Third-Party Integrations APIs

Version: aju17f20mq

Use the reference below for request and response fields and operation-specific requirements.

Overview

Connect end-user accounts through the optional hosted Pipedream integration. This API requires Pipedream Connect to be enabled for your account.

Everything Is Scoped To The Calling User

Authentication

User-facing calls act for the authenticated beneficiary. A backend sk_… key uses an authorized X-On-Behalf-Of selection with users:impersonate; a client pk_… key accompanies that user’s JWT from the configured issuer. Never expose a secret key in a client. Raw identity headers and recipient IDs are not authentication. See Authentication.

Tenant context comes from the authenticated request. Client-supplied X-Tenant-Id, X-User-Id or X-Project-Id are not an authorization mechanism. The current public integration uses the default project. Do not rely on project headers for separate project, test/live or customer isolation on this API.

A completed redirect is not proof of a connected, authorized account. Reconcile the current connection attempt and returned account state. Multiple accounts can exist for one app. A healthy connection does not replace the user’s consent for an action.

Related guide: Connected accounts

Pagination

JSON conventions

Requests accept snake_case or camelCase field names; responses use camelCase. Ordinary default-valued scalars and empty repeated fields can be omitted. Explicitly present optional scalars, map values and well-known JSON types follow their own presence rules: an explicit false, 0 or empty value is not universally equivalent to absence. Decode each field according to its schema. 64-bit integers use JSON strings; preserve their precision. Unknown request fields are generally discarded before validation, so a typo can silently change behavior. This is not a guarantee that arbitrary fields or future client contracts are supported. See API conventions.

Pipedream

Connect a user's own third-party accounts through Pipedream Connect, and manage what they have connected. The arc is: browse the catalog (public data, readable before anyone has connected anything), mint a short-lived hosted link the user opens to authorize one app, then read and remove the accounts that came out of it — including whole-user offboarding.

• List connectable apps
• Retrieve one app by slug
• List app categories
• Start connecting an app
• List the caller's connected accounts
• Disconnect one account
• Delete the caller's integration data entirely
• Call a connected app's API as the user

Server 1

Travila API

https://api.travila.ai

X-API-Key

Project/service API key. Use pk_… only with a verified end-user JWT; backend sk_… calls that require a user use authorized on-behalf-of context. Management operations can have different requirements; consult the operation and authentication guide.

X-On-Behalf-Of

The end user this call acts for. Required with an sk_… key, because a secret key identifies your tenant and not a user; omitting it returns 401 authenticated user_id is required. The key needs the users:impersonate scope or the call fails with 403 insufficient_scope.

Authorization: Bearer

The end user's own JWT, issued by the OIDC provider configured on the publishable key. Required alongside a pk_… key, and supplies the user identity in place of X-On-Behalf-Of.

Authentication credentials

API Key: apiKeyAuth

Setting	Value
Security scheme type	apiKey
header parameter name	X-API-Key

API Key: onBehalfOf

Setting	Value
Security scheme type	apiKey
header parameter name	X-On-Behalf-Of

HTTP: bearerAuth

Setting	Value
Security scheme type	http
Scheme	bearer

Operations

• Start connecting an app — POST /api/v1/integrations/pipedream/create-connect-token
• List connectable apps — POST /api/v1/integrations/pipedream/list-apps
• Retrieve one app by slug — POST /api/v1/integrations/pipedream/retrieve-app
• List app categories — POST /api/v1/integrations/pipedream/list-app-categories
• List the caller's connected accounts — POST /api/v1/integrations/pipedream/list-accounts
• Disconnect one account — POST /api/v1/integrations/pipedream/delete-account
• Delete the caller's integration data entirely — POST /api/v1/integrations/pipedream/delete-external-user
• Call a connected app's API as the user — POST /api/v1/integrations/pipedream/proxy

Document ID: DOC-API-connected-apps-overview. Section identities and revisions.

Section	Stable reference
Overview	DOC-API-connected-apps-overview#overview
Everything Is Scoped To The Calling User	DOC-API-connected-apps-overview#everything-is-scoped-to-the-calling-user
Authentication	DOC-API-connected-apps-overview#authentication
Pagination	DOC-API-connected-apps-overview#pagination
JSON conventions	DOC-API-connected-apps-overview#json-conventions
Pipedream	DOC-API-connected-apps-overview#reference-group-1
Server 1	DOC-API-connected-apps-overview#reference-server-1
X-API-Key	DOC-API-connected-apps-overview#authentication-apiKeyAuth
X-On-Behalf-Of	DOC-API-connected-apps-overview#authentication-onBehalfOf
Authorization: Bearer	DOC-API-connected-apps-overview#authentication-bearerAuth