xe4\x93\x02\x1f\x1a\x1a/api/v1/connected_accounts:\x01*\x12\xc6\x06\n\x16\x44\x65leteConnectedAccount\x12=.scalekit.v1.connected_accounts.DeleteConnectedAccountRequest\x1a>.scalekit.v1.connected_accounts.DeleteConnectedAccountResponse\"\xac\x05\x92\x41\xf6\x04\n\x12\x43onnected Accounts\x12\x1a\x44\x65lete a connected account\x1a\x9f\x02Permanently removes a connected account and revokes all associated authentication credentials. Identify the account by ID, or by combination of organization/user, connector, and identifier. This action cannot be undone. All OAuth tokens and API keys for this account will be invalidated.JK\n\x03\x32\x30\x30\x12\x44\nBConnected account deleted successfully and all credentials revokedJD\n\x03\x34\x30\x30\x12=\n;Invalid request - malformed parameters or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJK\n\x03\x34\x30\x34\x12\x44\nBConnected account not found - the specified account does not exist\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02&\"!/api/v1/connected_accounts:delete:\x01*\x12\xff\x06\n\x1fGetMagicLinkForConnectedAccount\x12\x46.scalekit.v1.connected_accounts.GetMagicLinkForConnectedAccountRequest\x1aG.scalekit.v1.connected_accounts.GetMagicLinkForConnectedAccountResponse\"\xca\x05\x92\x41\x90\x05\n\x12\x43onnected Accounts\x12\"Generate authentication magic link\x1a\xa2\x02\x43reates a time-limited magic link for connecting or re-authorizing a third-party account. The link directs users to the OAuth authorization flow for the specified connector. Returns the generated link URL and expiration timestamp. Links typically expire after a short duration for security.J\x9f\x01\n\x03\x32\x30\x30\x12\x97\x01\nHMagic link generated successfully with authorization URL and expiry time\x12K\nI\x1aG.scalekit.v1.connected_accounts.GetMagicLinkForConnectedAccountResponseJK\n\x03\x34\x30\x30\x12\x44\nBInvalid request - missing required parameters or invalid connectorJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02*\"%/api/v1/connected_accounts/magic_link:\x01*\x12\x85\x06\n\x13GetConnectedAccount\x12:.scalekit.v1.connected_accounts.GetConnectedAccountRequest\x1a;.scalekit.v1.connected_accounts.GetConnectedAccountResponse\"\xf4\x04\x92\x41\x90\x04\n\x12\x43onnected Accounts\x12\x17Get a connected account\x1a\xb8\x01Retrieves a connected account by its unique ID. Use the path \'/this\' (e.g. /api/v1/connected_accounts/this) to retrieve the connected account associated with the current token context.Jv\n\x03\x32\x30\x30\x12o\n,Successfully retrieved the connected account\x12?\n=\x1a;.scalekit.v1.connected_accounts.GetConnectedAccountResponseJD\n\x03\x34\x30\x30\x12=\n;Invalid request - missing or malformed connected account IDJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJ$\n\x03\x34\x30\x34\x12\x1d\n\x1b\x43onnected account not found\x82\xb5\x18\x03\x18\xc4\x01\xfa\xd2\xe4\x93\x02\t\x12\x07PREVIEW\x82\xd3\xe4\x93\x02\x44\x12\x1f/api/v1/connected_accounts/thisZ!\x12\x1f/api/v1/connected_accounts/{id}\x12\xc3\t\n\x1a\x44isconnectConnectedAccount\x12\x41.scalekit.v1.connected_accounts.DisconnectConnectedAccountRequest\x1a\x42.scalekit.v1.connected_accounts.DisconnectConnectedAccountResponse\"\x9d\x08\x92\x41\xee\x06\n\x12\x43onnected Accounts\x12\x1e\x44isconnect a connected account\x1a\xb6\x02\x44isconnects a connected account by setting its status to DISCONNECTED. The account record is retained but marked as no longer active. Use the path \'/this:disconnect\' (e.g. /api/v1/connected_accounts/this:disconnect) to disconnect the account associated with the current token context, without specifying an ID.J\x80\x01\n\x03\x32\x30\x30\x12y\n/Successfully disconnected the connected account\x12\x46\nD\x1a\x42.scalekit.v1.connected_accounts.DisconnectConnectedAccountResponseJ\x99\x01\n\x03\x34\x30\x30\x12\x91\x01\n\x8e\x01Invalid request - malformed connected account ID, or attempting to disconnect an account other than the one bound to the current token contextJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJv\n\x03\x34\x30\x33\x12o\nmForbidden - the token context is bound to a different connected account than the one specified in the requestJ$\n\x03\x34\x30\x34\x12\x1d\n\x1b\x43onnected account not found\x82\xb5\x18\x03\x18\xc4\x01\xfa\xd2\xe4\x93\x02\t\x12\x07PREVIEW\x82\xd3\xe4\x93\x02\x8e\x01\"*/api/v1/connected_accounts/{id}:disconnect:\x01*Z,\"\'/api/v1/connected_accounts/-:disconnect:\x01*Z/\"*/api/v1/connected_accounts/this:disconnect:\x01*\x12\xc2\x04\n\x0eGetRedirectUrl\x12\x35.scalekit.v1.connected_accounts.GetRedirectUrlRequest\x1a\x36.scalekit.v1.connected_accounts.GetRedirectUrlResponse\"\xc0\x03\x92\x41\xf0\x02\n\x12\x43onnected Accounts\x12\x17Get portal redirect URL\x1a\x87\x01Returns the redirect URL for the connected accounts portal. Used to redirect users to the appropriate portal page after authentication.Js\n\x03\x32\x30\x30\x12l\n.Successfully retrieved the portal redirect URL\x12:\n8\x1a\x36.scalekit.v1.connected_accounts.GetRedirectUrlResponseJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x03\x18\x80\x01\xfa\xd2\xe4\x93\x02\t\x12\x07PREVIEW\x82\xd3\xe4\x93\x02\x30\x12./api/v1/connected_accounts/portal/redirect_url\x12\xbf\x07\n\x17GetConnectedAccountAuth\x12\x46.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierRequest\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponse\"\x92\x06\x92\x41\xe1\x05\n\x12\x43onnected Accounts\x12&Get connected account auth credentials\x1a\xab\x02Retrieves complete authentication details for a connected account including OAuth tokens, refresh tokens, scopes, and API configuration. Query by account ID or by combination of organization/user, connector, and identifier. Returns sensitive credential information - use appropriate access controls.J\xa0\x01\n\x03\x32\x30\x30\x12\x98\x01\nISuccessfully retrieved connected account with full authentication details\x12K\nI\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponseJ<\n\x03\x34\x30\x30\x12\x35\n3Invalid request - missing required query parametersJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJP\n\x03\x34\x30\x34\x12I\nGConnected account not found - no account matches the specified criteria\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02!\x12\x1f/api/v1/connected_accounts/auth\x12\xfb\x06\n\x1aGetConnectedAccountDetails\x12\x46.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierRequest\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponse\"\xcb\x05\x92\x41\x97\x05\n\x12\x43onnected Accounts\x12\x1eGet connected account metadata\x1a\x83\x02Returns metadata for a connected account including status, connector type, provider, and configuration without exposing stored authorization credentials. Look up by account ID, or by a combination of organization (or user), connector, and external identifier.J\x86\x01\n\x03\x32\x30\x30\x12\x7f\n0Successfully retrieved connected account details\x12K\nI\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponseJ<\n\x03\x34\x30\x30\x12\x35\n3Invalid request - missing required query parametersJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJP\n\x03\x34\x30\x34\x12I\nGConnected account not found - no account matches the specified criteria\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02$\x12\"/api/v1/connected_accounts/details\x12\xbb\x07\n\x1aVerifyConnectedAccountUser\x12\x41.scalekit.v1.connected_accounts.VerifyConnectedAccountUserRequest\x1a\x42.scalekit.v1.connected_accounts.VerifyConnectedAccountUserResponse\"\x95\x06\x92\x41\xda\x05\n\x12\x43onnected Accounts\x12\x1dVerify connected account user\x1a\xa4\x02\x43onfirms the user assertion and activates the connected account after the user completes third-party OAuth. Called by the B2B app server with auth_request_id and identifier. Validates that the asserted identifier matches the one stored on the auth request and promotes pending tokens to live.J\x8a\x01\n\x03\x32\x30\x30\x12\x82\x01\n8Verification successful; connected account is now ACTIVE\x12\x46\nD\x1a\x42.scalekit.v1.connected_accounts.VerifyConnectedAccountUserResponseJ6\n\x03\x34\x30\x30\x12/\n-Invalid request - missing or malformed fieldsJ7\n\x03\x34\x30\x31\x12\x30\n.Unauthorized - invalid or missing access tokenJ(\n\x03\x34\x30\x33\x12!\n\x1f\x46orbidden - identifier mismatchJV\n\x03\x34\x30\x34\x12O\nMNot found - no pending flow for the given auth_request_id or already consumed\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02+\"&/api/v1/connected_accounts/user/verify:\x01*\x1a\xe3\x01\x92\x41\xdf\x01\n\x12\x43onnected Accounts\x12\xc8\x01Manage connected accounts for third-party integrations and OAuth connections. Connected accounts represent authenticated access to external services like Google, Notion, Slack, and other applications.B\xa4\x02Z<github.com/scalekit-inc/scalekit/pkg/grpc/connected_accounts\x92\x41\xe2\x01j\xdf\x01\n\x12\x43onnected Accounts\x12\xc8\x01Manage connected accounts for third-party integrations and OAuth connections. Connected accounts represent authenticated access to external services like Google, Notion, Slack, and other applications.b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n7scalekit/v1/connected_accounts/connected_accounts.proto\x12\x1escalekit.v1.connected_accounts\x1a\x1b\x62uf/validate/validate.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x1bgoogle/api/visibility.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a.protoc-gen-openapiv2/options/annotations.proto\x1a!scalekit/v1/options/options.proto\"\x8e\x10\n\x1cListConnectedAccountsRequest\x12\xb1\x01\n\x0forganization_id\x18\x01 \x01(\tB\x82\x01\x92\x41v2]Filter by organization ID. Returns only connected accounts associated with this organization.J\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12\x91\x01\n\x07user_id\x18\x02 \x01(\tBs\x92\x41g2MFilter by user ID. Returns only connected accounts associated with this user.J\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdf\x01\n\tconnector\x18\x03 \x01(\tB\xbb\x01\x92\x41\x99\x01\x32\x8c\x01\x46ilter by connector type (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xdb\x01\n\nidentifier\x18\x04 \x01(\tB\xb5\x01\x92\x41\xa8\x01\x32\x91\x01\x46ilter by account identifier. The unique identifier for the connected account within the third-party service (e.g., email address, workspace ID).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12\x9d\x01\n\x08provider\x18\x05 \x01(\tB\x80\x01\x92\x41t2hFilter by OAuth provider. The authentication provider name such as \'google\', \'microsoft\', \'github\', etc.J\x08\"google\"\xbaH\x06r\x04\x10\x00\x18\x32R\x08provider\x12\x9b\x01\n\tpage_size\x18\x06 \x01(\rB~\x92\x41r2lMaximum number of connected accounts to return per page. Must be between 0 and 100. Default is typically 10.J\x02\x31\x30\xbaH\x06*\x04\x10\x64(\x00R\x08pageSize\x12\xcb\x01\n\npage_token\x18\x07 \x01(\tB\xab\x01\x92\x41\x9e\x01\x32\x83\x01Pagination token from a previous response. Use the next_page_token value from ListConnectedAccountsResponse to fetch the next page.J\x16\"eyJvZmZzZXQiOjEwfQ==\"\xbaH\x06r\x04\x10\x00\x18\x64R\tpageToken\x12\xa7\x01\n\x05query\x18\x08 \x01(\tB\x90\x01\x92\x41\x83\x01\x32qText search query to filter connected accounts by name, identifier, or other searchable fields. Case-insensitive.J\x0e\"john@example\"\xbaH\x06r\x04\x10\x00\x18\x64R\x05query\x12\xb8\x02\n\x10\x63onnection_names\x18\t \x03(\tB\x8c\x02\x92\x41\xe3\x01\x32\xc8\x01\x46ilter by one or more connection names (exact match). Returns connected accounts belonging to any of the specified connections. Max 20 names per request. Cannot be combined with the `connector` field.J\x13[\"notion\", \"slack\"]\xa0\x01\x14\xbaH\"\x92\x01\x1f\x10\x14\"\x1br\x19\x10\x01\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$R\x0f\x63onnectionNames:\xb7\x01\xbaH\xb3\x01\x1a\xb0\x01\n&connector_or_connection_names_not_both\x12Jconnector and connection_names are mutually exclusive \xe2\x80\x94 provide only one\x1a:!(has(this.connector) && this.connection_names.size() > 0)B\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifier\"\xbb\x06\n\x1dListConnectedAccountsResponse\x12\xdc\x01\n\x12\x63onnected_accounts\x18\x01 \x03(\x0b\x32\x37.scalekit.v1.connected_accounts.ConnectedAccountForListBt\x92\x41q2oList of connected accounts matching the filter criteria. Excludes sensitive authorization details for security.R\x11\x63onnectedAccounts\x12\x99\x01\n\ntotal_size\x18\x02 \x01(\rBz\x92\x41w2pTotal count of connected accounts matching the filter criteria across all pages. Use for calculating pagination.J\x03\x31\x30\x30R\ttotalSize\x12\xd2\x01\n\x0fnext_page_token\x18\x03 \x01(\tB\xa9\x01\x92\x41\x9c\x01\x32\x81\x01Pagination token for retrieving the next page. Empty if this is the last page. Pass this value to page_token in the next request.J\x16\"eyJvZmZzZXQiOjIwfQ==\"\xbaH\x06r\x04\x10\x00\x18 R\rnextPageToken\x12\xc9\x01\n\x0fprev_page_token\x18\x04 \x01(\tB\xa0\x01\x92\x41\x93\x01\x32}Pagination token for retrieving the previous page. Empty if this is the first page. Pass this value to page_token to go back.J\x12\"eyJvZmZzZXQiOjB9\"\xbaH\x06r\x04\x10\x00\x18 R\rprevPageToken\"\xe0\x06\n\x1eSearchConnectedAccountsRequest\x12\xb9\x01\n\x05query\x18\x01 \x01(\tB\xa2\x01\x92\x41\x91\x01\x32\x86\x01Search term to match against connected account identifiers, providers, or connectors. Must be at least 3 characters. Case insensitive.J\x06google\xbaH\nr\x05\x10\x03\x18\xc8\x01\xc8\x01\x01R\x05query\x12\x85\x01\n\tpage_size\x18\x02 \x01(\rBh\x92\x41^2XMaximum number of connected accounts to return per page. Value must be between 1 and 30.J\x02\x33\x30\xbaH\x04*\x02\x18\x1eR\x08pageSize\x12\xa5\x01\n\npage_token\x18\x03 \x01(\tB\x85\x01\x92\x41\x81\x01\x32\x61Token from a previous response for pagination. Provide this to retrieve the next page of results.J\x1c\x65yJwYWdlIjoyLCJsaW1pdCI6MzB9R\tpageToken\x12i\n\rconnection_id\x18\x04 \x01(\tBD\x92\x41\x38\x32*Connection ID to filter connected accountsJ\n\"conn_123\"\xbaH\x06r\x04\x10\x00\x18 R\x0c\x63onnectionId:\xe6\x01\x92\x41\xe2\x01\n\x9c\x01*\x19Search Connected Accounts2\x7fSearch for connected accounts in your environment using a text query that matches against identifiers, providers, or connectors2Aquery=google&page_size=30&page_token=eyJwYWdlIjoyLCJsaW1pdCI6MzB9\"\x87\x05\n\x1fSearchConnectedAccountsResponse\x12\xcc\x01\n\x12\x63onnected_accounts\x18\x01 \x03(\x0b\x32\x37.scalekit.v1.connected_accounts.ConnectedAccountForListBd\x92\x41\x61\x32_List of connected accounts matching the search query. Excludes sensitive authorization details.R\x11\x63onnectedAccounts\x12l\n\ntotal_size\x18\x02 \x01(\rBM\x92\x41J2CTotal count of accounts matching the search query across all pages.J\x03\x31\x30\x30R\ttotalSize\x12\x91\x01\n\x0fnext_page_token\x18\x03 \x01(\tBi\x92\x41]2CPagination token for the next page. Empty if this is the last page.J\x16\"eyJvZmZzZXQiOjMwfQ==\"\xbaH\x06r\x04\x10\x00\x18 R\rnextPageToken\x12\x92\x01\n\x0fprev_page_token\x18\x04 \x01(\tBj\x92\x41^2HPagination token for the previous page. Empty if this is the first page.J\x12\"eyJvZmZzZXQiOjB9\"\xbaH\x06r\x04\x10\x00\x18 R\rprevPageToken\"\xa0\x08\n\x1d\x43reateConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12\xbd\x02\n\x11\x63onnected_account\x18\x05 \x01(\x0b\x32\x36.scalekit.v1.connected_accounts.CreateConnectedAccountB\xd7\x01\x92\x41\xcd\x01\x32*Details of the connected account to createJ\x9e\x01{ \"authorization_type\": \"OAUTH2\", \"authorization_details\": { \"oauth_token\": { \"access_token\": \"...\", \"refresh_token\": \"...\", \"scopes\": [\"read\", \"write\"] } } }\xbaH\x03\xc8\x01\x01R\x10\x63onnectedAccountB\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifier\"\x8d\x02\n\x1e\x43reateConnectedAccountResponse\x12\xea\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountB\x8a\x01\x92\x41\x86\x01\x32\x83\x01The newly created connected account with its unique identifier, status, and complete authorization details including access tokens.R\x10\x63onnectedAccount\"\x90\t\n\x1dUpdateConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12g\n\x02id\x18\x06 \x01(\tBR\x92\x41\x41\x32\x35Unique identifier for the connected account to updateJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x12\xbd\x02\n\x11\x63onnected_account\x18\x05 \x01(\x0b\x32\x36.scalekit.v1.connected_accounts.UpdateConnectedAccountB\xd7\x01\x92\x41\xcd\x01\x32*Details of the connected account to updateJ\x9e\x01{ \"authorization_type\": \"OAUTH2\", \"authorization_details\": { \"oauth_token\": { \"access_token\": \"...\", \"refresh_token\": \"...\", \"scopes\": [\"read\", \"write\"] } } }\xbaH\x03\xc8\x01\x01R\x10\x63onnectedAccountB\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_id\"\xf7\x01\n\x1eUpdateConnectedAccountResponse\x12\xd4\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountBu\x92\x41r2pThe updated connected account with refreshed credentials, new token expiry, and modified configuration settings.R\x10\x63onnectedAccount\"\xd0\x06\n\x1d\x44\x65leteConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12g\n\x02id\x18\x05 \x01(\tBR\x92\x41\x41\x32\x35Unique identifier for the connected account to deleteJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x42\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_id\" \n\x1e\x44\x65leteConnectedAccountResponse\"\xdf\t\n&GetMagicLinkForConnectedAccountRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12]\n\x02id\x18\x05 \x01(\tBH\x92\x41\x37\x32+Unique identifier for the connected accountJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x12\xcf\x01\n\x05state\x18\x07 \x01(\tB\xb3\x01\x92\x41\xa5\x01\x32wOptional opaque state value. State added to the user verify redirect URL query params to validate the user verificationJ*\"QVNDSUFyY2hhYml0dGVyXzE2ODQ5NzIwNzI0NTY=\"\xbaH\x07r\x05\x10\x00\x18\x80\x04H\x05R\x05state\x88\x01\x01\x12\x9d\x01\n\x0fuser_verify_url\x18\x08 \x01(\tBp\x92\x41T2\"B2B app\'s user verify redirect URLJ.\"https://app.yourapp.com/user/verify/callback\"\xbaH\x16r\x14\x10\x00\x18\x80\x10\x32\r^$|^https?://H\x06R\ruserVerifyUrl\x88\x01\x01\x42\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_idB\x08\n\x06_stateB\x12\n\x10_user_verify_url\"\x9c\x02\n\'GetMagicLinkForConnectedAccountResponse\x12r\n\x04link\x18\x01 \x01(\tB^\x92\x41[2%Authentication link for the connectorJ2\"https://notion.com/oauth/authorize?client_id=...\"R\x04link\x12}\n\x06\x65xpiry\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampBI\x92\x41\x46\x32,Expiry timestamp for the authentication linkJ\x16\"2024-03-20T15:04:05Z\"R\x06\x65xpiry\"\xeb\x02\n!VerifyConnectedAccountUserRequest\x12\xc8\x01\n\x0f\x61uth_request_id\x18\x01 \x01(\tB\x9f\x01\x92\x41\x8e\x01\x32`Auth request ID as base64url-encoded opaque token from the user verify redirect URL query paramsJ*\"QVNDSUFyY2hhYml0dGVyXzE2ODQ5NzIwNzI0NTY=\"\xe0\x41\x02\xbaH\x07r\x05\x10\x01\x18\xe8\x07R\rauthRequestId\x12{\n\nidentifier\x18\x02 \x01(\tB[\x92\x41K25Current logged in user\'s connected account identifierJ\x12\"user@example.com\"\xe0\x41\x02\xbaH\x07r\x05\x10\x01\x18\xc8\x01R\nidentifier\"\xd3\x01\n\"VerifyConnectedAccountUserResponse\x12\xac\x01\n\x1dpost_user_verify_redirect_url\x18\x01 \x01(\tBj\x92\x41g29URL to redirect the user to after successful verificationJ*\"https://env1.example.com/connect/success\"R\x19postUserVerifyRedirectUrl\"\xcf\x06\n&GetConnectedAccountByIdentifierRequest\x12t\n\x0forganization_id\x18\x01 \x01(\tBF\x92\x41:2!Organization ID for the connectorJ\x15\"org_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x00R\x0eorganizationId\x88\x01\x01\x12]\n\x07user_id\x18\x02 \x01(\tB?\x92\x41\x33\x32\x19User ID for the connectorJ\x16\"user_121312434123312\"\xbaH\x06r\x04\x10\x00\x18 H\x01R\x06userId\x88\x01\x01\x12\xdb\x01\n\tconnector\x18\x03 \x01(\tB\xb7\x01\x92\x41\x95\x01\x32\x88\x01\x43onnector identifier (e.g., \'notion\', \'slack\', \'google\'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.J\x08\"notion\"\xbaH\x1br\x19\x10\x00\x18\x90\x03\x32\x12^[a-zA-Z0-9_: -]*$H\x02R\tconnector\x88\x01\x01\x12\xce\x01\n\nidentifier\x18\x04 \x01(\tB\xa8\x01\x92\x41\x9b\x01\x32\x84\x01The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).J\x12\"user@example.com\"\xbaH\x06r\x04\x10\x00\x18\x64H\x03R\nidentifier\x88\x01\x01\x12]\n\x02id\x18\x05 \x01(\tBH\x92\x41\x37\x32+Unique identifier for the connected accountJ\x08\"ca_123\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_H\x04R\x02id\x88\x01\x01\x42\x12\n\x10_organization_idB\n\n\x08_user_idB\x0c\n\n_connectorB\r\n\x0b_identifierB\x05\n\x03_id\"\xbe\x02\n\'GetConnectedAccountByIdentifierResponse\x12\x92\x02\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountB\xb2\x01\x92\x41\xae\x01\x32\xab\x01The connected account with complete details including sensitive authorization credentials (access tokens, refresh tokens, scopes). Handle with appropriate access controls.R\x10\x63onnectedAccount\"\xe3\x13\n\x10\x43onnectedAccount\x12\xbc\x01\n\nidentifier\x18\x01 \x01(\tB\x9b\x01\x92\x41\x97\x01\x32\x80\x01The unique identifier for this account in the third-party service. Typically an email address, user ID, or workspace identifier.J\x12\"user@example.com\"R\nidentifier\x12\xaa\x01\n\x08provider\x18\x02 \x01(\tB\x8d\x01\x92\x41\x89\x01\x32}OAuth provider name (e.g., \'google\', \'microsoft\', \'github\'). Identifies which authentication service manages this connection.J\x08\"google\"R\x08provider\x12\xe4\x01\n\x06status\x18\x03 \x01(\x0e\x32/.scalekit.v1.connected_accounts.ConnectorStatusB\x9a\x01\x92\x41\x96\x01\x32\x93\x01\x43urrent status of the connected account. Indicates if the account is active, expired, pending authorization, or pending user identity verification.R\x06status\x12\xe9\x01\n\x12\x61uthorization_type\x18\x04 \x01(\x0e\x32-.scalekit.v1.connected_accounts.ConnectorTypeB\x8a\x01\x92\x41\x86\x01\x32\x83\x01Type of authorization mechanism used. Specifies whether this connection uses OAuth, API keys, bearer tokens, or other auth methods.R\x11\x61uthorizationType\x12\x81\x02\n\x15\x61uthorization_details\x18\x05 \x01(\x0b\x32\x34.scalekit.v1.connected_accounts.AuthorizationDetailsB\x95\x01\x92\x41\x91\x01\x32\x8e\x01Sensitive authentication credentials including access tokens, refresh tokens, and scopes. Contains either OAuth tokens or static auth details.R\x14\x61uthorizationDetails\x12\xce\x01\n\x10token_expires_at\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x87\x01\x92\x41\x83\x01\x32iExpiration timestamp for the access token. After this time, the token must be refreshed or re-authorized.J\x16\"2024-12-31T23:59:59Z\"R\x0etokenExpiresAt\x12\xc9\x01\n\nupdated_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x8d\x01\x92\x41\x89\x01\x32oTimestamp when this connected account was last modified. Updated whenever credentials or configuration changes.J\x16\"2024-03-20T15:04:05Z\"R\tupdatedAt\x12\xae\x01\n\tconnector\x18\x08 \x01(\tB\x8f\x01\x92\x41\x8b\x01\x32\x7f\x43onnector identifier (e.g., \'notion\', \'slack\', \'salesforce\'). Indicates which third-party application this account connects to.J\x08\"notion\"R\tconnector\x12\xcd\x01\n\x0clast_used_at\x18\t \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x8e\x01\x92\x41\x8a\x01\x32pTimestamp when this connected account was last used to make an API call. Useful for tracking active connections.J\x16\"2024-03-20T14:30:00Z\"R\nlastUsedAt\x12\x98\x01\n\x02id\x18\n \x01(\tB\x87\x01\x92\x41v2\\Unique Scalekit-generated identifier for this connected account. Always prefixed with \'ca_\'.J\x16\"ca_24834495392086178\"\xbaH\x0br\t\x10\x00\x18 :\x03\x63\x61_R\x02id\x12\xc6\x01\n\rconnection_id\x18\x0b \x01(\tB\xa0\x01\x92\x41\x93\x01\x32wReference to the parent connection configuration. Links this account to a specific connector setup in your environment.J\x18\"conn_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x0c\x63onnectionId\x12\x89\x02\n\napi_config\x18\x0c \x01(\x0b\x32\x17.google.protobuf.StructB\xd0\x01\x92\x41\xcc\x01\x32xOptional JSON configuration for connector-specific API settings such as rate limits, custom endpoints, or feature flags.JP{\"rate_limit\": 1000, \"timeout\": 30, \"base_url\": \"https://api.custom-domain.com\"}R\tapiConfig\"\x9a\x06\n\x16\x43reateConnectedAccount\x12\xae\x03\n\x15\x61uthorization_details\x18\x05 \x01(\x0b\x32\x34.scalekit.v1.connected_accounts.AuthorizationDetailsB\xc2\x02\x92\x41\xbe\x02\x32\xcd\x01Optional authentication credentials for the connected account. Include OAuth tokens (access_token, refresh_token, scopes) or static auth details (API keys, bearer tokens). Can be provided later via update.Jl{\"oauth_token\": {\"access_token\": \"ya29.a0...\", \"refresh_token\": \"1//0g...\", \"scopes\": [\"email\", \"profile\"]}}R\x14\x61uthorizationDetails\x12\x98\x02\n\napi_config\x18\x0b \x01(\x0b\x32\x17.google.protobuf.StructB\xdf\x01\x92\x41\xdb\x01\x32\x86\x01Optional JSON configuration for connector-specific API settings such as rate limits, custom API endpoints, timeouts, or feature flags.JP{\"rate_limit\": 1000, \"timeout\": 30, \"base_url\": \"https://api.custom-domain.com\"}R\tapiConfigJ\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x04\x10\x05J\x04\x08\x06\x10\x07J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tJ\x04\x08\t\x10\nJ\x04\x08\n\x10\x0b\"\xbc\x05\n\x16UpdateConnectedAccount\x12\x8d\x03\n\x15\x61uthorization_details\x18\x05 \x01(\x0b\x32\x34.scalekit.v1.connected_accounts.AuthorizationDetailsB\xa1\x02\x92\x41\x9d\x02\x32\x99\x01Updated authentication credentials. Provide new OAuth tokens (e.g., after refresh) or updated static auth details. Only included fields will be modified.J\x7f{\"oauth_token\": {\"access_token\": \"ya29.new_token...\", \"refresh_token\": \"1//0g...\", \"scopes\": [\"email\", \"profile\", \"calendar\"]}}R\x14\x61uthorizationDetails\x12\xe1\x01\n\napi_config\x18\n \x01(\x0b\x32\x17.google.protobuf.StructB\xa8\x01\x92\x41\xa4\x01\x32}Updated JSON configuration for API-specific settings. Merges with existing configuration - only provided fields are modified.J#{\"rate_limit\": 2000, \"timeout\": 60}R\tapiConfigJ\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x04\x10\x05J\x04\x08\x06\x10\x07J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tJ\x04\x08\t\x10\n\"\xe0\x08\n\x17\x43onnectedAccountForList\x12{\n\nidentifier\x18\x01 \x01(\tB[\x92\x41X2BThe unique identifier for this account in the third-party service.J\x12\"user@example.com\"R\nidentifier\x12]\n\x08provider\x18\x02 \x01(\tBA\x92\x41>22OAuth provider name (e.g., \'google\', \'microsoft\').J\x08\"google\"R\x08provider\x12h\n\x06status\x18\x03 \x01(\x0e\x32/.scalekit.v1.connected_accounts.ConnectorStatusB\x1f\x92\x41\x1c\x32\x1a\x43urrent connection status.R\x06status\x12\x80\x01\n\x12\x61uthorization_type\x18\x04 \x01(\x0e\x32-.scalekit.v1.connected_accounts.ConnectorTypeB\"\x92\x41\x1f\x32\x1d\x41uthorization mechanism type.R\x11\x61uthorizationType\x12~\n\x10token_expires_at\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampB8\x92\x41\x35\x32\x1bToken expiration timestamp.J\x16\"2024-12-31T23:59:59Z\"R\x0etokenExpiresAt\x12t\n\nupdated_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampB9\x92\x41\x36\x32\x1cLast modification timestamp.J\x16\"2024-03-20T15:04:05Z\"R\tupdatedAt\x12\x42\n\tconnector\x18\x08 \x01(\tB$\x92\x41!2\x15\x43onnector identifier.J\x08\"notion\"R\tconnector\x12p\n\x0clast_used_at\x18\t \x01(\x0b\x32\x1a.google.protobuf.TimestampB2\x92\x41/2\x15Last usage timestamp.J\x16\"2024-03-20T14:30:00Z\"R\nlastUsedAt\x12Q\n\x02id\x18\n \x01(\tBA\x92\x41>2$Unique connected account identifier.J\x16\"ca_24834495392086178\"R\x02id\x12w\n\rconnection_id\x18\x0b \x01(\tBR\x92\x41\x46\x32*Parent connection configuration reference.J\x18\"conn_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x0c\x63onnectionIdJ\x04\x08\x05\x10\x06\"\xe2\x02\n\x14\x41uthorizationDetails\x12M\n\x0boauth_token\x18\x01 \x01(\x0b\x32*.scalekit.v1.connected_accounts.OauthTokenH\x00R\noauthToken\x12M\n\x0bstatic_auth\x18\x02 \x01(\x0b\x32*.scalekit.v1.connected_accounts.StaticAuthH\x00R\nstaticAuth\x12N\n\ngoogle_dwd\x18\x03 \x01(\x0b\x32-.scalekit.v1.connected_accounts.GoogleDWDAuthH\x00R\tgoogleDwd\x12Q\n\x0btrusted_idp\x18\x04 \x01(\x0b\x32..scalekit.v1.connected_accounts.TrustedIDPAuthH\x00R\ntrustedIdpB\t\n\x07\x64\x65tails\"\xd8\x04\n\rGoogleDWDAuth\x12\x88\x01\n\x07subject\x18\x01 \x01(\tBn\x92\x41k2UEmail address of the Google Workspace user to impersonate via Domain-Wide Delegation.J\x12\"user@example.com\"R\x07subject\x12\x91\x01\n\x0c\x61\x63\x63\x65ss_token\x18\x02 \x01(\tBn\x92\x41h2POAuth access token acquired via the jwt-bearer grant. Present in responses only.J\x14\"ya29.a0AfH6SMBx...\"\xe0\x41\x03R\x0b\x61\x63\x63\x65ssToken\x12\x9d\x01\n\x06scopes\x18\x03 \x03(\tB\x84\x01\x92\x41~2>OAuth scopes granted to this token. Present in responses only.J<[\"openid\", \"https://www.googleapis.com/auth/userinfo.email\"]\xe0\x41\x03R\x06scopes\x12\x87\x01\n\x10token_expires_at\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampBA\x92\x41;29When the access token expires. Present in responses only.\xe0\x41\x03R\x0etokenExpiresAt\"\xc3\x05\n\x0eTrustedIDPAuth\x12\xb3\x01\n\x07\x64\x62_user\x18\x01 \x01(\tB\x99\x01\x92\x41\x95\x01\x32\x7fTarget database user for the federated session (required for provisioned Redshift clusters; ignored for serverless workgroups).J\x12\"analytics_reader\"R\x06\x64\x62User\x12\x92\x01\n\raccess_key_id\x18\x02 \x01(\tBn\x92\x41h2[Federated access key ID issued by the trusted identity provider. Present in responses only.J\t\"ASIA...\"\xe0\x41\x03R\x0b\x61\x63\x63\x65ssKeyId\x12x\n\x11secret_access_key\x18\x03 \x01(\tBL\x92\x41\x46\x32\x44\x46\x65\x64\x65rated secret access key. Never returned in public API responses.\xe0\x41\x03R\x0fsecretAccessKey\x12m\n\rsession_token\x18\x04 \x01(\tBH\x92\x41\x42\x32@Federated session token. Never returned in public API responses.\xe0\x41\x03R\x0csessionToken\x12}\n\x06\x65xpiry\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampBI\x92\x41\x43\x32\x41When the federated credentials expire. Present in responses only.\xe0\x41\x03R\x06\x65xpiry\"\xdc\x05\n\nOauthToken\x12\xa0\x01\n\x0c\x61\x63\x63\x65ss_token\x18\x01 \x01(\tB}\x92\x41z2bOAuth access token for API requests. Typically short-lived and must be refreshed after expiration.J\x14\"ya29.a0AfH6SMBx...\"R\x0b\x61\x63\x63\x65ssToken\x12\xae\x01\n\rrefresh_token\x18\x02 \x01(\tB\x88\x01\x92\x41\x84\x01\x32nOAuth refresh token for obtaining new access tokens. Long-lived and used to maintain persistent authorization.J\x12\"1//0gHJxZ-Lb2...\"R\x0crefreshToken\x12\xe1\x01\n\x06scopes\x18\x03 \x03(\tB\xc8\x01\x92\x41\xc4\x01\x32\\List of granted OAuth scopes defining the permissions and access levels for this connection.Jd[\"https://www.googleapis.com/auth/drive.readonly\", \"https://www.googleapis.com/auth/userinfo.email\"]R\x06scopes\x12\x95\x01\n\x06\x64omain\x18\x04 \x01(\tB}\x92\x41z2iAssociated domain for workspace or organization-scoped OAuth connections (e.g., Google Workspace domain).J\r\"example.com\"R\x06\x64omain\"\xf4\x01\n\nStaticAuth\x12\xe5\x01\n\x07\x64\x65tails\x18\x01 \x01(\x0b\x32\x17.google.protobuf.StructB\xb1\x01\x92\x41\xad\x01\x32zFlexible JSON structure containing static credentials. Format varies by connector type (API key, username/password, etc.).J/{\"api_key\": \"sk_live_...\", \"api_secret\": \"...\"}R\x07\x64\x65tails\"\x83\x02\n\x1aGetConnectedAccountRequest\x12\xe4\x01\n\x02id\x18\x01 \x01(\tB\xd3\x01\x92\x41\xc6\x01\x32\xab\x01Unique identifier for the connected account. Always prefixed with \'ca_\'. If omitted (via the /this path), the connected account is resolved from the current token context.J\x16\"ca_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x02id\"\xc5\x01\n\x1bGetConnectedAccountResponse\x12\xa5\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountBF\x92\x41\x43\x32\x41The connected account with its details and authentication status.R\x10\x63onnectedAccount\"\xb2\x01\n!DisconnectConnectedAccountRequest\x12\x8c\x01\n\x02id\x18\x01 \x01(\tB|\x92\x41p2VUnique identifier for the connected account to disconnect. Always prefixed with \'ca_\'.J\x16\"ca_24834495392086178\"\xbaH\x06r\x04\x10\x00\x18 R\x02id\"\xc6\x01\n\"DisconnectConnectedAccountResponse\x12\x9f\x01\n\x11\x63onnected_account\x18\x01 \x01(\x0b\x32\x30.scalekit.v1.connected_accounts.ConnectedAccountB@\x92\x41=2;The connected account with its updated DISCONNECTED status.R\x10\x63onnectedAccount\"\x17\n\x15GetRedirectUrlRequest\"\xb9\x01\n\x16GetRedirectUrlResponse\x12\x9e\x01\n\x0credirect_url\x18\x01 \x01(\tB{\x92\x41x2AThe URL to redirect the user to in the connected accounts portal.J3\"https://app.example.com/portal/connected-accounts\"R\x0bredirectUrl*\x8b\x01\n\x0f\x43onnectorStatus\x12!\n\x1d\x43ONNECTION_STATUS_UNSPECIFIED\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\x0b\n\x07\x45XPIRED\x10\x02\x12\x10\n\x0cPENDING_AUTH\x10\x03\x12\x18\n\x14PENDING_VERIFICATION\x10\x04\x12\x10\n\x0c\x44ISCONNECTED\x10\x05*\xc4\x01\n\rConnectorType\x12\x1f\n\x1b\x43ONNECTION_TYPE_UNSPECIFIED\x10\x00\x12\t\n\x05OAUTH\x10\x01\x12\x0b\n\x07\x41PI_KEY\x10\x02\x12\x0e\n\nBASIC_AUTH\x10\x03\x12\x10\n\x0c\x42\x45\x41RER_TOKEN\x10\x04\x12\n\n\x06\x43USTOM\x10\x05\x12\t\n\x05\x42\x41SIC\x10\x06\x12\r\n\tOAUTH_M2M\x10\x07\x12\x11\n\rTRELLO_OAUTH1\x10\x08\x12\x0e\n\nGOOGLE_DWD\x10\t\x12\x0f\n\x0bTRUSTED_IDP\x10\n2\x93W\n\x17\x43onnectedAccountService\x12\xde\x06\n\x15ListConnectedAccounts\x12<.scalekit.v1.connected_accounts.ListConnectedAccountsRequest\x1a=.scalekit.v1.connected_accounts.ListConnectedAccountsResponse\"\xc7\x05\x92\x41\x9b\x05\n\x12\x43onnected Accounts\x12\x17List connected accounts\x1a\x9a\x02Retrieves a paginated list of connected accounts for third-party integrations. Filter by organization, user, connector type, provider, or identifier. Returns OAuth tokens, API keys, and connection status for each account. Use pagination tokens to navigate through large result sets.J\xaf\x01\n\x03\x32\x30\x30\x12\xa7\x01\nbSuccessfully retrieved the list of connected accounts with their authentication details and status\x12\x41\n?\x1a=.scalekit.v1.connected_accounts.ListConnectedAccountsResponseJY\n\x03\x34\x30\x30\x12R\nPInvalid request - occurs when query parameters are malformed or validation failsJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02\x1c\x12\x1a/api/v1/connected_accounts\x12\xe0\x06\n\x17SearchConnectedAccounts\x12>.scalekit.v1.connected_accounts.SearchConnectedAccountsRequest\x1a?.scalekit.v1.connected_accounts.SearchConnectedAccountsResponse\"\xc3\x05\x92\x41\x90\x05\n\x12\x43onnected Accounts\x12\x19Search connected accounts\x1a\x99\x02Search for connected accounts in your environment using a text query that matches against identifiers, providers, or connectors. The search performs case-insensitive matching across account details. Returns paginated results with account status and authentication type information.J\x99\x01\n\x03\x32\x30\x30\x12\x91\x01\nJSuccessfully retrieved matching connected accounts with pagination support\x12\x43\nA\x1a?.scalekit.v1.connected_accounts.SearchConnectedAccountsResponseJc\n\x03\x34\x30\x30\x12\\\nZInvalid request - query parameter is too short (minimum 3 characters) or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02#\x12!/api/v1/connected_accounts:search\x12\xfe\x07\n\x16\x43reateConnectedAccount\x12=.scalekit.v1.connected_accounts.CreateConnectedAccountRequest\x1a>.scalekit.v1.connected_accounts.CreateConnectedAccountResponse\"\xe4\x06\x92\x41\xb5\x06\n\x12\x43onnected Accounts\x12\x1a\x43reate a connected account\x1a\xdf\x02\x43reates a new connected account with OAuth tokens or API credentials for third-party service integration. Supply authorization details including access tokens, refresh tokens, scopes, and optional API configuration. The account can be scoped to an organization or user. Returns the created account with its unique identifier and authentication status.J\xa4\x01\n\x03\x32\x30\x31\x12\x9c\x01\nVConnected account created successfully with authentication credentials stored securely\x12\x42\n@\x1a>.scalekit.v1.connected_accounts.CreateConnectedAccountResponseJg\n\x03\x34\x30\x30\x12`\n^Invalid request - missing required fields, invalid authorization details, or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJM\n\x03\x34\x30\x39\x12\x46\nDConflict - connected account with the same identifier already exists\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02\x1f\"\x1a/api/v1/connected_accounts:\x01*\x12\xf0\x07\n\x16UpdateConnectedAccount\x12=.scalekit.v1.connected_accounts.UpdateConnectedAccountRequest\x1a>.scalekit.v1.connected_accounts.UpdateConnectedAccountResponse\"\xd6\x06\x92\x41\xa6\x06\n\x12\x43onnected Accounts\x12$Update connected account credentials\x1a\xd2\x02Updates authentication credentials and configuration for an existing connected account. Modify OAuth tokens, refresh tokens, access scopes, or API configuration settings. Specify the account by ID, or by combination of organization/user, connector, and identifier. Returns the updated account with new token expiry and status information.J\x9a\x01\n\x03\x32\x30\x30\x12\x92\x01\nLConnected account updated successfully with new credentials or configuration\x12\x42\n@\x1a>.scalekit.v1.connected_accounts.UpdateConnectedAccountResponseJg\n\x03\x34\x30\x30\x12`\n^Invalid request - missing required fields, invalid authorization details, or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJK\n\x03\x34\x30\x34\x12\x44\nBConnected account not found - the specified account does not exist\x82\xb5\x18\x03\x18\xc4\x01\x82\xd3\xe4\x93\x02\x1f\x1a\x1a/api/v1/connected_accounts:\x01*\x12\xc6\x06\n\x16\x44\x65leteConnectedAccount\x12=.scalekit.v1.connected_accounts.DeleteConnectedAccountRequest\x1a>.scalekit.v1.connected_accounts.DeleteConnectedAccountResponse\"\xac\x05\x92\x41\xf6\x04\n\x12\x43onnected Accounts\x12\x1a\x44\x65lete a connected account\x1a\x9f\x02Permanently removes a connected account and revokes all associated authentication credentials. Identify the account by ID, or by combination of organization/user, connector, and identifier. This action cannot be undone. All OAuth tokens and API keys for this account will be invalidated.JK\n\x03\x32\x30\x30\x12\x44\nBConnected account deleted successfully and all credentials revokedJD\n\x03\x34\x30\x30\x12=\n;Invalid request - malformed parameters or validation failedJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJK\n\x03\x34\x30\x34\x12\x44\nBConnected account not found - the specified account does not exist\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02&\"!/api/v1/connected_accounts:delete:\x01*\x12\xff\x06\n\x1fGetMagicLinkForConnectedAccount\x12\x46.scalekit.v1.connected_accounts.GetMagicLinkForConnectedAccountRequest\x1aG.scalekit.v1.connected_accounts.GetMagicLinkForConnectedAccountResponse\"\xca\x05\x92\x41\x90\x05\n\x12\x43onnected Accounts\x12\"Generate authentication magic link\x1a\xa2\x02\x43reates a time-limited magic link for connecting or re-authorizing a third-party account. The link directs users to the OAuth authorization flow for the specified connector. Returns the generated link URL and expiration timestamp. Links typically expire after a short duration for security.J\x9f\x01\n\x03\x32\x30\x30\x12\x97\x01\nHMagic link generated successfully with authorization URL and expiry time\x12K\nI\x1aG.scalekit.v1.connected_accounts.GetMagicLinkForConnectedAccountResponseJK\n\x03\x34\x30\x30\x12\x44\nBInvalid request - missing required parameters or invalid connectorJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02*\"%/api/v1/connected_accounts/magic_link:\x01*\x12\x85\x06\n\x13GetConnectedAccount\x12:.scalekit.v1.connected_accounts.GetConnectedAccountRequest\x1a;.scalekit.v1.connected_accounts.GetConnectedAccountResponse\"\xf4\x04\x92\x41\x90\x04\n\x12\x43onnected Accounts\x12\x17Get a connected account\x1a\xb8\x01Retrieves a connected account by its unique ID. Use the path \'/this\' (e.g. /api/v1/connected_accounts/this) to retrieve the connected account associated with the current token context.Jv\n\x03\x32\x30\x30\x12o\n,Successfully retrieved the connected account\x12?\n=\x1a;.scalekit.v1.connected_accounts.GetConnectedAccountResponseJD\n\x03\x34\x30\x30\x12=\n;Invalid request - missing or malformed connected account IDJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJ$\n\x03\x34\x30\x34\x12\x1d\n\x1b\x43onnected account not found\x82\xb5\x18\x03\x18\xc4\x01\xfa\xd2\xe4\x93\x02\t\x12\x07PREVIEW\x82\xd3\xe4\x93\x02\x44\x12\x1f/api/v1/connected_accounts/thisZ!\x12\x1f/api/v1/connected_accounts/{id}\x12\xc3\t\n\x1a\x44isconnectConnectedAccount\x12\x41.scalekit.v1.connected_accounts.DisconnectConnectedAccountRequest\x1a\x42.scalekit.v1.connected_accounts.DisconnectConnectedAccountResponse\"\x9d\x08\x92\x41\xee\x06\n\x12\x43onnected Accounts\x12\x1e\x44isconnect a connected account\x1a\xb6\x02\x44isconnects a connected account by setting its status to DISCONNECTED. The account record is retained but marked as no longer active. Use the path \'/this:disconnect\' (e.g. /api/v1/connected_accounts/this:disconnect) to disconnect the account associated with the current token context, without specifying an ID.J\x80\x01\n\x03\x32\x30\x30\x12y\n/Successfully disconnected the connected account\x12\x46\nD\x1a\x42.scalekit.v1.connected_accounts.DisconnectConnectedAccountResponseJ\x99\x01\n\x03\x34\x30\x30\x12\x91\x01\n\x8e\x01Invalid request - malformed connected account ID, or attempting to disconnect an account other than the one bound to the current token contextJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJv\n\x03\x34\x30\x33\x12o\nmForbidden - the token context is bound to a different connected account than the one specified in the requestJ$\n\x03\x34\x30\x34\x12\x1d\n\x1b\x43onnected account not found\x82\xb5\x18\x03\x18\xc4\x01\xfa\xd2\xe4\x93\x02\t\x12\x07PREVIEW\x82\xd3\xe4\x93\x02\x8e\x01\"*/api/v1/connected_accounts/{id}:disconnect:\x01*Z,\"\'/api/v1/connected_accounts/-:disconnect:\x01*Z/\"*/api/v1/connected_accounts/this:disconnect:\x01*\x12\xc2\x04\n\x0eGetRedirectUrl\x12\x35.scalekit.v1.connected_accounts.GetRedirectUrlRequest\x1a\x36.scalekit.v1.connected_accounts.GetRedirectUrlResponse\"\xc0\x03\x92\x41\xf0\x02\n\x12\x43onnected Accounts\x12\x17Get portal redirect URL\x1a\x87\x01Returns the redirect URL for the connected accounts portal. Used to redirect users to the appropriate portal page after authentication.Js\n\x03\x32\x30\x30\x12l\n.Successfully retrieved the portal redirect URL\x12:\n8\x1a\x36.scalekit.v1.connected_accounts.GetRedirectUrlResponseJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access token\x82\xb5\x18\x03\x18\x80\x01\xfa\xd2\xe4\x93\x02\t\x12\x07PREVIEW\x82\xd3\xe4\x93\x02\x30\x12./api/v1/connected_accounts/portal/redirect_url\x12\xbf\x07\n\x17GetConnectedAccountAuth\x12\x46.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierRequest\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponse\"\x92\x06\x92\x41\xe1\x05\n\x12\x43onnected Accounts\x12&Get connected account auth credentials\x1a\xab\x02Retrieves complete authentication details for a connected account including OAuth tokens, refresh tokens, scopes, and API configuration. Query by account ID or by combination of organization/user, connector, and identifier. Returns sensitive credential information - use appropriate access controls.J\xa0\x01\n\x03\x32\x30\x30\x12\x98\x01\nISuccessfully retrieved connected account with full authentication details\x12K\nI\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponseJ<\n\x03\x34\x30\x30\x12\x35\n3Invalid request - missing required query parametersJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJP\n\x03\x34\x30\x34\x12I\nGConnected account not found - no account matches the specified criteria\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02!\x12\x1f/api/v1/connected_accounts/auth\x12\xfb\x06\n\x1aGetConnectedAccountDetails\x12\x46.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierRequest\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponse\"\xcb\x05\x92\x41\x97\x05\n\x12\x43onnected Accounts\x12\x1eGet connected account metadata\x1a\x83\x02Returns metadata for a connected account including status, connector type, provider, and configuration without exposing stored authorization credentials. Look up by account ID, or by a combination of organization (or user), connector, and external identifier.J\x86\x01\n\x03\x32\x30\x30\x12\x7f\n0Successfully retrieved connected account details\x12K\nI\x1aG.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponseJ<\n\x03\x34\x30\x30\x12\x35\n3Invalid request - missing required query parametersJB\n\x03\x34\x30\x31\x12;\n9Authentication required - missing or invalid access tokenJP\n\x03\x34\x30\x34\x12I\nGConnected account not found - no account matches the specified criteria\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02$\x12\"/api/v1/connected_accounts/details\x12\xbb\x07\n\x1aVerifyConnectedAccountUser\x12\x41.scalekit.v1.connected_accounts.VerifyConnectedAccountUserRequest\x1a\x42.scalekit.v1.connected_accounts.VerifyConnectedAccountUserResponse\"\x95\x06\x92\x41\xda\x05\n\x12\x43onnected Accounts\x12\x1dVerify connected account user\x1a\xa4\x02\x43onfirms the user assertion and activates the connected account after the user completes third-party OAuth. Called by the B2B app server with auth_request_id and identifier. Validates that the asserted identifier matches the one stored on the auth request and promotes pending tokens to live.J\x8a\x01\n\x03\x32\x30\x30\x12\x82\x01\n8Verification successful; connected account is now ACTIVE\x12\x46\nD\x1a\x42.scalekit.v1.connected_accounts.VerifyConnectedAccountUserResponseJ6\n\x03\x34\x30\x30\x12/\n-Invalid request - missing or malformed fieldsJ7\n\x03\x34\x30\x31\x12\x30\n.Unauthorized - invalid or missing access tokenJ(\n\x03\x34\x30\x33\x12!\n\x1f\x46orbidden - identifier mismatchJV\n\x03\x34\x30\x34\x12O\nMNot found - no pending flow for the given auth_request_id or already consumed\x82\xb5\x18\x02\x18\x44\x82\xd3\xe4\x93\x02+\"&/api/v1/connected_accounts/user/verify:\x01*\x1a\xe3\x01\x92\x41\xdf\x01\n\x12\x43onnected Accounts\x12\xc8\x01Manage connected accounts for third-party integrations and OAuth connections. Connected accounts represent authenticated access to external services like Google, Notion, Slack, and other applications.B\xa4\x02Z<github.com/scalekit-inc/scalekit/pkg/grpc/connected_accounts\x92\x41\xe2\x01j\xdf\x01\n\x12\x43onnected Accounts\x12\xc8\x01Manage connected accounts for third-party integrations and OAuth connections. Connected accounts represent authenticated access to external services like Google, Notion, Slack, and other applications.b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -208,6 +208,16 @@ if not _descriptor._USE_C_DESCRIPTORS:
   _globals['_GOOGLEDWDAUTH'].fields_by_name['scopes']._serialized_options = b'\222A~2>OAuth scopes granted to this token. Present in responses only.J<[\"openid\", \"https://www.googleapis.com/auth/userinfo.email\"]\340A\003'
   _globals['_GOOGLEDWDAUTH'].fields_by_name['token_expires_at']._loaded_options = None
   _globals['_GOOGLEDWDAUTH'].fields_by_name['token_expires_at']._serialized_options = b'\222A;29When the access token expires. Present in responses only.\340A\003'
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['db_user']._loaded_options = None
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['db_user']._serialized_options = b'\222A\225\0012\177Target database user for the federated session (required for provisioned Redshift clusters; ignored for serverless workgroups).J\022\"analytics_reader\"'
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['access_key_id']._loaded_options = None
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['access_key_id']._serialized_options = b'\222Ah2[Federated access key ID issued by the trusted identity provider. Present in responses only.J\t\"ASIA...\"\340A\003'
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['secret_access_key']._loaded_options = None
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['secret_access_key']._serialized_options = b'\222AF2DFederated secret access key. Never returned in public API responses.\340A\003'
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['session_token']._loaded_options = None
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['session_token']._serialized_options = b'\222AB2@Federated session token. Never returned in public API responses.\340A\003'
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['expiry']._loaded_options = None
+  _globals['_TRUSTEDIDPAUTH'].fields_by_name['expiry']._serialized_options = b'\222AC2AWhen the federated credentials expire. Present in responses only.\340A\003'
   _globals['_OAUTHTOKEN'].fields_by_name['access_token']._loaded_options = None
   _globals['_OAUTHTOKEN'].fields_by_name['access_token']._serialized_options = b'\222Az2bOAuth access token for API requests. Typically short-lived and must be refreshed after expiration.J\024\"ya29.a0AfH6SMBx...\"'
   _globals['_OAUTHTOKEN'].fields_by_name['refresh_token']._loaded_options = None
@@ -254,10 +264,10 @@ if not _descriptor._USE_C_DESCRIPTORS:
   _globals['_CONNECTEDACCOUNTSERVICE'].methods_by_name['GetConnectedAccountDetails']._serialized_options = b'\222A\227\005\n\022Connected Accounts\022\036Get connected account metadata\032\203\002Returns metadata for a connected account including status, connector type, provider, and configuration without exposing stored authorization credentials. Look up by account ID, or by a combination of organization (or user), connector, and external identifier.J\206\001\n\003200\022\177\n0Successfully retrieved connected account details\022K\nI\032G.scalekit.v1.connected_accounts.GetConnectedAccountByIdentifierResponseJ<\n\003400\0225\n3Invalid request - missing required query parametersJB\n\003401\022;\n9Authentication required - missing or invalid access tokenJP\n\003404\022I\nGConnected account not found - no account matches the specified criteria\202\265\030\002\030D\202\323\344\223\002$\022\"/api/v1/connected_accounts/details'
   _globals['_CONNECTEDACCOUNTSERVICE'].methods_by_name['VerifyConnectedAccountUser']._loaded_options = None
   _globals['_CONNECTEDACCOUNTSERVICE'].methods_by_name['VerifyConnectedAccountUser']._serialized_options = b'\222A\332\005\n\022Connected Accounts\022\035Verify connected account user\032\244\002Confirms the user assertion and activates the connected account after the user completes third-party OAuth. Called by the B2B app server with auth_request_id and identifier. Validates that the asserted identifier matches the one stored on the auth request and promotes pending tokens to live.J\212\001\n\003200\022\202\001\n8Verification successful; connected account is now ACTIVE\022F\nD\032B.scalekit.v1.connected_accounts.VerifyConnectedAccountUserResponseJ6\n\003400\022/\n-Invalid request - missing or malformed fieldsJ7\n\003401\0220\n.Unauthorized - invalid or missing access tokenJ(\n\003403\022!\n\037Forbidden - identifier mismatchJV\n\003404\022O\nMNot found - no pending flow for the given auth_request_id or already consumed\202\265\030\002\030D\202\323\344\223\002+\"&/api/v1/connected_accounts/user/verify:\001*'
-  _globals['_CONNECTORSTATUS']._serialized_start=19769
-  _globals['_CONNECTORSTATUS']._serialized_end=19908
-  _globals['_CONNECTORTYPE']._serialized_start=19911
-  _globals['_CONNECTORTYPE']._serialized_end=20090
+  _globals['_CONNECTORSTATUS']._serialized_start=20562
+  _globals['_CONNECTORSTATUS']._serialized_end=20701
+  _globals['_CONNECTORTYPE']._serialized_start=20704
+  _globals['_CONNECTORTYPE']._serialized_end=20900
   _globals['_LISTCONNECTEDACCOUNTSREQUEST']._serialized_start=359
   _globals['_LISTCONNECTEDACCOUNTSREQUEST']._serialized_end=2421
   _globals['_LISTCONNECTEDACCOUNTSRESPONSE']._serialized_start=2424
@@ -299,25 +309,27 @@ if not _descriptor._USE_C_DESCRIPTORS:
   _globals['_CONNECTEDACCOUNTFORLIST']._serialized_start=15730
   _globals['_CONNECTEDACCOUNTFORLIST']._serialized_end=16850
   _globals['_AUTHORIZATIONDETAILS']._serialized_start=16853
-  _globals['_AUTHORIZATIONDETAILS']._serialized_end=17124
-  _globals['_GOOGLEDWDAUTH']._serialized_start=17127
-  _globals['_GOOGLEDWDAUTH']._serialized_end=17727
-  _globals['_OAUTHTOKEN']._serialized_start=17730
-  _globals['_OAUTHTOKEN']._serialized_end=18462
-  _globals['_STATICAUTH']._serialized_start=18465
-  _globals['_STATICAUTH']._serialized_end=18709
-  _globals['_GETCONNECTEDACCOUNTREQUEST']._serialized_start=18712
-  _globals['_GETCONNECTEDACCOUNTREQUEST']._serialized_end=18971
-  _globals['_GETCONNECTEDACCOUNTRESPONSE']._serialized_start=18974
-  _globals['_GETCONNECTEDACCOUNTRESPONSE']._serialized_end=19171
-  _globals['_DISCONNECTCONNECTEDACCOUNTREQUEST']._serialized_start=19174
-  _globals['_DISCONNECTCONNECTEDACCOUNTREQUEST']._serialized_end=19352
-  _globals['_DISCONNECTCONNECTEDACCOUNTRESPONSE']._serialized_start=19355
-  _globals['_DISCONNECTCONNECTEDACCOUNTRESPONSE']._serialized_end=19553
-  _globals['_GETREDIRECTURLREQUEST']._serialized_start=19555
-  _globals['_GETREDIRECTURLREQUEST']._serialized_end=19578
-  _globals['_GETREDIRECTURLRESPONSE']._serialized_start=19581
-  _globals['_GETREDIRECTURLRESPONSE']._serialized_end=19766
-  _globals['_CONNECTEDACCOUNTSERVICE']._serialized_start=20093
-  _globals['_CONNECTEDACCOUNTSERVICE']._serialized_end=31248
+  _globals['_AUTHORIZATIONDETAILS']._serialized_end=17207
+  _globals['_GOOGLEDWDAUTH']._serialized_start=17210
+  _globals['_GOOGLEDWDAUTH']._serialized_end=17810
+  _globals['_TRUSTEDIDPAUTH']._serialized_start=17813
+  _globals['_TRUSTEDIDPAUTH']._serialized_end=18520
+  _globals['_OAUTHTOKEN']._serialized_start=18523
+  _globals['_OAUTHTOKEN']._serialized_end=19255
+  _globals['_STATICAUTH']._serialized_start=19258
+  _globals['_STATICAUTH']._serialized_end=19502
+  _globals['_GETCONNECTEDACCOUNTREQUEST']._serialized_start=19505
+  _globals['_GETCONNECTEDACCOUNTREQUEST']._serialized_end=19764
+  _globals['_GETCONNECTEDACCOUNTRESPONSE']._serialized_start=19767
+  _globals['_GETCONNECTEDACCOUNTRESPONSE']._serialized_end=19964
+  _globals['_DISCONNECTCONNECTEDACCOUNTREQUEST']._serialized_start=19967
+  _globals['_DISCONNECTCONNECTEDACCOUNTREQUEST']._serialized_end=20145
+  _globals['_DISCONNECTCONNECTEDACCOUNTRESPONSE']._serialized_start=20148
+  _globals['_DISCONNECTCONNECTEDACCOUNTRESPONSE']._serialized_end=20346
+  _globals['_GETREDIRECTURLREQUEST']._serialized_start=20348
+  _globals['_GETREDIRECTURLREQUEST']._serialized_end=20371
+  _globals['_GETREDIRECTURLRESPONSE']._serialized_start=20374
+  _globals['_GETREDIRECTURLRESPONSE']._serialized_end=20559
+  _globals['_CONNECTEDACCOUNTSERVICE']._serialized_start=20903
+  _globals['_CONNECTEDACCOUNTSERVICE']._serialized_end=32058
 # @@protoc_insertion_point(module_scope)