Say where this webhook's provider lives, and store its read-only token
PUT/api/v1/webhooks/:webhook_id/provider-connection
Where a reconcile read would dial for this webhook, and the read-only credential that
authenticates it (ADR-0052, #614). provider_base_url and provider_repo are a pair replaced
whole on every write; provider_base_url: "" clears both, and naming one without the other is
invalid_argument. The base URL must be https (loopback http excepted) and, when
SWITCHBOARD_PROVIDER_READ_ALLOWED_ORIGINS is set, exactly one of the listed origins — a prefix
never matches. provider_read_token is three-state: the key omitted keeps the stored token, ""
clears it, a value replaces it. A non-empty token requires SWITCHBOARD_SECRET_ENCRYPTION_KEY, is
encrypted at rest like a signing secret, and is never returned by any response. Agents read these
fields on list_webhooks and have no verb that writes them: whoever supplies the token decides
where it is sent. Nothing dials out yet — the reconcile pass is #616.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 503
Saved; what a reconcile read would use, with the token itself withheld.
The base URL is malformed, or the address names only one half of the pair.
Missing, expired, revoked, or non-operator bearer.
The base URL's origin is outside SWITCHBOARD_PROVIDER_READ_ALLOWED_ORIGINS.
No such webhook in the caller's reach.
A token was supplied but SWITCHBOARD_SECRET_ENCRYPTION_KEY is not configured.