> ## Documentation Index > Fetch the complete documentation index at: https://checkfu.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Apply a ConnectionVault > Compile one inline ConnectionVault document — a named grouping of Connections with explicit member access (principals or groups) — into ordinary `use_connection` PermissionAssignments, one per member × Connection (D213). The apply reconciles against the stored vault: it mints PermissionAssignments for new edges, re-mints any compiled PermissionAssignment that was deleted elsewhere, and revokes only PermissionAssignments the vault itself compiled for dropped edges. Because the apply revokes, it never adopts a pre-existing equivalent PermissionAssignment minted outside the vault — that conflicts instead, so a vault edit can never destroy an operator's independent row. At most 1024 member × Connection edges compile in one apply. `dry_run=true` returns the compile plan without materializing. The vault row grants nothing by itself; no runtime check consults it. Requires an Idempotency-Key; re-apply of the same name is a CAS'd upgrade of the derived aggregate. Checkfu support posture: alpha; hosted. Required evidence journey: connection-lifecycle. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. ## OpenAPI ````yaml /openapi.json post /v1/connection-vaults/apply openapi: 3.1.0 info: title: Checkfu API version: '2026-08-27' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-27); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnesses - name: harnessRuntime - name: computerProfiles - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: dreams - name: modelCredentials - name: modelRoutingProfiles - name: blueprintInstallations - name: toolSources - name: skills - name: skillSources - name: agentSources - name: skillProposals - name: instructionProposals - name: catalog - name: concepts - name: support - name: connections - name: connectionVaults - name: connectionAssignments - name: connectedRuntimes - name: projects - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: usage - name: models - name: outcomes - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: sessionHandoffs - name: sessionCapsules - name: sessionTrajectories - name: webhookEndpoints - name: integrationGateway - name: agentDeployments - name: workEnvironments - name: computers - name: computerScreens - name: computerBrowserObservations - name: computerBrowserActions - name: environments - name: vaults - name: apiMcp - name: a2a paths: /v1/connection-vaults/apply: post: tags: - connectionVaults summary: Apply a ConnectionVault description: >- Compile one inline ConnectionVault document — a named grouping of Connections with explicit member access (principals or groups) — into ordinary `use_connection` PermissionAssignments, one per member × Connection (D213). The apply reconciles against the stored vault: it mints PermissionAssignments for new edges, re-mints any compiled PermissionAssignment that was deleted elsewhere, and revokes only PermissionAssignments the vault itself compiled for dropped edges. Because the apply revokes, it never adopts a pre-existing equivalent PermissionAssignment minted outside the vault — that conflicts instead, so a vault edit can never destroy an operator's independent row. At most 1024 member × Connection edges compile in one apply. `dry_run=true` returns the compile plan without materializing. The vault row grants nothing by itself; no runtime check consults it. Requires an Idempotency-Key; re-apply of the same name is a CAS'd upgrade of the derived aggregate. Checkfu support posture: alpha; hosted. Required evidence journey: connection-lifecycle. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. operationId: connectionVaults.applyConnectionVault parameters: - name: checkfu-version in: header schema: type: string enum: - '2026-08-27' required: true - name: idempotency-key in: header schema: type: string allOf: - maxLength: 255 - minLength: 1 required: true - name: dry_run in: query schema: type: string enum: - 'true' - 'false' required: false requestBody: content: application/json: schema: $ref: >- #/components/schemas/ConnectionVaultCompiledPermissionAssignmentCeiling required: true responses: '200': description: Success content: application/json: schema: anyOf: - type: object properties: mode: type: string enum: - plan plan: type: object properties: name: type: string allOf: - minLength: 1 - maxLength: 255 connection_count: type: integer allOf: - minimum: 0 member_count: type: integer allOf: - minimum: 0 use_connection_permission_assignments: type: integer allOf: - minimum: 0 required: - name - connection_count - member_count - use_connection_permission_assignments additionalProperties: false required: - mode - plan additionalProperties: false - type: object properties: mode: type: string enum: - receipt receipt: type: object properties: vault_name: type: string allOf: - minLength: 1 - maxLength: 255 pack_digest: type: string allOf: - minLength: 1 prior_version: type: integer allOf: - exclusiveMinimum: 0 access: type: array items: $ref: '#/components/schemas/Objects_93' revoked_permission_assignment_ids: type: array items: $ref: '#/components/schemas/PermissionAssignmentId' compiled_at: type: string requested_by: $ref: '#/components/schemas/Union_134' required: - vault_name - pack_digest - access - revoked_permission_assignment_ids - compiled_at - requested_by additionalProperties: false required: - mode - receipt additionalProperties: false headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: $ref: '#/components/schemas/ValidationMalformedError' '401': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object required: - error properties: error: type: object properties: type: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '404': description: >- The requested resource does not exist in the resolved deployment boundary. content: application/json: schema: $ref: '#/components/schemas/ValidationNotFoundError' '409': description: >- The request conflicts with the resource's current state. | An idempotent mutation conflicts with a completed or in-progress request for the same key. content: application/json: schema: anyOf: - $ref: '#/components/schemas/ValidationConflictError' - $ref: '#/components/schemas/IdempotencyConflictError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' security: - bearerAuth: [] components: schemas: ConnectionVaultCompiledPermissionAssignmentCeiling: type: object properties: schema_version: type: number enum: - 1 name: type: string allOf: - minLength: 1 - maxLength: 255 description: anyOf: - type: string allOf: - minLength: 1 - maxLength: 2048 - type: 'null' connection_ids: $ref: '#/components/schemas/ConnectionVaultConnectionIds' members: $ref: '#/components/schemas/ConnectionVaultMembers' required: - schema_version - name - description - connection_ids - members additionalProperties: false Objects_93: type: object properties: member: $ref: '#/components/schemas/Union_175' connection_id: $ref: '#/components/schemas/ConnectionId' permission_assignment_id: $ref: '#/components/schemas/PermissionAssignmentId' required: - member - connection_id - permission_assignment_id additionalProperties: false PermissionAssignmentId: type: string allOf: - pattern: ^perm_[0-9a-f]{32}$ Union_134: anyOf: - type: object properties: kind: type: string enum: - system required: - kind additionalProperties: false - type: object properties: kind: type: string enum: - api_key id: $ref: '#/components/schemas/ApiKeyId' required: - kind - id additionalProperties: false - type: object properties: kind: type: string enum: - principal id: $ref: '#/components/schemas/PrincipalId' authenticated_by: $ref: '#/components/schemas/ApiKeyId' required: - kind - id additionalProperties: false - type: object properties: kind: type: string enum: - console_user id: type: string allOf: - minLength: 1 authenticated_by: $ref: '#/components/schemas/ApiKeyId' required: - kind - id additionalProperties: false - type: object properties: kind: type: string enum: - operator id: type: string allOf: - minLength: 1 required: - kind - id additionalProperties: false WorkspaceId: type: string allOf: - pattern: ^wrkspc_[0-9a-f]{32}$ ValidationMalformedError: type: object properties: error: type: object properties: type: type: string enum: - validation.malformed message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-malformed description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The request could not be decoded or violated a declared input constraint. PolicyDeniedError: type: object properties: error: type: object properties: type: type: string enum: - policy.denied message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Deployment governance or retention policy denied the request. ValidationNotFoundError: type: object properties: error: type: object properties: type: type: string enum: - validation.not_found message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-not-found description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The requested resource does not exist in the resolved deployment boundary. ValidationConflictError: type: object properties: error: type: object properties: type: type: string enum: - validation.conflict message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-conflict description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: The request conflicts with the resource's current state. IdempotencyConflictError: anyOf: - $ref: '#/components/schemas/ValidationIdempotencyConflictError' - $ref: '#/components/schemas/ValidationIdempotencyInProgressError' description: >- An idempotent mutation conflicts with a completed or in-progress request for the same key. RuntimeInternalError: type: object properties: error: type: object properties: type: type: string enum: - runtime.internal message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. ConnectionVaultConnectionIds: type: array items: $ref: '#/components/schemas/ConnectionId' allOf: - maxItems: 256 ConnectionVaultMembers: type: array items: $ref: '#/components/schemas/Union_175' allOf: - maxItems: 256 Union_175: anyOf: - type: object properties: kind: type: string enum: - principal principal: $ref: '#/components/schemas/PrincipalId' required: - kind - principal additionalProperties: false - type: object properties: kind: type: string enum: - group group: $ref: '#/components/schemas/PrincipalGroupId' required: - kind - group additionalProperties: false ConnectionId: type: string allOf: - pattern: ^conn_[0-9a-f]{32}$ ApiKeyId: type: string allOf: - pattern: ^akey_[0-9a-f]{32}$ PrincipalId: type: string allOf: - pattern: ^prin_[0-9a-f]{32}$ ValidationIdempotencyConflictError: type: object properties: error: type: object properties: type: type: string enum: - validation.idempotency_conflict message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#validation-idempotency-conflict description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: The Idempotency-Key is already bound to a different request. ValidationIdempotencyInProgressError: type: object properties: error: type: object properties: type: type: string enum: - validation.idempotency_in_progress message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#validation-idempotency-in-progress description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An identical idempotent request is still in progress and may be retried later. PrincipalGroupId: type: string allOf: - pattern: ^pgrp_[0-9a-f]{32}$ securitySchemes: bearerAuth: type: http scheme: bearer ````