---
title: "Get an operation binding"
method: GET
path: "/operation/bindings/{bindingId}"
tags: ["OperationBindings"]
---

# Get an operation binding

`GET /operation/bindings/{bindingId}`

Reads one operation binding, including connector-local operation name, protocol, request
and response descriptors, transformation reference, delivery settings, and egress policy.

## Path parameters

- `bindingId` string, uuid, required — Stable identifier for a connector operation binding.

## Response `200`

Operation binding.

- OperationBinding — Request to bind a connector resource to a logical operation. The binding connects connector instance, attached resource, logical operation, transfer mode, protocol, operation name, optional transformation, and destination delivery policy.
  - `connectorInstanceId` string, uuid, required — Stable platform identifier for a configured connector instance.
  - `connectorResourceId` string, uuid, required — Stable identifier for a resource attached to a connector instance.
  - `operationKind` 'READ' | 'WRITE' | 'UPDATE' | 'DELETE' | 'UPSERT' | 'QUERY' | 'SEARCH' | 'IMPORT' | 'EXPORT' | 'INVOKE' | 'DISCOVER' | 'VALIDATE', required — Reusable operation taxonomy shared by connectors, inventory, policy, and workflows. The operation kind is logical; connector-local details live in operationName.
  - `transferMode` 'SINGLE' | 'BATCH' | 'STREAM' — Transfer semantics for an operation binding. Streaming and batching are execution modes of a logical operation, not operation kinds.
  - `direction` 'INBOUND' | 'OUTBOUND' | 'BIDIRECTIONAL' — Direction of data movement represented by an operation binding.
  - `accessProtocol` 'HTTP' | 'HTTPS' | 'JDBC' | 'ODBC' | 'SFTP' | 'FILE' | 'S3' | 'AZURE_BLOB' | 'GCS' | 'KAFKA' | 'AMQP' | 'MQTT' | 'OIDC' | 'DIDCOMM' | 'VAULT' | 'INTERNAL' | 'CUSTOM' — Transport or access protocol. This is intentionally separate from ResourceKind and RepresentationKind: for example, CSV data can be read over HTTPS, S3, SFTP, FILE, or VAULT.
  - `operationName` string — Connector-local operation name, for example OpenAPI operationId, SQL statement name, file action, or vault operation.
  - `requestDescriptorId` string, uuid — Stable identifier for a described external or internal resource shape.
  - `responseDescriptorId` string, uuid — Stable identifier for a described external or internal resource shape.
  - `transformationId` string, uuid — Stable identifier for a transformation definition.
  - `delivery` DestinationDelivery — Delivery requirements for destination bindings, including acknowledgement and retry behavior.
    - `deliveryMode` 'SYNC' | 'ASYNC' | 'BATCH' | 'STREAMING' — Delivery timing and batching behavior expected by a destination operation binding.
    - `ackMode` 'NONE' | 'ACCEPTED' | 'COMMITTED' | 'VERIFIED' — Acknowledgement level a destination must provide before the platform treats delivery as complete.
    - `idempotencyKeyPath` string — Path in the outgoing payload used as idempotency key.
    - `retryPolicy` RetryPolicy — Retry and dead-letter behavior for connector operations.
      - `maxAttempts` integer — Maximum number of attempts, including the initial attempt. Zero means no retry after the initial failure.
      - `backoffMillis` integer — Delay between attempts in milliseconds. Runtime implementations may apply jitter.
      - `deadLetterEnabled` boolean — Whether failed items should be written to the route dead-letter store when retries are exhausted.
  - `egressPolicy` EgressPolicy — Network and payload egress limits for connector operations. This is the connector policy hook for SSRF protection, tenant boundary checks, and later semantic/compliance checks. Runtime adapters should resolve names before connecting and pass the resolved address to the evaluator when DNS pinning is enabled.
    - `allowedHosts` string[] — Hostnames or wildcard host patterns the connector is allowed to contact. Use `*.example.com` for one-or-more subdomains.
    - `blockedHosts` string[] — Hostnames or wildcard host patterns that are always denied, even when they also match an allowed host pattern.
    - `allowedCidrs` string[] — IPv4 CIDR ranges the connector may contact when the target or resolved address is an IP address.
    - `allowedProtocols` AccessProtocol[] — Access protocols allowed by this connector or operation.
    - `allowedPorts` integer[] — Network ports allowed by this connector or operation. Empty means protocol defaults are allowed unless another policy blocks the target.
    - `blockPrivateNetworks` boolean — Whether private, loopback, link-local, local, multicast, and cloud metadata targets are denied by default.
    - `pinResolvedAddress` boolean — Whether runtime adapters should connect to the already-validated resolved address to reduce DNS rebinding risk.
    - `maxPayloadBytes` integer — Maximum allowed request or response payload size in bytes.
    - `requiresTenantBoundary` boolean — Whether route execution must enforce tenant boundary checks before egress.
    - `metadata` StringMap — Small string-only metadata map for labels, ownership, routing hints, and implementation-specific annotations. Use first-class fields for contractually significant data.
  - `metadata` StringMap — Small string-only metadata map for labels, ownership, routing hints, and implementation-specific annotations. Use first-class fields for contractually significant data.
  - `bindingId` string, uuid, required — Stable identifier for a connector operation binding.
  - `createdAt` string, date-time, required — Creation timestamp.
  - `updatedAt` string, date-time, required — Last update timestamp.

## Other responses

- `401` — Authentication is required.
- `404` — The requested resource was not found.

---

[API](https://skmtc.net/sphereon-opensource/apis/connector-integration-profile-api.md) · [All operations](https://skmtc.net/sphereon-opensource/apis/connector-integration-profile-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sphereon-opensource/connector-integration-profile-api/versions/60cb8c70871b/schema)