> ## Documentation Index
> Fetch the complete documentation index at: https://evalgate.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections

> Review connected accounts and the resources your work may use.

Connections brings gateway accounts and direct model credentials into one
workspace view. Select an account to review its access checks, model resources,
routing and recorded activity. Workspace administrators manage credentials;
members use the resources their work is already permitted to access.

A saved credential has not necessarily passed an access check. An old successful
check is shown as history, and unavailable inventory remains unavailable rather
than an empty success. Model pricing and evidence status remain separate facts.

The catalog opens guided setup for installed connector implementations. A catalog
entry does not establish live compatibility. Native sources require a saved
account, an actual discovery result and a reviewed resource grant before use.
Databricks guided setup covers model serving. Slack setup covers notifications.
Deployment-local execution requires an operator-installed environment binding
for the exact workspace, connector and account. Entering a private address or
enrolling a remote runner does not establish execution.

Replacing a direct credential updates EvalGate's stored key. Revoke the old key
with the provider separately. Removing EvalGate access does not delete an
upstream account, index, collection or model.

This surface is a source candidate until its deployment is verified. Native
resource grants and bounded connector operations are implemented in this
candidate; account authorization and deployment acceptance remain prerequisites.
One-time budget exceptions are not enabled. Existing runtime policy,
reservations and evidence services continue to govern model calls.

Automation uses the same read contracts:

```bash theme={null}
evalgate api listConnections --query limit=25 --json
evalgate api getConnectionCatalog --json
```

The TypeScript and Python OpenAPI clients expose `listConnections` and
`getConnectionCatalog`. MCP clients use `connections_list` and
`connections_catalog`. None of these reads returns a secret or grants permission
to read content or invoke a model.

## Native source setup

Open **Connections → Add a connection**, select a connector and enter its exact
account scope. Save or reuse its credential, then save the account setup. On the
account page, discover resources, select the ones to permit and review the grant.
Child resources require their own discovery and review. Discovery metadata alone
does not authorize all documents, tenants, namespaces or models in an account.
Older configuration-only drafts remain visible. If they lack the current
execution fields, create a new reviewed setup with those fields; repairing a
credential reference does not edit the account's configuration.

Configured resources are labeled separately from resources observed through the
provider. Empty, partial and unavailable responses remain distinct. Reads and
searches return bounded previews; an incomplete result does not establish that
the entire source has been checked. Response text is returned to the current
request; operation receipts retain metadata and hashes rather than document
bodies or query text.

| Connector | Supported native operations | Required boundary |
| - | - | - |
| Kong | Discover enabled AI Proxy plugins/models; invoke chat | Exact management scope; independent runtime consumer credential |
| Portkey | Discover workspace providers and their models; invoke chat | Observed workspace provider route and integration slug; independent runtime key |
| Cloudflare | Discover gateway; invoke an explicit chat model | Exact account/gateway/model; independent account AI token |
| Vertex AI | Discover endpoints; invoke an explicit Gemini chat model | Exact project/region; regional OpenAI-compatible Gemini runtime |
| Pinecone | Discover indexes/namespaces; read vectors; vector search | Separately approved index host and namespace; caller-supplied vector |
| Qdrant | Discover collections; scroll/read; vector search | Exact collection and optional named vector |
| Weaviate | Discover collections/tenants; read; text/vector search | Observed scalar schema and separately reviewed tenant |
| Milvus | Discover collections/partitions; read; vector search | Exact database, native schema and partition |
| Azure Search | Discover indexes; read; text/vector search | Native document-key field and reviewed index |
| OpenSearch / Elasticsearch | Discover an exact physical index; read; text search | No wildcard or alias expansion; no arbitrary query DSL |
| Bedrock Knowledge Bases | Discover; vector-KB Retrieve | No generation or original-file downloads; managed/Kendra/SQL variants unqualified |
| Vertex Search | Discover data stores/documents; read metadata; search | Exact project/location; content URLs never grant download permission |
| SharePoint | Discover sites/libraries/items; read/search text | Global Graph; exact site IDs and approved SharePoint download origin |
| Google Drive | Discover folder items; read/search text and supported exports | Exact folder; binary files refused; Sheets CSV is first-sheet only |
| S3 | Discover prefix/objects; read text; key-prefix search | Regional general-purpose bucket and literal approved prefix |
| Snowflake | Discover tables/views; read/search bounded previews | Exact database/schema/warehouse/role; fixed read-only SQL API statements |
| BigQuery | Discover dataset/tables; read tabledata; bounded row search | Exact location/project/dataset; views require separate budgeted query jobs |
| PostgreSQL | Discover tables/views; read/search bounded previews | Installed deployment-local read-only credential, exact database/schema and TLS addresses |
| Confluence | Discover space/pages; read/search reviewed content | OAuth mapping to the exact site and numeric space ID |
| Notion | Discover configured pages/data sources; read/search pages | API 2026-03-11; bounded recursion; unsupported blocks remain incomplete |
| A2A agent | Discover card; send one text request | Exact A2A 1.0 JSON-RPC endpoint/card; whole-agent grant |
| Glean | Configured data-source discovery; native search/document read | Exact enterprise backend and data source; upstream access checks remain authoritative |

PDF, Office, images and other binary ingestion are not silently treated as text.
Use EvalGate's supported document-ingestion path for those formats. S3 directory
buckets/access points/Outposts, sovereign SharePoint clouds and remote private
worker dispatch require additional native qualification. PostgreSQL pgvector
similarity and arbitrary database SQL are not enabled here. PostgreSQL previews
represent non-safe-integer numeric values as strings to preserve their exact
source lexemes.

PostgreSQL operations run read only with a ten-second statement timeout.
Cancelling a request closes local connections; if the upstream server refuses
cancellation, the statement timeout remains the server-work bound.

## Credentials and runtime access

Credentials are stored by the existing canonical credential owner, with the
deployment's configured encryption and erasure-ledger requirements. Secrets do
not belong in account fields or URLs. Source access uses the provider's own ACLs
on every operation. Paused/revoked roots, rotated credentials and changed resource
selections require a fresh review. Expired user OAuth access tokens must be
replaced; automatic rotating-refresh-token persistence is not implemented.

| Authentication | Credential value |
| - | - |
| Bearer/API token | Raw token, or JSON containing `accessToken`/`apiKey`/`token` and optional `expiresAt` |
| Basic authentication | JSON containing `username` and `password` |
| AWS SigV4 | JSON containing `accessKeyId`, `secretAccessKey`, optional `sessionToken` and `expiresAt` |
| Google service account | Service-account JSON with its private key; token exchange uses Google's fixed OAuth endpoint |
| SharePoint app identity | JSON containing `tenantId`, `clientId`, `clientSecret`; token exchange targets that tenant's Graph scope |
| Snowflake | OAuth access token with read-only warehouse/role permissions |

Kong, Portkey, Cloudflare and Vertex model discovery and model traffic use
independent credential references. Register a runtime gateway with the exact
allowed model IDs, then bind it to the account with **Model or tool execution**
purpose. Management tokens are never reused as an implicit runtime fallback.
Cloudflare runtime credentials use JSON `{"apiKey":"…","gatewayId":"…"}`
with the exact account AI v1 base URL. Vertex runtime uses a current OAuth access
token and its exact regional `endpoints/openapi` base. Calls remain subject to
the canonical model policy, pricing, reservations and evidence requirements.
Operators must also configure the existing reviewed gateway upstream/provider
bindings and physical request contracts, including verified liability and a
finite daily budget. Missing pricing or transport review blocks a call; source
discovery does not create a budget exception. See the model-provider deployment
guide for those canonical controls.

An invocation whose response is lost has an uncertain outcome. Use the read-only
receipt lookup with the same operation identity; do not create a new identity as
an automatic retry. Credential saves also need inventory inspection after a lost
response because their current save contract cannot deduplicate that write.

## Shared native operations

The web flow calls these same authenticated contracts used by the generated
TypeScript/Python OpenAPI clients and `evalgate api`:

| Contract | Purpose |
| - | - |
| `GET /api/connections/graph/{id}/runtime` | Current authority, supported operations, resource grants and review epochs |
| `POST /api/connections/graph/{id}/discover` | Bounded native resource page and a time-limited snapshot |
| `POST /api/connections/graph/{id}/grants` | Review/add/remove only resources from an authorized discovery snapshot |
| `POST /api/connections/graph/{id}/execute` | Read/search/invoke using an exact current grant |
| `GET /api/connections/graph/{id}/operations/{operationId}` | Read an existing receipt by the initiating client's idempotency key; never dispatch work |
| `GET /api/connections/runtime/environments` | Nonsecret installed deployment references for the current workspace |

Mutations require a UUID `idempotencyKey`, `expectedRevision`,
`expectedAuthorityEpoch` and `expectedSelectionEpoch` from the current runtime
review. Use a snapshot's `snapshotId` plus its actual `nativeIds` to grant access.
Use `parentGrantId` to discover children and `grantId` to execute. Continuations
are opaque receipt IDs bound to the same account, principal, operation, query,
selection and authority; never pass a raw provider cursor. Expired or changed
reviews return a conflict and require fresh discovery. Content is not replayed
from receipts. Read/search/invoke receipt lookup recovers operation identity,
state and timestamps; provider task details and content are not replayed. An A2A
task state is the observation returned with the original send. EvalGate does not
poll or continue that task; inspect it with the upstream provider.

Current resource review is bounded to1000 grants. Granting a page advances the
selection epoch and clears its old continuation; restart discovery to review
another page. Shared multi-page approval and a searchable grant inventory are
not enabled.

Discover the exact generated operation names with `evalgate api --list-operations --json` or
the OpenAPI operation inventory. These source operations do not change the
released public MCP management boundary or publish a new SDK package.

## Deployment-local sources

An operator can install `EVALGATE_CONNECTOR_ENVIRONMENT_BINDINGS` as a JSON array
in the self-hosted server environment. Each binding contains an `id` UUID,
positive `version`, `organizationId`, `driverId`, exact `accountScope`,
`environment` (`dev`, `staging` or `prod`), `secret`, and an `addresses` map from
exact service origins to approved IP addresses. The setup UI receives only the
nonsecret `environment-secret:UUID:version` reference and scope metadata.
The address registry must include every service origin that the selected
protocol uses, including fixed OAuth and approved download origins. An unlisted
origin is refused even if its DNS addresses are public.

For PostgreSQL, use a `postgresql://USER:PASSWORD@HOST:PORT/DATABASE` secret with
no query/hash and a read-only upstream role. The addresses entry uses the same
`postgresql://HOST:PORT` origin. DNS answers must belong to the approved address
set; TLS still verifies the original host. Bindings cannot substitute a shared
application database credential or another workspace/account's authority.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.