Connections Scripts API

openapi: 3.2.0
info:
  title: Connections Icu Scripts API
  version: 1.0.0
  description: 'Operations tagged Scripts across 2 of this provider''s published API definitions: connections-icu-studio-openapi-original.json, connections-icu-studio-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://studio.connectionsapi.com
tags:
- name: Scripts
paths:
  /v1/scripts:
    get:
      summary: 'Script Vault: list this company''s stored operator scripts (metadata + size +…'
      security:
      - aegisBearer: []
      - apiKey: []
      tags:
      - Scripts
      operationId: getV1Scripts
      x-operation-id-source: derived
    servers:
    - url: https://studio.connectionsapi.com
  /v1/scripts/{tool_name}:
    get:
      summary: 'Script Vault: fetch ONE stored script''s code + metadata (the pull half of…'
      security:
      - aegisBearer: []
      - apiKey: []
      parameters:
      - name: tool_name
        in: path
        required: true
        schema:
          type: string
      tags:
      - Scripts
      operationId: getV1ScriptsByToolName
      x-operation-id-source: derived
    put:
      summary: 'Script Vault: upsert a script in place - {description, code, name?…'
      security:
      - aegisBearer: []
      - apiKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              description: 'Script Vault upsert (code + description required). A body carrying ONLY destructive and/or shared_across_projects is a settings update of the stored script: its code, description and every other field are kept. The tool_name comes from the PATH, never the body.'
              properties:
                description:
                  type: string
                  description: Written for SEARCH - what it finds or answers, and when to reach for it. This text IS the index.
                code:
                  type: string
                  description: The script source, for a self-contained instrument.
                code_path:
                  type: string
                  description: Path to a self-contained file to store instead of inline code.
                delegate_path:
                  type: string
                  description: A workspace-anchored launcher for a TRACKED repo script - preferred over a copy that drifts.
                name:
                  type: string
                  description: Human-readable name; defaults to the tool_name.
                language:
                  type: string
                  description: javascript/node by default; 'bun' for Bun APIs or TypeScript imports.
                  enum:
                  - javascript
                  - node
                  - bun
                parameters:
                  type: object
                  description: Declared arguments, surfaced to callers.
                tags:
                  type: array
                  items:
                    type: string
                  description: Search tags.
                destructive:
                  type: boolean
                  description: Mark it if a run mutates anything.
                  x-setting:
                    id: studio.script_destructive
                    label: Script is destructive
                    synonyms:
                    - destructive script
                    - script mutates
                    - mark script destructive
                    scope: script
                    group: Script Vault
                    scopeParam: tool_name
                shared_across_projects:
                  type: boolean
                  description: 'true makes the script visible from every project you own; false keeps it in this one. Alias: shared.'
                  x-setting:
                    id: studio.script_shared_across_projects
                    label: Share script across projects
                    synonyms:
                    - share script
                    - script in every project
                    - cross project script
                    scope: script
                    group: Script Vault
                    scopeParam: tool_name
      parameters:
      - name: tool_name
        in: path
        required: true
        schema:
          type: string
      tags:
      - Scripts
      operationId: putV1ScriptsByToolName
      x-operation-id-source: derived
    delete:
      summary: 'Script Vault: delete a stored script (always allowed for your own company''s…'
      security:
      - aegisBearer: []
      - apiKey: []
      parameters:
      - name: tool_name
        in: path
        required: true
        schema:
          type: string
      tags:
      - Scripts
      operationId: deleteV1ScriptsByToolName
      x-operation-id-source: derived
    servers:
    - url: https://studio.connectionsapi.com
components:
  securitySchemes:
    aegisBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The AEGIS SSO access token (Cognito JWT from the shared sign-in) presented as a Bearer on every /v1 call.
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: cnx_live_* | cnx_pub_*
      description: 'A key minted in the console, sent as a bearer token. `cnx_live_` carries cross-plane data scopes AND (when granted) Studio management scopes (apps:*, keys:*, projects:*, webhooks:*) that authorize the console-management operations below. `cnx_pub_` is the publishable, browser-safe tier (Stripe''s pk_ model): mint-time capped to :read scopes, requires a non-empty allowed-origins allowlist, refused on any non-GET/HEAD route, and rate-limited - safe to embed in client-side code.'
    oauthUserToken:
      type: http
      scheme: bearer
      description: EITHER (a) a Sign-in-with-Connections USER access token issued by accounts.connectionsapi.com to a registered OAuth app - the app acts on behalf of its signed-in user, rows are keyed by the token's own sub + client_id; OR (b) an app-bound publishable key (cnx_pub_, minted with an appId) presented on X-Connections-Api-Key ALONGSIDE the signed-in user's own plain AEGIS bearer on Authorization - the server derives (app_id, sub) from the two verified credentials. The publishable key alone authorizes nothing; both credentials are required. This second form is for a developer who wants the locker without standing up a full OAuth client - mint one publishable key bound to a registered app instead.
x-refined-from:
- connections-icu-studio-openapi-original.json
- connections-icu-studio-openapi.yml