WorkOS PHP SDK

__construct()


    public
                    __construct(HttpClient $client) : mixed

Parameters

$client : HttpClient

authorizeDataIntegration()

Get authorization URL


    public
                    authorizeDataIntegration(string $slug, string $userId[, string|null $organizationId = null ][, PipesOwnership|null $connectionOwner = null ][, string|null $returnTo = null ][, array<string, string>|null $config = null ][, RequestOptions|null $options = null ][, string|null $accountDisplayName = null ][, string|null $codeChallenge = null ][, string|null $codeChallengeMethod = null ][, DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionIntent|null $connectionIntent = null ][, string|null $connectedAccountId = null ]) : DataIntegrationAuthorizeUrlResponse

Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.

Parameters

$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$userId : string: The ID of the user to authorize. When connection_owner is organization, this is the user authorizing on behalf of the organization; they must be an active member of the organization and do not become the owner of the resulting connected account.
$organizationId : string|null = null: An organization ID to scope the authorization to a specific organization. Required when connection_owner is organization.
$connectionOwner : PipesOwnership|null = null: Who will own the connected account. user (the default) connects the user's own account. organization connects the organization's shared account and requires organization_id.
$returnTo : string|null = null: The URL to redirect the user to after authorization. Required with code_challenge, and must then exactly match a redirect URI registered on one of the environment's applications. Loopback URLs match on any port; wildcard redirect URIs are not honored, and a return_to with a query string or fragment never matches.
$config : array<string, string>|null = null: Connect-time config values for the provider-declared installation-scope fields (e.g. a Zendesk subdomain), keyed by the config field. Only fields the provider declares may be supplied, and required fields must be provided unless already pinned on the integration.
$options : RequestOptions|null = null
$accountDisplayName : string|null = null: A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
$codeChallenge : string|null = null: A PKCE-style code challenge: the base64url-encoded SHA-256 of a code_verifier your app keeps. When set, the connection isn't saved when the user finishes authorizing. Instead, the user is redirected to return_to with a connect_code and state, and your app must call Finish connection with the connect_code and code_verifier within 90 seconds to save it.
$codeChallengeMethod : string|null = null: The method used to derive code_challenge. Only S256 is supported, and it is the default. Requires code_challenge.
$connectionIntent : DataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionIntent|null = null: Which connection the request targets. Omit it to use the compatibility connection. Send add to create another connection: the first connection for an owner shape fills the compatibility slot, and later connections are standard. Send reauthorize with connected_account_id to reauthorize one exact connection.
$connectedAccountId : string|null = null: The exact connected account to reauthorize. Required with connection_intent: reauthorize and not accepted otherwise.

Tags

Return values

DataIntegrationAuthorizeUrlResponse

createDataIntegration()

Create a data integration


    public
                    createDataIntegration(string $provider[, PipesOwnership|null $ownership = null ][, string|null $description = null ][, bool|null $enabled = null ][, array<string|int, string>|null $scopes = null ][, array<string|int, DataIntegrationAuthMethods>|null $authMethods = null ][, array<string, string>|null $config = null ][, DataIntegrationCredentialsInput|null $credentials = null ][, ApiKeyInstallation|null $apiKey = null ][, CustomProviderDefinition|null $customProvider = null ][, RequestOptions|null $options = null ]) : DataIntegration

Creates a data integration for a provider. Set credentials.type to custom to use your own OAuth app credentials or organization to have each organization supply its own. Set auth_methods to ["api_key"] to create an API key integration; you may optionally supply an api_key block to install a first tenant in the same call. Set auth_methods to ["client_credentials"] to create a client-credentials integration; client credentials are installed per-tenant afterwards. Set ownership to organization to create the integration organizations connect to instead of the default user-owned one; a provider may have one of each. For a built-in provider, pass its slug as provider. For a custom provider, pass a new slug plus a custom_provider definition, or the slug of an existing custom provider (without custom_provider) to add the other ownership.

Parameters

$provider : string: The provider to create a Data Integration for. For a built-in provider use its slug (e.g. github, slack). For a custom provider, this is the new provider slug and custom_provider must be supplied. A custom provider slug cannot shadow an existing global provider slug.
$ownership : PipesOwnership|null = null: Who owns the Data Integration. user (the default) creates the integration users connect their own accounts to; organization creates the root organizations connect to. Ownership is fixed at creation, and one integration of each ownership may exist per provider. Independent of credentials.type.
$description : string|null = null: An optional description of the Data Integration.
$enabled : bool|null = null: Whether the Data Integration is enabled. Defaults to false.
$scopes : array<string|int, string>|null = null: The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
$authMethods : array<string|int, DataIntegrationAuthMethods>|null = null: How accounts authenticate with the provider. Defaults to ["oauth"]. Use ["api_key"] to declare an API key integration; credentials is then not required and keys are supplied per-tenant (optionally via api_key on this request). Use ["client_credentials"] to declare a client-credentials integration; credentials is likewise not required and client credentials are supplied per-tenant.
$config : array<string, string>|null = null: Provider-specific config values (e.g. a Snowflake account), keyed by the config field. Only fields the built-in provider declares are accepted.
$credentials : DataIntegrationCredentialsInput|null = null: The OAuth credentials to configure for the Data Integration. Required for OAuth integrations; omit when auth_methods is ["api_key"].
$apiKey : ApiKeyInstallation|null = null: An optional API key to install for the first tenant on an api_key integration. Omit to declare a keyless integration; tenants can be added later via the per-installation API key path.
$customProvider : CustomProviderDefinition|null = null: The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.
$options : RequestOptions|null = null

Tags

Return values

DataIntegration

createDataIntegrationApiKey()

Create another API key connected account


    public
                    createDataIntegrationApiKey(string $slug, string $userId, string $secret, string $connectionIntent[, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $organizationId = null ][, PipesOwnership|null $connectionOwner = null ][, RequestOptions|null $options = null ]) : ConnectedAccount

Creates another API key-based connected account for the specified integration, owned by the user or, when connection_owner is organization, shared by the organization. Requires connection_intent: add and does not accept connected_account_id; use PUT to create or rotate the compatibility connection or to update an exact connection.

Parameters

$slug : string: The identifier of the integration.
$userId : string: A User identifier.
$secret : string: The API key secret to store for this integration.
$connectionIntent : string: Must be add: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard.
$accountDisplayName : string|null = null: A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
$accountIdentifier : string|null = null: A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
$organizationId : string|null = null: An Organization identifier. Optional parameter to scope the connection to a specific organization. Required when connection_owner is organization.
$connectionOwner : PipesOwnership|null = null: Whose connection to create or rotate. user (the default) addresses the connection owned by user_id. organization addresses the connection shared by every member of organization_id; user_id then identifies the member performing the request and must be an active member of the organization.
$options : RequestOptions|null = null

Tags

Return values

ConnectedAccount

createDataIntegrationClientCredential()

Create another client credentials connected account


    public
                    createDataIntegrationClientCredential(string $slug, string $userId, string $clientId, string $clientSecret, string $connectionIntent[, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $organizationId = null ][, PipesOwnership|null $connectionOwner = null ][, array<string, string>|null $config = null ][, RequestOptions|null $options = null ]) : ConnectedAccount

Creates another client credentials-based connected account for the specified integration, owned by the user or, when connection_owner is organization, shared by the organization. Requires connection_intent: add and does not accept connected_account_id; use PUT to create or rotate the compatibility connection or to update an exact connection.

Parameters

$slug : string: The identifier of the integration.
$userId : string: A User identifier.
$clientId : string: The OAuth client ID to store for this integration.
$clientSecret : string: The OAuth client secret to store for this integration.
$connectionIntent : string: Must be add: this endpoint only creates another connection. The first connection for an owner shape fills the compatibility slot; later connections are standard.
$accountDisplayName : string|null = null: A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
$accountIdentifier : string|null = null: A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
$organizationId : string|null = null: An Organization identifier. Optional parameter to scope the connection to a specific organization. Required when connection_owner is organization.
$connectionOwner : PipesOwnership|null = null: Whose connection to create or rotate. user (the default) addresses the connection owned by user_id. organization addresses the connection shared by every member of organization_id; user_id then identifies the member performing the request and must be an active member of the organization.
$config : array<string, string>|null = null: Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
$options : RequestOptions|null = null

Tags

Return values

ConnectedAccount

createDataIntegrationCredential()

Vend credentials for a connected account


    public
                    createDataIntegrationCredential(string $slug, string $userId[, string|null $organizationId = null ][, string|null $connectedAccountId = null ][, PipesOwnership|null $connectionOwner = null ][, bool|null $supportsMultipleConnections = null ][, RequestOptions|null $options = null ]) : DataIntegrationCredentialsResponse

Returns credentials for a user's connected account. Branches on the installation's auth_method: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret. Every active credential includes config: provider-declared, non-secret values from the installation snapshot, with current provider defaults for unset fields. Editing integration or organization configuration does not change the snapshot; reconnect or explicitly rebind the connection to adopt those edits. Defaults remain live, so a changed default can appear in config before a cached token is refreshed or re-minted. Credentials that never refresh require a reconnect or rebind when a default changes their routing.

Parameters

$slug : string: The identifier of the integration.
$userId : string: A User identifier. When connection_owner is organization, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
$organizationId : string|null = null: An Organization identifier. Optional parameter to scope the connection to a specific organization. Required when connection_owner is organization.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select a specific connection when the user has several for this provider.
$connectionOwner : PipesOwnership|null = null: Which connection to vend from. user (the default) vends the user's own connection and requires user_id. organization vends the organization's shared connection and requires organization_id.
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. If no connected_account_id is supplied and several connections match, the request returns account_selection_required. When omitted or false, only the compatibility connection is considered.
$options : RequestOptions|null = null

Tags

Return values

DataIntegrationCredentialsResponse

createOrganizationConnectedAccount()

Import an organization connected account


    public
                    createOrganizationConnectedAccount(string $organizationId, string $slug, string $userId[, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $accessToken = null ][, string|null $refreshToken = null ][, DateTimeImmutable|null $expiresAt = null ][, array<string|int, string>|null $scopes = null ][, PipeConnectedAccountState|null $state = null ][, string|null $connectionIntent = null ][, RequestOptions|null $options = null ][, array<string, string>|null $config = null ][, array<string, mixed>|null $metadata = null ]) : ConnectedAccount

Imports an organization-owned connected account by providing OAuth tokens directly. Omit connection_intent to create only the compatibility connection, or set it to add to explicitly create another connection. This creation-only endpoint does not accept connected_account_id or reauthorization intent.

Parameters

$organizationId : string: An Organization identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$userId : string: The User identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
$accountDisplayName : string|null = null: A mutable, non-unique connection label; null clears it. Not an account identifier.
$accountIdentifier : string|null = null: A developer-attested account identifier; null clears it.
$accessToken : string|null = null: The OAuth access token for the connected account.
$refreshToken : string|null = null: The OAuth refresh token for the connected account.
$expiresAt : DateTimeImmutable|null = null: The ISO-8601 timestamp when the access token expires. Required when access_token is provided for tokens that expire.
$scopes : array<string|int, string>|null = null: The OAuth scopes granted for this connection.
$state : PipeConnectedAccountState|null = null: Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
$connectionIntent : string|null = null: Set to add to create another connected account. Omit this field for permanent compatibility behavior.
$options : RequestOptions|null = null
$config : array<string, string>|null = null: Installation-scoped provider configuration for this connection, such as Salesforce salesforce_host. Imports apply supplied values over installation-scoped integration pins and inherit other config from the credential source. Credential-bearing imports must satisfy required configuration even when config is omitted or }. On update, a supplied object replaces installation-scoped values; omitted config preserves the stored snapshot. Stored integration-scoped values remain bound to the OAuth client and cannot be overridden or replaced with current integration pins. Replacements must satisfy required configuration; } and empty-string values clear installation-scoped values only when the result is valid. Provider defaults count toward completeness but are resolved at read time, not stored. Only tokenless needs_reauthorization placeholders may remain incomplete; attaching their first tokens validates configuration even when config is omitted. Unrelated updates do not revalidate unchanged configuration. Clearing salesforce_host falls back to login.salesforce.com, which may not work for sandbox or My Domain-only connections.
$metadata : array<string, mixed>|null = null: Provider token-response metadata to preserve during import, such as Salesforce instance_url. Only allowlisted, non-sensitive scalar fields from this provider are accepted, including nested fields. Provider refresh responses can update these values. Not accepted on update.

Tags

Return values

ConnectedAccount

createUserConnectedAccount()

Import a connected account


    public
                    createUserConnectedAccount(string $userId, string $slug[, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $accessToken = null ][, string|null $refreshToken = null ][, DateTimeImmutable|null $expiresAt = null ][, array<string|int, string>|null $scopes = null ][, PipeConnectedAccountState|null $state = null ][, string|null $connectionIntent = null ][, string|null $organizationId = null ][, RequestOptions|null $options = null ][, array<string, string>|null $config = null ][, array<string, mixed>|null $metadata = null ]) : ConnectedAccount

Imports a connected account for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.

Parameters

$userId : string: A User identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$accountDisplayName : string|null = null: A mutable, non-unique connection label; null clears it. Not an account identifier.
$accountIdentifier : string|null = null: A developer-attested account identifier; null clears it.
$accessToken : string|null = null: The OAuth access token for the connected account.
$refreshToken : string|null = null: The OAuth refresh token for the connected account.
$expiresAt : DateTimeImmutable|null = null: The ISO-8601 timestamp when the access token expires. Required when access_token is provided for tokens that expire.
$scopes : array<string|int, string>|null = null: The OAuth scopes granted for this connection.
$state : PipeConnectedAccountState|null = null: Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
$connectionIntent : string|null = null: Set to add to create another connected account. Omit this field for permanent compatibility behavior.
$organizationId : string|null = null: An Organization identifier. Optional parameter if the connection is scoped to an organization.
$options : RequestOptions|null = null
$config : array<string, string>|null = null: Installation-scoped provider configuration for this connection, such as Salesforce salesforce_host. Imports apply supplied values over installation-scoped integration pins and inherit other config from the credential source. Credential-bearing imports must satisfy required configuration even when config is omitted or }. On update, a supplied object replaces installation-scoped values; omitted config preserves the stored snapshot. Stored integration-scoped values remain bound to the OAuth client and cannot be overridden or replaced with current integration pins. Replacements must satisfy required configuration; } and empty-string values clear installation-scoped values only when the result is valid. Provider defaults count toward completeness but are resolved at read time, not stored. Only tokenless needs_reauthorization placeholders may remain incomplete; attaching their first tokens validates configuration even when config is omitted. Unrelated updates do not revalidate unchanged configuration. Clearing salesforce_host falls back to login.salesforce.com, which may not work for sandbox or My Domain-only connections.
$metadata : array<string, mixed>|null = null: Provider token-response metadata to preserve during import, such as Salesforce instance_url. Only allowlisted, non-sensitive scalar fields from this provider are accepted, including nested fields. Provider refresh responses can update these values. Not accepted on update.

Tags

Return values

ConnectedAccount

deleteDataIntegration()

Delete a data integration


    public
                    deleteDataIntegration(string $slug[, RequestOptions|null $options = null ]) : void

Deletes the user-owned data integration and all of its connected installations. For a custom provider, the provider definition is deleted once no organization-owned root references it either.

Parameters

$slug : string: The slug identifier of the data integration.
$options : RequestOptions|null = null

Tags

deleteDataIntegrationOrganization()

Delete an organization-owned data integration


    public
                    deleteDataIntegrationOrganization(string $slug[, RequestOptions|null $options = null ]) : void

Deletes the organization-owned data integration for a provider and all of its connected installations. For a custom provider, the provider definition is deleted once no user-owned root references it either. The /organization suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization.

Parameters

$slug : string: The slug identifier of the data integration.
$options : RequestOptions|null = null

Tags

deleteOrganizationConnectedAccount()

Delete an organization connected account


    public
                    deleteOrganizationConnectedAccount(string $organizationId, string $slug[, bool|null $supportsMultipleConnections = null ][, string|null $connectedAccountId = null ][, RequestOptions|null $options = null ]) : void

Disconnects the organization's account for the provider, including removing any stored access and refresh tokens. A member will need to reauthorize if the organization wants to reconnect. This does not revoke access on the provider side.

Parameters

$organizationId : string: An Organization identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. When omitted or false, only the compatibility connection is considered.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select the connection to delete.
$options : RequestOptions|null = null

Tags

deleteUserConnectedAccount()

Delete a connected account


    public
                    deleteUserConnectedAccount(string $userId, string $slug[, string|null $organizationId = null ][, bool|null $supportsMultipleConnections = null ][, string|null $connectedAccountId = null ][, RequestOptions|null $options = null ]) : void

Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. Access is not revoked on the provider side, except for the WorkOS OAuth provider, whose underlying AuthKit grant is revoked.

Parameters

$userId : string: A User identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$organizationId : string|null = null: An Organization identifier. Optional parameter if the connection is scoped to an organization.
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. When omitted or false, only the compatibility connection is considered.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select the connection to delete.
$options : RequestOptions|null = null

Tags

finishConnection()

Finish connection


    public
                    finishConnection(string $connectCode, string $codeVerifier[, string|null $state = null ][, RequestOptions|null $options = null ]) : DataIntegrationFinishConnectionResponse

Saves a connection that was started with code_challenge. After the user authorizes, WorkOS redirects them to return_to with a connect_code and state. Call this endpoint from your server with that connect_code and the code_verifier behind the challenge to save the connected account.

Parameters

$connectCode : string: The connect_code WorkOS added to return_to when the user finished authorizing. It can be used once and expires 90 seconds after the redirect.
$codeVerifier : string: The code verifier code_challenge was derived from: 43 to 128 characters from A-Z, a-z, 0-9, -, ., _ and ~. A wrong verifier uses up the connect_code, and the user has to connect again.
$state : string|null = null: The state WorkOS added to return_to alongside connect_code. Optional; it is only used to correlate the request in logs.
$options : RequestOptions|null = null

Tags

Return values

DataIntegrationFinishConnectionResponse

getAccessToken()

Get an access token for a connected account


    public
                    getAccessToken(string $provider, string $userId[, string|null $organizationId = null ][, string|null $connectedAccountId = null ][, PipesOwnership|null $connectionOwner = null ][, bool|null $supportsMultipleConnections = null ][, RequestOptions|null $options = null ]) : DataIntegrationAccessTokenResponse

Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.

Parameters

$provider : string: The identifier of the integration.
$userId : string: A User identifier. When connection_owner is organization, this is the user the credentials are vended on behalf of; they must be an active member of the organization.
$organizationId : string|null = null: An Organization identifier. Optional parameter to scope the connection to a specific organization. Required when connection_owner is organization.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select a specific connection when the user has several for this provider.
$connectionOwner : PipesOwnership|null = null: Which connection to vend from. user (the default) vends the user's own connection and requires user_id. organization vends the organization's shared connection and requires organization_id.
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. If no connected_account_id is supplied and several connections match, the request returns account_selection_required. When omitted or false, only the compatibility connection is considered.
$options : RequestOptions|null = null

Tags

Return values

DataIntegrationAccessTokenResponse

getDataIntegration()

Get a data integration


    public
                    getDataIntegration(string $slug[, RequestOptions|null $options = null ]) : DataIntegration

Retrieves the user-owned data integration by its slug.

Parameters

$slug : string: The slug identifier of the data integration.
$options : RequestOptions|null = null

Tags

Return values

DataIntegration

getOrganizationConnectedAccount()

Get an organization connected account


    public
                    getOrganizationConnectedAccount(string $organizationId, string $slug[, bool|null $supportsMultipleConnections = null ][, string|null $connectedAccountId = null ][, RequestOptions|null $options = null ]) : ConnectedAccount

Retrieves an organization's connected account for a specific provider.

Parameters

$organizationId : string: An Organization identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. When omitted or false, only the compatibility connection is considered.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select a specific connection when the organization has several for this provider.
$options : RequestOptions|null = null

Tags

Return values

ConnectedAccount

getUserConnectedAccount()

Get a connected account


    public
                    getUserConnectedAccount(string $userId, string $slug[, string|null $organizationId = null ][, bool|null $supportsMultipleConnections = null ][, string|null $connectedAccountId = null ][, RequestOptions|null $options = null ]) : ConnectedAccount

Retrieves a user's connected account for a specific provider.

Parameters

$userId : string: A User identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$organizationId : string|null = null: An Organization identifier. Optional parameter if the connection is scoped to an organization.
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. When omitted or false, only the compatibility connection is considered.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select a specific connection when the user has several for this provider.
$options : RequestOptions|null = null

Tags

Return values

ConnectedAccount

listDataIntegrationOrganization()

Get an organization-owned data integration


    public
                    listDataIntegrationOrganization(string $slug[, RequestOptions|null $options = null ]) : DataIntegration

Retrieves the organization-owned data integration for a provider by its slug. The /organization suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization.

Parameters

$slug : string: The slug identifier of the data integration.
$options : RequestOptions|null = null

Tags

Return values

DataIntegration

listDataIntegrations()

List data integrations


    public
                    listDataIntegrations([string|null $before = null ][, string|null $after = null ][, int|null $limit = null ][, PaginationOrder $order = PaginationOrder::Desc ][, PipesOwnership|null $ownership = null ][, RequestOptions|null $options = null ]) : PaginatedResponse<string|int, DataIntegration>

Lists the environment's data integrations configured with custom or organization credentials, including custom providers and API key integrations. Both user-owned and organization-owned roots are returned, each as its own row with an ownership; filter with ownership to return only one kind.

Parameters

$before : string|null = null: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with "obj_123", your subsequent call can include before="obj_123" to fetch a new batch of objects before "obj_123".
$after : string|null = null: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with "obj_123", your subsequent call can include after="obj_123" to fetch a new batch of objects after "obj_123".
$limit : int|null = null: Upper limit on the number of objects to return, between 1 and 100. Defaults to 10.
$order : PaginationOrder = PaginationOrder::Desc: Order the results by the creation time. Supported values are "asc" (ascending), "desc" (descending), and "normal" (descending with reversed cursor semantics where before fetches older records and after fetches newer records). Defaults to "desc".
$ownership : PipesOwnership|null = null: Only return Data Integrations with this ownership: user for the integrations users connect their own accounts to, or organization for the roots organizations connect to. Omit to return both.
$options : RequestOptions|null = null

Tags

Return values

PaginatedResponse<string|int, DataIntegration>

listOrganizationDataProviders()

List providers for an organization


    public
                    listOrganizationDataProviders(string $organizationId[, bool|null $supportsMultipleConnections = null ][, RequestOptions|null $options = null ]) : DataIntegrationsListResponse

Retrieves the organization-owned providers configured for your environment and the organization's connected account information for each. Providers owned by individual users are not included.

Parameters

$organizationId : string: An Organization identifier to list providers and connected accounts for.
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. When omitted or false, only the compatibility connection is considered.
$options : RequestOptions|null = null

Tags

Return values

DataIntegrationsListResponse

listUserDataProviders()

List providers for a user


    public
                    listUserDataProviders(string $userId[, string|null $organizationId = null ][, bool|null $supportsMultipleConnections = null ][, RequestOptions|null $options = null ]) : DataIntegrationsListResponse

Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's connected account information where applicable.

Parameters

$userId : string: A User identifier to list providers and connected accounts for.
$organizationId : string|null = null: An Organization identifier. Optional parameter to filter connections for a specific organization.
$supportsMultipleConnections : bool|null = null: Set to true to use the plural connection contract. When omitted or false, only the compatibility connection is considered.
$options : RequestOptions|null = null

Tags

Return values

DataIntegrationsListResponse

updateDataIntegration()

Update a data integration


    public
                    updateDataIntegration(string $slug[, string|null $description = null ][, bool|null $enabled = null ][, array<string|int, string>|null $scopes = null ][, DataIntegrationCredentialsInput|null $credentials = null ][, ApiKeyInstallation|null $apiKey = null ][, UpdateCustomProviderDefinition|null $customProvider = null ][, RequestOptions|null $options = null ]) : DataIntegration

Updates the description, enabled state, or custom credentials of the user-owned data integration. For custom providers, custom_provider updates the OAuth definition.

Parameters

$slug : string: The slug identifier of the data integration.
$description : string|null = null: An optional description of the Data Integration.
$enabled : bool|null = null: Whether the Data Integration is enabled.
$scopes : array<string|int, string>|null = null: The OAuth scopes to request for the Data Integration. Pass null to reset to the provider's configured scopes.
$credentials : DataIntegrationCredentialsInput|null = null: New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with api_key.
$apiKey : ApiKeyInstallation|null = null: An API key to install or rotate for a tenant on an api_key integration. Upserts the tenant installation identified by user_id (and optional organization_id).
$customProvider : UpdateCustomProviderDefinition|null = null: Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
$options : RequestOptions|null = null

Tags

Return values

DataIntegration

updateDataIntegrationApiKey()

Upsert an API key for a connected account


    public
                    updateDataIntegrationApiKey(string $slug, string $userId, string $secret[, string|null $organizationId = null ][, string|null $connectedAccountId = null ][, PipesOwnership|null $connectionOwner = null ][, RequestOptions|null $options = null ][, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $connectionIntent = null ]) : ConnectedAccount

Creates or updates an API-key-based installation for the specified integration, owned by the user or, when connection_owner is organization, shared by the organization. If an installation already exists, the stored API key is rotated to the new value. To create another connection, use POST.

Parameters

$slug : string: The identifier of the integration.
$userId : string: A User identifier.
$secret : string: The API key secret to store for this integration.
$organizationId : string|null = null: An Organization identifier. Optional parameter to scope the connection to a specific organization. Required when connection_owner is organization.
$connectedAccountId : string|null = null: The exact connected account to reauthorize. Required with connection_intent: reauthorize; it may also be sent on its own to reauthorize that connection.
$connectionOwner : PipesOwnership|null = null: Whose connection to create or rotate. user (the default) addresses the connection owned by user_id. organization addresses the connection shared by every member of organization_id; user_id then identifies the member performing the request and must be an active member of the organization.
$options : RequestOptions|null = null
$accountDisplayName : string|null = null: A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
$accountIdentifier : string|null = null: A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
$connectionIntent : string|null = null: Send reauthorize with connected_account_id to reauthorize one exact connection. Omit it to use the compatibility connection; creating another connection lives on the POST route.

Tags

Return values

ConnectedAccount

updateDataIntegrationClientCredentials()

Upsert client credentials for a connected account


    public
                    updateDataIntegrationClientCredentials(string $slug, string $userId, string $clientId, string $clientSecret[, string|null $organizationId = null ][, string|null $connectedAccountId = null ][, PipesOwnership|null $connectionOwner = null ][, array<string, string>|null $config = null ][, RequestOptions|null $options = null ][, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $connectionIntent = null ]) : ConnectedAccount

Creates or updates a client-credentials-based installation for the specified integration, owned by the user or, when connection_owner is organization, shared by the organization. If an installation already exists, the stored client credentials are rotated to the new values. To create another connection, use POST.

Parameters

$slug : string: The identifier of the integration.
$userId : string: A User identifier.
$clientId : string: The OAuth client ID to store for this integration.
$clientSecret : string: The OAuth client secret to store for this integration.
$organizationId : string|null = null: An Organization identifier. Optional parameter to scope the connection to a specific organization. Required when connection_owner is organization.
$connectedAccountId : string|null = null: The exact connected account to reauthorize. Required with connection_intent: reauthorize; it may also be sent on its own to reauthorize that connection.
$connectionOwner : PipesOwnership|null = null: Whose connection to create or rotate. user (the default) addresses the connection owned by user_id. organization addresses the connection shared by every member of organization_id; user_id then identifies the member performing the request and must be an active member of the organization.
$config : array<string, string>|null = null: Provider-specific configuration values collected for this installation, keyed by the provider's config field descriptors.
$options : RequestOptions|null = null
$accountDisplayName : string|null = null: A mutable, non-unique label. Omit to preserve an existing label; null clears it. Labels are never account identifiers.
$accountIdentifier : string|null = null: A developer-attested provider account identifier, never inferred from a label or credential. Omit to preserve an existing identifier; null clears it.
$connectionIntent : string|null = null: Send reauthorize with connected_account_id to reauthorize one exact connection. Omit it to use the compatibility connection; creating another connection lives on the POST route.

Tags

Return values

ConnectedAccount

updateDataIntegrationOrganization()

Update an organization-owned data integration


    public
                    updateDataIntegrationOrganization(string $slug[, string|null $description = null ][, bool|null $enabled = null ][, array<string|int, string>|null $scopes = null ][, DataIntegrationCredentialsInput|null $credentials = null ][, ApiKeyInstallation|null $apiKey = null ][, UpdateCustomProviderDefinition|null $customProvider = null ][, RequestOptions|null $options = null ]) : DataIntegration

Updates the description, enabled state, or custom credentials of the organization-owned data integration for a provider. For custom providers, custom_provider updates the OAuth definition, which is shared with the user-owned root. The /organization suffix selects the environment-level organization-owned root for the provider; it does not name a particular organization.

Parameters

$slug : string: The slug identifier of the data integration.
$description : string|null = null: An optional description of the Data Integration.
$enabled : bool|null = null: Whether the Data Integration is enabled.
$scopes : array<string|int, string>|null = null: The OAuth scopes to request for the Data Integration. Pass null to reset to the provider's configured scopes.
$credentials : DataIntegrationCredentialsInput|null = null: New OAuth credentials for the Data Integration. When provided, rotates the stored client secret. Mutually exclusive with api_key.
$apiKey : ApiKeyInstallation|null = null: An API key to install or rotate for a tenant on an api_key integration. Upserts the tenant installation identified by user_id (and optional organization_id).
$customProvider : UpdateCustomProviderDefinition|null = null: Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
$options : RequestOptions|null = null

Tags

Return values

DataIntegration

updateOrganizationConnectedAccount()

Update an organization connected account


    public
                    updateOrganizationConnectedAccount(string $organizationId, string $slug, string $userId[, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $accessToken = null ][, string|null $refreshToken = null ][, DateTimeImmutable|null $expiresAt = null ][, array<string|int, string>|null $scopes = null ][, PipeConnectedAccountState|null $state = null ][, bool|null $supportsMultipleConnections = null ][, string|null $connectedAccountId = null ][, string|null $connectionIntent = null ][, RequestOptions|null $options = null ][, array<string, string>|null $config = null ]) : ConnectedAccount

Updates an organization's connected account tokens, scopes, state, or provider configuration for a specific provider.

Parameters

$organizationId : string: An Organization identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$userId : string: The User identifier of the organization member on whose behalf the connected account is being imported or updated. The user must be an active member of the organization.
$accountDisplayName : string|null = null: A mutable, non-unique connection label; null clears it. Not an account identifier.
$accountIdentifier : string|null = null: A developer-attested account identifier; null clears it.
$accessToken : string|null = null: The OAuth access token for the connected account.
$refreshToken : string|null = null: The OAuth refresh token for the connected account.
$expiresAt : DateTimeImmutable|null = null: The ISO-8601 timestamp when the access token expires. Required when access_token is provided for tokens that expire.
$scopes : array<string|int, string>|null = null: The OAuth scopes granted for this connection.
$state : PipeConnectedAccountState|null = null: Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
$supportsMultipleConnections : bool|null = null: Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply connected_account_id to update an exact connection.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select the connection to update.
$connectionIntent : string|null = null: Set to reauthorize with connected_account_id to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior.
$options : RequestOptions|null = null
$config : array<string, string>|null = null: Installation-scoped provider configuration for this connection, such as Salesforce salesforce_host. Imports apply supplied values over installation-scoped integration pins and inherit other config from the credential source. Credential-bearing imports must satisfy required configuration even when config is omitted or }. On update, a supplied object replaces installation-scoped values; omitted config preserves the stored snapshot. Stored integration-scoped values remain bound to the OAuth client and cannot be overridden or replaced with current integration pins. Replacements must satisfy required configuration; } and empty-string values clear installation-scoped values only when the result is valid. Provider defaults count toward completeness but are resolved at read time, not stored. Only tokenless needs_reauthorization placeholders may remain incomplete; attaching their first tokens validates configuration even when config is omitted. Unrelated updates do not revalidate unchanged configuration. Clearing salesforce_host falls back to login.salesforce.com, which may not work for sandbox or My Domain-only connections.

Tags

Return values

ConnectedAccount

updateUserConnectedAccount()

Update a connected account


    public
                    updateUserConnectedAccount(string $userId, string $slug[, string|null $accountDisplayName = null ][, string|null $accountIdentifier = null ][, string|null $accessToken = null ][, string|null $refreshToken = null ][, DateTimeImmutable|null $expiresAt = null ][, array<string|int, string>|null $scopes = null ][, PipeConnectedAccountState|null $state = null ][, string|null $organizationId = null ][, bool|null $supportsMultipleConnections = null ][, string|null $connectedAccountId = null ][, string|null $connectionIntent = null ][, RequestOptions|null $options = null ][, array<string, string>|null $config = null ]) : ConnectedAccount

Updates a user's connected account tokens, scopes, state, or provider configuration for a specific provider.

Parameters

$userId : string: A User identifier.
$slug : string: The slug identifier of the provider (e.g., github, slack, notion).
$accountDisplayName : string|null = null: A mutable, non-unique connection label; null clears it. Not an account identifier.
$accountIdentifier : string|null = null: A developer-attested account identifier; null clears it.
$accessToken : string|null = null: The OAuth access token for the connected account.
$refreshToken : string|null = null: The OAuth refresh token for the connected account.
$expiresAt : DateTimeImmutable|null = null: The ISO-8601 timestamp when the access token expires. Required when access_token is provided for tokens that expire.
$scopes : array<string|int, string>|null = null: The OAuth scopes granted for this connection.
$state : PipeConnectedAccountState|null = null: Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
$organizationId : string|null = null: An Organization identifier. Optional parameter if the connection is scoped to an organization.
$supportsMultipleConnections : bool|null = null: Accepted for compatibility; does not change update targeting. Omit intent and selector to update the compatibility connection, or supply connected_account_id to update an exact connection.
$connectedAccountId : string|null = null: A connected account identifier. Use this to select the connection to update.
$connectionIntent : string|null = null: Set to reauthorize with connected_account_id to update one exact connection. The intent may be omitted when supplying an ID. Omit both for permanent compatibility behavior.
$options : RequestOptions|null = null
$config : array<string, string>|null = null: Installation-scoped provider configuration for this connection, such as Salesforce salesforce_host. Imports apply supplied values over installation-scoped integration pins and inherit other config from the credential source. Credential-bearing imports must satisfy required configuration even when config is omitted or }. On update, a supplied object replaces installation-scoped values; omitted config preserves the stored snapshot. Stored integration-scoped values remain bound to the OAuth client and cannot be overridden or replaced with current integration pins. Replacements must satisfy required configuration; } and empty-string values clear installation-scoped values only when the result is valid. Provider defaults count toward completeness but are resolved at read time, not stored. Only tokenless needs_reauthorization placeholders may remain incomplete; attaching their first tokens validates configuration even when config is omitted. Unrelated updates do not revalidate unchanged configuration. Clearing salesforce_host falls back to login.salesforce.com, which may not work for sandbox or My Domain-only connections.

Tags

Return values

ConnectedAccount

Pipes in package Application

Table of Contents

Properties

Methods

Properties

$client read-only

Methods

__construct()

Parameters

authorizeDataIntegration()

Parameters

Tags

Return values

createDataIntegration()

Parameters

Tags

Return values

createDataIntegrationApiKey()

Parameters

Tags

Return values

createDataIntegrationClientCredential()

Parameters

Tags

Return values

createDataIntegrationCredential()

Parameters

Tags

Return values

createOrganizationConnectedAccount()

Parameters

Tags

Return values

createUserConnectedAccount()

Parameters

Tags

Return values

deleteDataIntegration()

Parameters

Tags

deleteDataIntegrationOrganization()

Parameters

Tags

deleteOrganizationConnectedAccount()

Parameters

Tags

deleteUserConnectedAccount()

Parameters

Tags

finishConnection()

Parameters

Tags

Return values

getAccessToken()

Parameters

Tags

Return values

getDataIntegration()

Parameters

Tags

Return values

getOrganizationConnectedAccount()

Parameters

Tags

Return values

getUserConnectedAccount()

Parameters

Tags

Return values

listDataIntegrationOrganization()

Parameters

Tags

Return values

listDataIntegrations()

Parameters

Tags

Return values

listOrganizationDataProviders()

Parameters

Tags

Pipes
in package

Application