---
title: "Create"
method: POST
path: "/v3/integrations"
tags: ["integrations-v3"]
---

# Create

`POST /v3/integrations`

Create a new named integration instance and start a health check.

Credentials are encrypted and stored in AWS Secrets Manager. Only
metadata (name, type, id, timestamps) is stored in the database.

After the instance is created, a health check workflow runs in the
background against the supplied credentials. The workflow updates
``last_health_check`` asynchronously.

**Permissions**: org admin (own org) or platform admin (any org).
``organization_id`` defaults to the caller's own org; platform admins
may supply a different org to create integrations on its behalf.

Returns HTTP 201 with the created instance metadata.

## Query parameters

- `organization_id` string, nullable

## Request body

- CreateIntegrationV3Request — Request body for creating a new integration instance. The ``integration`` field is a discriminated union over all supported integration types (Datadog, Elasticsearch, PagerDuty, …). Set the ``type`` field inside ``integration`` to select the concrete schema. Example:: { "name": "datadog-prod", "integration": { "type": "datadog", "api_key": "abc123", "app_key": "xyz789", "base_api_url": "https://api.datadoghq.com" } }
  - `name` string, required — Human-readable display name for this integration instance. Must be unique within the organization for a given type. Examples: 'datadog-prod', 'opensearch-us-east', 'github-main-org'.
  - `description` string, nullable — Optional description of this integration instance. This description is surfaced directly to Traversal's AI during incident investigations, so include context that helps the AI understand when and how to use this integration — such as which environment it covers, which services or teams own it, and any relevant scope or access limitations. Examples: 'Primary account for US-East production — covers all API and worker services owned by the platform team', 'Read-only OpenSearch cluster for production log analysis — indexes rotate daily, retain 30 days'.
  - `integration` union, required — The integration configuration. Include a ``type`` discriminator field (e.g. ``"type": "metric_store"``) to select the correct schema. Credential fields (API keys, tokens) are stored encrypted and never returned in plaintext after creation.
    - AnthropicIntegrationConfig — Anthropic Claude API integration for LLM capabilities. Customer provides API key and optional configuration for proxies. Attributes: type: Integration type discriminator for union resolution api_key: Anthropic API key (required) base_url: Base URL for API proxies (optional, defaults to Anthropic's API)
      - `type` 'anthropic'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — Anthropic API key
      - `base_url` string, uri, nullable
    - OpenAIIntegrationConfig — OpenAI API integration for GPT models and embeddings. Customer provides API key and optional configuration for organization and proxies. Attributes: type: Integration type discriminator for union resolution api_key: OpenAI API key (required) organization_id: OpenAI organization ID (optional) base_url: Base URL for API proxies (optional, defaults to OpenAI's API)
      - `type` 'openai'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — OpenAI API key
      - `organization_id` string, nullable — OpenAI organization ID
      - `base_url` string, uri, nullable
    - GradientAIIntegrationConfig — DigitalOcean Gradient AI integration for LLM capabilities. Attributes: type: Integration type discriminator for union resolution api_key: Gradient AI API key (required)
      - `type` 'gradient_ai'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — Gradient AI API key
    - DatadogIntegrationConfig — Datadog monitoring platform for metrics, logs, traces, and alerts. Customer provides API key, Application key, and API URL selection. Attributes: type: Integration type discriminator for union resolution api_key: Datadog API key (required) app_key: Datadog Application key (required) api_url: Datadog API URL (optional, e.g., https://api.datadoghq.com, https://api.datadoghq.eu)
      - `type` 'datadog'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required
      - `app_key` string, password, required
      - `api_url` string, required
    - CloudWatchIntegrationConfig — Customer AWS role Traversal assumes to read CloudWatch metrics and logs. Shares the cross-account IAM role credential plane with the AWS CLI integration (``aws_cli``), but is a distinct telemetry integration: it exposes CloudWatch Logs and Metrics through dedicated SDK-backed tools rather than the terminal AWS CLI. Unlike ``aws_cli`` it carries a list of ``regions`` to query.
      - `type` 'cloudwatch'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `account_id` string, required — 12-digit AWS account ID, derived from role_arn; used as the identity for dedup.
      - `role_arn` string, required — Customer-owned IAM role ARN Traversal assumes to read CloudWatch data.
      - `regions` string[], required — AWS regions to query CloudWatch metrics and logs in.
    - ElasticsearchIntegrationConfig — Elasticsearch search and analytics engine for log aggregation. Customer provides connection details (hosts or cloud ID) and authentication credentials (basic auth, API key with ID, or API key only). Attributes: type: Integration type discriminator for union resolution connection: Connection configuration (hosts or cloud ID) auth: Authentication configuration (basic auth or API key variants)
      - `type` 'elasticsearch'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `connection` union, required
        - ElasticsearchHostsConnection — Connection via explicit host list. Attributes: connection_type: Discriminator for union type hosts: One or more Elasticsearch hosts
          - `connection_type` 'hosts'
          - `hosts` string[] — One or more Elasticsearch hosts
        - ElasticsearchCloudConnection — Connection via Elastic Cloud deployment ID. Attributes: connection_type: Discriminator for union type cloud_id: Elastic Cloud deployment ID
          - `connection_type` 'cloud_id'
          - `cloud_id` string, password, required — Elastic Cloud deployment ID
      - `auth` union, required
        - ElasticsearchBasicAuth — HTTP Basic authentication credentials. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required — Username for basic auth
          - `password` string, password, required — Password for basic auth
        - ElasticsearchApiKeyWithId — API key authentication with ID and key pair. Attributes: auth_type: Discriminator for union type key_id: API key identifier (required) key: API key secret (required)
          - `auth_type` 'api_key_with_id'
          - `key_id` string, required — API key identifier
          - `key` string, password, required — API key secret
        - ElasticsearchApiKey — API key authentication (single key string). Attributes: auth_type: Discriminator for union type api_key: API key (required)
          - `auth_type` 'api_key'
          - `api_key` string, password, required — API key
      - `index_discovery_patterns` string[] — Index patterns used to scope dataset-enumeration requests (_cat/indices/<pattern>, _resolve/index/<pattern>) — e.g. ['logs-*']. Required for least-privilege credentials and path-allowlisted or federated proxies that reject unscoped enumeration. Empty enumerates unscoped ('*').
    - EMIMIntegrationConfig — Amex EMIM (Emergency Incident Management) API integration. EMIM provides access to bridge details, postmortems, and incident data for Amex emergency incidents. Attributes: type: Integration type discriminator for union resolution api_key: EMIM API key for MAC signature authentication api_secret: EMIM API secret for MAC signature authentication api_host: EMIM API host URL (e.g., "emim.example.com")
      - `type` 'emim'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — EMIM API key for authentication
      - `api_secret` string, password, required — EMIM API secret for MAC signature
      - `api_host` string, uri, required — EMIM API host URL
    - PrometheusIntegrationConfig — Prometheus time-series database for metrics collection. Customer provides server URL and optional authentication (basic auth or bearer token). Attributes: type: Integration type discriminator for union resolution url: Prometheus server URL (required) auth: Optional authentication configuration (basic auth or bearer token) enable_ssl: Whether to enable SSL for the connection
      - `type` 'prometheus'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Prometheus server URL
      - `auth` union, required
        - PrometheusBasicAuth — HTTP Basic authentication credentials for Prometheus. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required — Username for basic auth
          - `password` string, password, required — Password for basic auth
        - PrometheusBearerToken — Bearer token authentication for Prometheus. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token for cloud Prometheus authentication
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required — Bearer token for authentication
      - `enable_ssl` boolean — Enables SSL for the Prometheus server. See https://www.python-httpx.org/advanced/ssl/ for more details.
      - `multi_url_legacy` string[], nullable — [Deprecated] Legacy field to represent multiple prometheus endpoints that share the same settings.
    - VictoriaMetricsIntegrationConfigInput — Victoria Metrics time-series database for metrics storage and querying. Cluster URLs and a single shared auth are carried in ``digital_ocean_vm_integration``. IMPORTANT REMARK: - The way this whole class is structured is a massive hack. The real problem is that we currently do not support multiple integrations of the same type for a particular customer. In other words, we cannot have multiple Victoria Metrics integrations for a particular customer. - This is why cluster URLs and authentication live in the ``digital_ocean_vm_integration`` wrapper. Ideally, we would have a list of VictoriaMetricsIntegration objects with their own authentication configurations. Attributes: type: Integration type discriminator for union resolution digital_ocean_vm_integration: Configuration for connecting to multiple Victoria Metrics clusters with a single authentication configuration
      - `type` 'victoria_metrics'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `digital_ocean_vm_integration` MultiClusterSingleAuth — Defines a configuration for connecting to multiple Victoria Metrics clusters with a single authentication configuration.
        - `urls` string[], required — List of Victoria Metrics cluster URLs
        - `auth` union — Authentication configuration for the VM connection
          - VictoriaMetricsBasicAuth — HTTP Basic authentication credentials for Victoria Metrics. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
            - `auth_type` 'basic_auth'
            - `username` string, required — Username for basic auth
            - `password` string, password, required — Password for basic auth
          - VictoriaMetricsBearerToken — Bearer token authentication for Victoria Metrics. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token for authentication
            - `auth_type` 'bearer_token'
            - `bearer_token` string, password, required — Bearer token for authentication
        - `enable_ssl` boolean — Whether to enable SSL for the VM connection. See https://www.python-httpx.org/advanced/ssl/ for more details.
    - AppDynamicsIntegrationConfig — AppDynamics application performance monitoring platform integration. Customer provides OAuth credentials for AppDynamics API access. Attributes: type: Integration type discriminator for union resolution client_id: OAuth client ID (required) client_secret: OAuth client secret (required) base_url: AppDynamics API base URL (optional)
      - `type` 'appdynamics'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `client_id` string, required — OAuth client ID
      - `client_secret` string, password, required — OAuth client secret
      - `base_url` string, uri, nullable
    - ServiceNowIntegrationConfig — ServiceNow IT service management and incident tracking platform integration. Attributes: type: Integration type discriminator for union resolution instance_url: ServiceNow instance URL auth: Authentication configuration (client_credentials, password_grant, or basic_auth) ssl_verify: Whether to verify SSL certificates. Set False for on-prem instances with internal CAs that are not in the system trust store. metrics_api_tables: CMDB class tables queryable via the Clotho metrics API. table_api_tables: Tables allowed for the generic REST Table API.
      - `type` 'servicenow'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `instance_url` string, uri, required — ServiceNow instance URL
      - `auth` union, required
        - ServiceNowClientCredentialsAuth
          - `auth_type` 'client_credentials'
          - `client_id` string, required — OAuth client ID
          - `client_secret` string, password, required — OAuth client secret
          - `access_token_url` string, uri, required — OAuth access token URL
        - ServiceNowPasswordGrantAuth
          - `auth_type` 'password_grant'
          - `username` string, required — ServiceNow username
          - `password` string, password, required — ServiceNow password
          - `access_token_url` string, uri, required — OAuth access token URL
        - ServiceNowBasicAuth
          - `auth_type` 'basic_auth'
          - `username` string, required — ServiceNow username
          - `password` string, password, required — ServiceNow password
      - `ssl_verify` boolean — Verify SSL certificates
      - `incident_api_path` string — Incident table API path.
      - `incident_api_health_check_params` object — Query params for the health check probe against the incident table.
      - `custom_headers` object — Optional non-sensitive HTTP headers added to every ServiceNow API request.
      - `metrics_api_tables` string[] — CMDB class tables queryable via the Clotho metrics API (e.g. cmdb_ci_computer). Drives ServiceNow dataset population for DatasetExecuteMetricQueriesTool.
      - `table_api_tables` string[] — Tables allowed for the generic REST Table API (ServiceNowTableQueryTool), e.g. cmdb_ci, incident. Drives dataset population for future table-query dataset support.
    - GitHubIntegrationConfig — GitHub source code hosting and version control platform integration. Customer provides either GitHub App installation ID (preferred) or a personal access token for authentication. Attributes: type: Integration type discriminator for union resolution auth: Authentication configuration (installation ID or access token) api_url: GitHub API URL for Enterprise deployments (optional) repos: List of repositories in 'owner/repo' format (optional) organization: GitHub organization name for organization-wide access (optional)
      - `type` 'github'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth` union, required
        - GitHubInstallationAuth — GitHub App installation authentication. Attributes: auth_type: Discriminator for union type installation_id: GitHub App installation ID (required)
          - `auth_type` 'installation_id'
          - `installation_id` string, password, required — GitHub App installation ID
        - GitHubTokenAuth — GitHub personal access token or OAuth token authentication. Attributes: auth_type: Discriminator for union type access_token: Personal access token or OAuth token (required, begins with secret_)
          - `auth_type` 'access_token'
          - `access_token` string, password, required — Personal access token or OAuth token
        - GitHubEnterpriseAuth — GitHub Enterprise authentication. Attributes: auth_type: Discriminator for union type api_url: GitHub API URL for Enterprise deployments (required)
          - `auth_type` 'enterprise'
          - `api_url` string, uri, required — GitHub API URL for Enterprise deployments
          - `access_token` string, password, required — Personal access token or OAuth token
      - `api_url` string, uri, nullable — GitHub API URL for Enterprise deployments
      - `repositories` string[], nullable — List of repositories in 'owner/repo' format (e.g., 'myorg/myrepo')
      - `organization` string, nullable — GitHub organization name for organization-wide access
    - GitLabIntegrationConfig — GitLab source code hosting and version control platform integration. Supports both gitlab.com and self-hosted GitLab instances. Customer provides a personal access token, project access token, or group access token for authentication. Self-hosted instances can specify a custom API URL. Attributes: type: Integration type discriminator for union resolution auth: Authentication configuration (personal, project, or group access token) api_url: GitLab API URL (default: https://gitlab.com for gitlab.com, custom for self-hosted) project_ids: List of project IDs (numeric) to access (optional) group_id: GitLab group ID for group-wide access (optional)
      - `type` 'gitlab'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth` union
        - GitLabTokenAuth — GitLab personal access token or OAuth token authentication. Supports both gitlab.com and self-hosted GitLab instances. Attributes: auth_type: Discriminator for union type access_token: Personal access token or OAuth token (required)
          - `auth_type` 'access_token'
          - `access_token` string, password, required — Personal access token or OAuth token
        - GitLabProjectAccessTokenAuth — GitLab project access token authentication. Project-scoped tokens for specific projects (similar to GitHub deploy keys). Attributes: auth_type: Discriminator for union type project_id: GitLab project ID access_token: Project access token (required)
          - `auth_type` 'project_access_token'
          - `project_id` integer, required — GitLab project ID
          - `access_token` string, password, required — Project access token
        - GitLabGroupAccessTokenAuth — GitLab group access token authentication. Group-scoped tokens for access to all projects within a group. Attributes: auth_type: Discriminator for union type group_id: GitLab group ID access_token: Group access token (required)
          - `auth_type` 'group_access_token'
          - `group_id` integer, required — GitLab group ID
          - `access_token` string, password, required — Group access token
      - `api_url` string, uri — GitLab API URL (default: gitlab.com, set custom URL for self-hosted)
      - `project_ids` integer[], nullable — List of GitLab project IDs (numeric) to access
      - `group_id` integer, nullable — GitLab group ID for group-wide access
    - GrafanaIntegrationConfig — Grafana observability platform for metrics, logs, and traces visualization. Customer provides server URL and authentication credentials (bearer token or username/password). Attributes: type: Integration type discriminator for union resolution url: Grafana server URL (required) auth: Authentication configuration (bearer token or basic auth) enable_querying: Whether Traversal may run queries through this Grafana instance.
      - `type` 'grafana'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Grafana server URL
      - `auth` union, required
        - GrafanaBearerTokenAuth — Bearer token authentication for Grafana. Attributes: auth_type: Discriminator for union type bearer_token: Service account token or API key (required)
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required — Service account token or API key
        - GrafanaBasicAuth — HTTP Basic authentication credentials for Grafana. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required — Username for basic auth
          - `password` string, password, required — Password for basic auth
      - `enable_querying` boolean — Allow Traversal to run queries through this Grafana instance
    - ThousandEyesIntegrationConfig — ThousandEyes network intelligence and monitoring platform integration. Customer provides API key for ThousandEyes API access. Attributes: type: Integration type discriminator for union resolution api_key: ThousandEyes API key (required)
      - `type` 'thousandeyes'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — ThousandEyes API key
    - NotionIntegrationConfig — Notion workspace and knowledge management platform integration. Customer provides integration token for Notion API access. Attributes: type: Integration type discriminator for union resolution token: Notion integration token (required, begins with secret_)
      - `type` 'notion'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `token` string, password, required — Notion integration token
    - OpenSearchIntegrationConfig — OpenSearch search and analytics engine (Elasticsearch fork). Customer provides connection details (hosts) and authentication credentials (basic auth, API key with ID, or API key only). Attributes: type: Integration type discriminator for union resolution hosts: One or more OpenSearch hosts auth: Authentication configuration (basic auth or API key variants)
      - `type` 'opensearch'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth` union, required
        - OpenSearchBasicAuth — HTTP Basic authentication credentials. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
          - `auth_type` 'basic_auth'
          - `username` string, required — Username for basic auth
          - `password` string, password, required — Password for basic auth
        - OpenSearchApiKeyWithId — API key authentication with ID and key pair. Attributes: auth_type: Discriminator for union type key_id: API key identifier (required) key: API key secret (required)
          - `auth_type` 'api_key_with_id'
          - `key_id` string, required — API key identifier
          - `key` string, password, required — API key secret
        - OpenSearchApiKey — API key authentication (single key string). Attributes: auth_type: Discriminator for union type api_key: API key (required)
          - `auth_type` 'api_key'
          - `api_key` string, password, required — API key
        - OpenSearchBearerToken — Bearer token authentication. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token sent in the Authorization header
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required — Bearer token
      - `base_url_for_ui` string, uri, nullable
      - `hosts` string[] — One or more OpenSearch hosts
      - `index_discovery_patterns` string[] — Index patterns used to scope dataset-enumeration requests (_cat/indices/<pattern>, _resolve/index/<pattern>) — e.g. ['elf-*-log-*', 'elf-*-span-*']. Required for least-privilege credentials and path-allowlisted or federated proxies that reject unscoped enumeration. Empty enumerates unscoped ('*').
    - SplunkIntegrationConfig — Splunk log management and security information platform integration. Customer provides instance URL and authentication (basic auth or bearer token). Attributes: type: Integration type discriminator for union resolution url: Splunk instance URL (required) auth: Authentication configuration (basic auth or bearer token)
      - `type` 'splunk'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Splunk instance URL
      - `auth` union, required
        - SplunkBasicAuth — Username/password authentication credentials for Splunk. Attributes: auth_type: Discriminator for union type username: Username for authentication (required) password: Password for authentication (required)
          - `auth_type` 'basic_auth'
          - `username` string, required — Username for authentication
          - `password` string, password, required — Password for authentication
        - SplunkBearerToken — Bearer token authentication for Splunk. Attributes: auth_type: Discriminator for union type bearer_token: Bearer token for Splunk authentication
          - `auth_type` 'bearer_token'
          - `bearer_token` string, password, required — Bearer token for authentication
    - ConfluenceIntegrationConfigInput — Confluence wiki and documentation platform integration. Attributes: type: Integration type discriminator for union resolution url: Confluence instance URL (required) auth: Authentication configuration (Basic Auth, Bearer token, or a client-credentials variant for Cloud reached via an egress gateway) cloud_id: Atlassian cloud ID for multi-tenant deployments (optional, required for api.atlassian.net)
      - `type` 'confluence'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Confluence instance URL
      - `auth` union, required
        - ConfluenceBasicAuth — Atlassian Cloud authentication via email + API token. Standard auth for Confluence Cloud: the email and API token are sent as HTTP Basic Auth credentials (``Authorization: Basic base64(email:token)``).
          - `auth_type` 'basic_auth'
          - `username` string, required — Email address for Atlassian Cloud
          - `api_key` string, password, required — Atlassian API token
        - ConfluenceUsernamePasswordAuth — Confluence Server / Data Center HTTP Basic authentication.
          - `auth_type` 'username_password'
          - `username` string, required — Confluence username
          - `password` string, password, required — Confluence account password
        - ConfluenceBearerAuth — On-prem / Data Center authentication via personal access token. Used for Confluence Server or Data Center instances that authenticate with ``Authorization: Bearer <token>`` rather than Basic Auth.
          - `auth_type` 'bearer_token'
          - `api_key` string, password, required — Personal access token
        - ClientCredentialsAuthBasicJson — HTTP Basic auth plus a JSON body. Credentials authenticate as HTTP Basic; endpoint-specific parameters travel in ``request_body`` as JSON. The token is read from ``token_response_key``.
          - `token_url` string, uri, required — Token endpoint URL
          - `client_id` string, password, required — Client identifier
          - `client_secret` string, password, required — Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential — A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required — Username for the Basic credential
            - `secret` string, password, required — Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'basic_json'
        - ClientCredentialsAuthHmacSigned — Token request authenticated by an HMAC signature carried in request headers. The caller signs ``{client_id}-{signature_version}-{timestamp_ms}`` with the base64-decoded ``client_secret`` (HMAC-SHA256, base64url-encoded) and sends the signature plus the app id, version, and timestamp as request headers. Endpoint-specific parameters travel in ``request_body`` as JSON; the token is read from ``token_response_key``.
          - `token_url` string, uri, required — Token endpoint URL
          - `client_id` string, password, required — Client identifier
          - `client_secret` string, password, required — Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential — A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required — Username for the Basic credential
            - `secret` string, password, required — Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'hmac_signed'
          - `signature_version` string — Signing scheme version echoed in the signed message and header
      - `cloud_id` string, nullable — Atlassian cloud ID for multi-tenant deployments (required when using api.atlassian.net)
    - FireHydrantIntegrationConfig — FireHydrant incident management and retrospective platform integration. Customer provides API key for FireHydrant API access. Attributes: type: Integration type discriminator for union resolution api_key: FireHydrant API key (required)
      - `type` 'firehydrant'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — FireHydrant API key
    - SlackIntegrationConfig — Slack team communication and collaboration platform integration. Customer provides bot token for Slack API access. Attributes: type: Integration type discriminator for union resolution bot_token: Slack bot token (required, begins with xoxb-) workspace_id: Workspace/team ID (T...). Populated from slack_integrations DB table. team_name: Human-readable workspace name. Populated from slack_integrations DB table. bot_user_id: Slack user ID of the bot (U...). Populated from slack_integrations DB table. bot_id: Bot app configuration ID (B...). Populated from slack_integrations DB table. enterprise_id: Enterprise Grid ID. Populated from slack_integrations DB table. enterprise_name: Human-readable enterprise name. Populated from slack_integrations DB table. enterprise_url: Enterprise Grid URL. Populated from slack_integrations DB table. is_enterprise_install: Whether this is an Enterprise Grid installation. Populated from slack_integrations DB table. app_id: Slack App ID. Populated from slack_integrations DB table. bot_scopes: Comma-separated OAuth scopes granted to the bot. Populated from slack_integrations DB table. bot_refresh_token: Bot token refresh token. Populated from slack_integrations DB table. bot_token_expires_at: Bot token expiry timestamp. Populated from slack_integrations DB table. user_id: Slack user ID of the person who installed the app. Populated from slack_integrations DB table. user_token: User OAuth token. Populated from slack_integrations DB table. user_scopes: Comma-separated OAuth scopes granted to the user token. Populated from slack_integrations DB table. user_refresh_token: User token refresh token. Populated from slack_integrations DB table. user_token_expires_at: User token expiry timestamp. Populated from slack_integrations DB table. token_type: Token type (always 'bot'). Populated from slack_integrations DB table. installed_at: Installation timestamp. Populated from slack_integrations DB table. incoming_webhook_url: Incoming webhook URL. Populated from slack_integrations DB table. incoming_webhook_channel: Channel name for the incoming webhook. Populated from slack_integrations DB table. incoming_webhook_channel_id: Channel ID for the incoming webhook. Populated from slack_integrations DB table. incoming_webhook_configuration_url: URL to reconfigure the incoming webhook. Populated from slack_integrations DB table.
      - `type` 'slack'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `bot_token` string, password, required — Slack bot token
      - `workspace_id` string, nullable — Workspace ID for enterprise installations
      - `team_name` string, nullable — Human-readable Slack workspace name
      - `bot_user_id` string, nullable — Slack user ID of the bot (U...)
      - `bot_id` string, nullable — Bot app configuration ID (B...)
      - `enterprise_id` string, nullable — Enterprise Grid ID
      - `enterprise_name` string, nullable — Human-readable enterprise name
      - `is_enterprise_install` boolean, nullable — Whether this is an Enterprise Grid installation
      - `incoming_webhook_url` string, nullable — Incoming webhook URL
      - `incoming_webhook_channel` string, nullable — Channel name for the incoming webhook
      - `incoming_webhook_channel_id` string, nullable — Channel ID for the incoming webhook
      - `incoming_webhook_configuration_url` string, nullable — URL to reconfigure the incoming webhook
      - `app_id` string, nullable — Slack App ID
      - `enterprise_url` string, nullable — Enterprise Grid URL
      - `bot_scopes` string, nullable — Comma-separated OAuth scopes granted to the bot
      - `user_id` string, nullable — Slack user ID of the person who installed the app
      - `user_scopes` string, nullable — Comma-separated OAuth scopes granted to the user token
      - `token_type` string, nullable — Token type
      - `installed_at` string, nullable — Installation timestamp
      - `bot_token_expires_at` string, nullable — Bot token expiry timestamp
      - `bot_refresh_token` string, password, nullable — Bot token refresh token
      - `user_token` string, password, nullable — User OAuth token
      - `user_refresh_token` string, password, nullable — User token refresh token
      - `user_token_expires_at` string, nullable — User token expiry timestamp
      - `archived_at` string, nullable — Lifecycle marker carried over from the legacy slack_integrations table. Set when the workspace install was archived in the legacy system; preserved here so historical installs can be backfilled without losing the archive timestamp. None for live installs.
    - TeamsIntegrationConfig — Microsoft Teams chat platform integration. The Teams analogue of ``SlackIntegration``: the typed credentials blob for a Teams bot install, stored as an AWS secret on an ``integration_instances`` row of ``integration_type = teams``. There is no Postgres install table — Teams ships natively on ``integration_instances``. Credentials are Azure Bot Service / Bot Framework app credentials: the bot's Microsoft app (client) id plus its client secret. ``tenant_id`` is the Azure AD tenant the bot is installed in and serves as the ``third_party_id`` for the ``integration_instances`` row. Attributes: type: Integration type discriminator for union resolution. app_id: Microsoft/Bot Framework app (client) id. A public identifier, not a secret. app_password: Bot client secret. Required, secret. tenant_id: Azure AD tenant id; the install identifier (``third_party_id``). app_type: Bot Framework app type ("MultiTenant" / "SingleTenant" / "UserAssignedMSI"). bot_id: The bot's id in Teams (often equal to ``app_id``). Install metadata. bot_name: Human-readable bot/app display name. Install metadata. service_url: Bot Framework service URL for the tenant, discovered from inbound activities and required to send proactive messages. Install metadata. installed_at: Installation timestamp. Install metadata. archived_at: Lifecycle marker set when the install was archived; None for live installs.
      - `type` 'teams'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `app_id` string, required — Microsoft/Bot Framework app (client) id
      - `app_password` string, password, required — Bot client secret
      - `tenant_id` string, nullable — Azure AD tenant id; the install's third_party_id
      - `app_type` string, nullable — Bot Framework app type (MultiTenant / SingleTenant)
      - `bot_id` string, nullable — The bot's id in Teams
      - `bot_name` string, nullable — Human-readable bot/app display name
      - `service_url` string, nullable — Bot Framework service URL for the tenant (for proactive messages)
      - `installed_at` string, nullable — Installation timestamp
      - `archived_at` string, nullable — Lifecycle marker set when the Teams install was archived; None for live installs.
    - LokiIntegrationConfig — Loki log aggregation system integration. Grafana Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. Attributes: type: Integration type discriminator for union resolution url: Loki server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments
      - `type` 'loki'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Loki server URL
      - `token` string, password, nullable — Bearer token for authentication
      - `org_id` string, nullable — Organization ID for multi-tenant deployments
    - LinearIntegrationConfig — Linear issue tracking integration. Linear is a modern issue tracking tool for software teams. Attributes: type: Integration type discriminator for union resolution api_key: Linear API key for authentication (required)
      - `type` 'linear'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — Linear API key for authentication
    - MimirIntegrationConfig — Mimir - scalable long-term storage for Prometheus metrics. Customer provides server URL and authentication. Mimir typically requires an X-Scope-OrgID header for multi-tenancy. Attributes: type: Integration type discriminator for union resolution url: Mimir server URL (required) basic_auth: Optional basic authentication credentials bearer_token: Optional bearer token for authentication org_id: X-Scope-OrgID header value for Mimir multi-tenancy
      - `type` 'mimir'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Mimir server URL
      - `basic_auth` PrometheusBasicAuth — HTTP Basic authentication credentials for Prometheus. Attributes: auth_type: Discriminator for union type username: Username for basic auth (required) password: Password for basic auth (required)
        - `auth_type` 'basic_auth'
        - `username` string, required — Username for basic auth
        - `password` string, password, required — Password for basic auth
      - `bearer_token` string, password, nullable — Bearer token for authentication
      - `org_id` string, nullable — X-Scope-OrgID header value for Mimir multi-tenancy
    - MotherDuckIntegrationConfig — MotherDuck serverless analytics integration. MotherDuck is a serverless analytics platform built on DuckDB. Attributes: type: Integration type discriminator for union resolution token: MotherDuck authentication token (required)
      - `type` 'motherduck'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `token` string, password, required — MotherDuck authentication token
    - JiraIntegrationConfigInput — Jira issue tracking integration. Jira is an issue tracking and project management tool by Atlassian. Attributes: type: Integration type discriminator for union resolution base_url: Jira instance URL (e.g., https://company.atlassian.net or https://api.atlassian.net) auth: API-token auth for Cloud or username/password Basic Auth for Server/Data Center cloud_id: Atlassian cloud ID for multi-tenant deployments (optional, required for api.atlassian.net)
      - `type` 'jira'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `base_url` string, uri, required — Jira instance URL (e.g., https://company.atlassian.net or https://api.atlassian.net)
      - `auth` union
        - JiraApiTokenAuth — Atlassian Cloud authentication via email and API token.
          - `auth_type` 'api_token'
          - `email` string, required — Atlassian account email
          - `api_token` string, password, required — Jira API token
        - JiraBasicAuth — Jira Server / Data Center authentication via username and password.
          - `auth_type` 'basic_auth'
          - `username` string, required — Jira username
          - `password` string, password, required — Jira account password
      - `email` string, nullable
      - `api_token` string, password, nullable
      - `cloud_id` string, nullable — Atlassian cloud ID for multi-tenant deployments (required when using api.atlassian.net)
    - KubernetesIntegrationConfig — Kubernetes API integration for sandbox kubectl access. Holds a cluster ``connection`` (how to reach the API server) and an ``auth`` (how to authenticate). Commands receive a per-exec kubeconfig built from a short-lived token. The two axes are orthogonal except for ``aws_eks``, which is self-authenticating and pairs only with the ``aws_eks_derived`` sentinel — the pairing validator enforces the valid combinations.
      - `type` 'kubernetes'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `connection` union, required
        - KubernetesExplicitConnection — Direct connection details for one Kubernetes API server.
          - `connection_type` 'explicit'
          - `cluster_name` string, required — Human-readable cluster/context name
          - `server_url` string, uri, required — Kubernetes API server URL
          - `default_namespace` string, nullable — Optional namespace set as the kubeconfig context default
          - `certificate_authority_data` string, nullable — Base64-encoded PEM CA bundle for the Kubernetes API server
          - `insecure_skip_tls_verify` boolean — Disable TLS verification for the Kubernetes API server
        - KubernetesEksConnection — Discover an EKS cluster and mint tokens from an assumed AWS role. Self-authenticating: one assumed-role session both resolves the endpoint/CA (``eks:DescribeCluster``) and presigns the STS token, so it pairs only with ``aws_eks_derived`` auth. Authorization is deferred to the role's EKS access-entry RBAC — mirrors the AWS CLI integration's defer-to-ARN model. ``external_id`` is optional to configure here, but AWS's own AssumeRole condition is not: every broker-trusting role (customer-CFN-deployed or Traversal's own internal one) requires a matching ``sts:ExternalId``. When unset, the credential provider falls back to the org-derived default (``traversal:<org_id>``) rather than omitting the parameter.
          - `connection_type` 'aws_eks'
          - `cluster_name` string, required — EKS cluster name (also the kubeconfig context name)
          - `region` string, required — AWS region of the EKS cluster
          - `role_arn` string, required — Customer IAM role ARN Traversal assumes; its EKS RBAC is the boundary
          - `external_id` string, password, nullable — External ID for the customer's IAM role trust policy — the confused-deputy mitigation for a multi-tenant assumer. Leave unset to use Traversal's org-derived default (traversal:<org_id>), which is what the CFN template's downloadable default is pre-filled with; set explicitly only if the role's trust policy pins a different value.
          - `session_duration_seconds` integer — Duration of the assumed-role session used to mint EKS tokens
          - `default_namespace` string, nullable — Optional namespace set as the kubeconfig context default
      - `auth` union, required
        - KubernetesTokenRequestAuth — Mint short-lived tokens for a customer-scoped Kubernetes ServiceAccount. The requester token should be bound only to ``create`` on the target ``serviceaccounts/token`` resource. The target ServiceAccount's RBAC is the permission boundary for commands run by the agent.
          - `auth_type` 'token_request'
          - `service_account_name` string, required — Target ServiceAccount whose RBAC defines kubectl permissions
          - `service_account_namespace` string, required — Namespace containing the target ServiceAccount
          - `requester_bearer_token` string, password, required — Bearer token allowed to create tokens for the target ServiceAccount via the Kubernetes TokenRequest API
          - `audience` string, nullable — Optional TokenRequest audience. Leave unset for the cluster default.
          - `expiration_seconds` integer — Requested lifetime for each short-lived ServiceAccount token
        - KubernetesBearerAuth — Static, long-lived ServiceAccount bearer token (self-managed clusters). Pairs with an ``explicit`` connection. The token's ServiceAccount RBAC is the permission boundary for commands run by the agent.
          - `auth_type` 'bearer'
          - `bearer_token` string, password, required — Static ServiceAccount bearer token used to authenticate to the cluster
        - KubernetesAwsEksDerivedAuth — Sentinel: auth derived from an ``aws_eks`` connection's assumed-role identity. Carries no independent credentials — the connection's assumed role both discovers the cluster endpoint/CA (``eks:DescribeCluster``) and presigns the STS token. Valid only with an ``aws_eks`` connection (enforced by ``KubernetesIntegrationConfig``'s pairing validator).
          - `auth_type` 'aws_eks_derived'
    - CoralogixIntegrationConfig — Coralogix observability platform integration. Coralogix is a full-stack observability platform that provides log analytics, metrics, and tracing capabilities. Attributes: type: Integration type discriminator for union resolution api_key: API key for Coralogix authentication (required) base_url: Coralogix API base URL (e.g., "https://api.eu2.coralogix.com")
      - `type` 'coralogix'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — API key for Coralogix authentication
      - `base_url` string, uri, required — Coralogix API base URL (e.g., https://api.eu2.coralogix.com)
    - CriblIntegrationConfig — Cribl.Cloud observability pipeline integration. Authenticates via OAuth client credentials against the Cribl.Cloud workspace URL. Attributes: type: Integration type discriminator for union resolution url: Cribl.Cloud workspace URL (required) auth: Cribl.Cloud OAuth client credentials
      - `type` 'cribl'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Cribl.Cloud workspace URL
      - `auth` CriblSaasAuth, required — OAuth 2.0 client-credentials authentication for Cribl.Cloud. The client_id and client_secret are exchanged at ``https://login.cribl.cloud/oauth/token`` for a 24-hour Bearer JWT used on subsequent API requests. Attributes: client_id: OAuth client ID from the Cribl.Cloud API Credential client_secret: OAuth client secret from the Cribl.Cloud API Credential
        - `client_id` string, required — Cribl.Cloud OAuth client ID
        - `client_secret` string, password, required — Cribl.Cloud OAuth client secret
    - IncidentIoIntegrationConfig — Incident.io incident management platform integration. Customer provides API key for incident.io API access. The API key is used as a Bearer token for all upstream requests. Attributes: type: Integration type discriminator for union resolution api_key: Incident.io API key (required, begins with inc_)
      - `type` 'incident_io'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_key` string, password, required — Incident.io API key
    - SentryIntegrationConfig — Sentry error and performance monitoring platform integration. Customer provides an auth token (org-scoped internal-integration token preferred, personal auth token as a fallback) plus their organization slug. The token is used as a Bearer token for all upstream requests. Attributes: type: Integration type discriminator for union resolution auth_token: Sentry auth token (required) organization_slug: Sentry organization slug the token belongs to (required, all deployments). Analogous to the cloud ID on Atlassian. base_url: API base URL. Defaults to https://sentry.io when unset. Set to https://de.sentry.io for the EU region, or the custom domain for single-tenant / self-hosted deployments.
      - `type` 'sentry'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `auth_token` string, password, required — Sentry auth token
      - `organization_slug` string, required — Sentry organization slug
      - `base_url` string, uri, nullable — API base URL; defaults to https://sentry.io. Set to https://de.sentry.io for the EU region, or the custom domain for single-tenant / self-hosted.
    - TempoIntegrationConfig — Grafana Tempo distributed tracing backend integration. Attributes: type: Integration type discriminator for union resolution url: Tempo server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments
      - `type` 'tempo'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Tempo server URL
      - `token` string, password, nullable — Bearer token for authentication
      - `org_id` string, nullable — Organization ID for multi-tenant deployments
    - AlertmanagerIntegrationConfig — Grafana Alertmanager integration for querying active and historical alerts. Attributes: type: Integration type discriminator for union resolution url: Alertmanager server URL (required) token: Optional bearer token for authentication org_id: Optional organization ID for multi-tenant deployments
      - `type` 'alertmanager'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `url` string, uri, required — Alertmanager server URL
      - `token` string, password, nullable — Bearer token for authentication
      - `org_id` string, nullable — Organization ID for multi-tenant deployments
    - AlexandriaIntegrationConfig — Configuration for a Nubank Alexandria MCP endpoint. Attributes: type: Integration discriminator (always ``IntegrationType.ALEXANDRIA``). enabled_data_types: Alexandria provides log data via Trino queries. server_url: Alexandria MCP endpoint URL. Defaults to the prod-global cluster-internal address, but is configurable so different envs (blue/green, ist, us, br) can be used without a code change. bearer_token: Optional Nubank API key JWT sent as ``Authorization: Bearer``. Required at query time; omitted on legacy instances until migrated.
      - `type` 'alexandria'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required — Alexandria MCP endpoint URL
      - `bearer_token` string, password, nullable — Bearer token for Alexandria MCP proxy authentication
    - HoneycombIntegrationConfig — Configuration for a Nubank Honeycomb MCP endpoint. Attributes: type: Integration discriminator (always ``IntegrationType.HONEYCOMB``). enabled_data_types: Honeycomb provides trace data via MCP tools. server_url: Honeycomb MCP proxy endpoint URL. bearer_token: Optional Nubank API key JWT sent as ``Authorization: Bearer``. Required at query time; omitted on legacy instances until migrated.
      - `type` 'honeycomb'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required — Honeycomb MCP proxy endpoint URL
      - `bearer_token` string, password, nullable — Bearer token for Honeycomb MCP proxy authentication
    - DynatraceIntegrationConfig — Dynatrace observability integration supporting Classic API and/or Grail. Customers populate *one or both* of (``classic_url`` + ``api_token_auth``) and (``platform_url`` + ``oauth_auth``). At least one complete pair is required; the health checker and clients will only exercise the pair(s) that are configured. Typical configurations: * **SaaS, mid-migration:** both pairs. Classic API token unlocks ``/api/v2/problems``, ``/api/v2/entities``, etc.; OAuth unlocks Grail (``/platform/storage/query/*``). * **SaaS, Grail-only:** only ``platform_url`` + ``oauth_auth``. Problems and entities still reachable via DQL (``fetch dt.entity.host``, …). * **Managed / self-hosted:** only ``classic_url`` + ``api_token_auth`` (Grail is not deployed on Managed).
      - `type` 'dynatrace'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `classic_url` string, uri, nullable — Classic Environment API URL. SaaS: 'https://<env-id>.live.dynatrace.com'. Managed / self-hosted: 'https://<your-domain>/e/<env-id>'. Required when api_token_auth is set.
      - `platform_url` string, uri, nullable — Platform (Grail) URL: 'https://<env-id>.apps.dynatrace.com'. Required when oauth_auth is set. SaaS-only (Managed has no Grail).
      - `api_token_auth` DynatraceApiTokenAuth — Classic Environment API credentials. Authenticates as ``Authorization: Api-Token <api_token>`` against the classic ``/api/v2/*`` surface. This is the **only** auth type available on Dynatrace Managed / self-hosted tenants (Grail is SaaS-only). Generate in Dynatrace UI: Settings → Integration → Dynatrace API → Generate token. Select the scopes the integration needs — at minimum ``metrics.read`` for the health check to pass.
        - `auth_type` 'api_token'
        - `api_token` string, password, required — Dynatrace API Token (starts with 'dt0c01.')
      - `oauth_auth` DynatraceOAuthClientAuth — Platform / Grail credentials via OAuth 2.0 client credentials. At request time we exchange (``client_id``, ``client_secret``) plus the requested ``scopes`` and the account URN (``resource``) at ``sso_token_url`` for a short-lived Bearer token, which is then sent as ``Authorization: Bearer <token>`` against ``/platform/*`` endpoints on the platform host. Generate in Dynatrace UI: Account Management → Identity & access management → OAuth clients → Create client. Grant the scopes the integration will need (e.g. ``storage:logs:read``, ``storage:buckets:read``, ``storage:system:read``).
        - `auth_type` 'oauth_client'
        - `client_id` string, required — OAuth client ID (starts with 'dt0s02.')
        - `client_secret` string, password, required — OAuth client secret
        - `account_urn` string, required — Dynatrace account URN, e.g. 'urn:dtaccount:<uuid>'
        - `sso_token_url` string, uri — SSO token endpoint. Override only for sovereign/regional tenants.
        - `scopes` string[] — OAuth scopes to request when minting a Bearer token. Empty (the default) means we omit the scope parameter so Dynatrace returns the full allowlist the OAuth client was granted. Override only to narrow the token below that grant.
    - McpIntegrationConfigInput — Configuration for a single MCP server. Three auth methods are supported, distinguished by how the credential is obtained: - ``bearer_token``: a static credential, stamped on a header as-is. No acquisition step. ``auth_header_name`` and ``auth_scheme`` shape the header and default to ``Authorization`` / ``Bearer``, i.e. ``Authorization: Bearer <auth_token>``. Override them for servers that want something else: ``Basic`` for HTTP Basic, ``Bearer Basic`` for Mixpanel's documented hybrid, or ``auth_scheme=None`` plus an ``X-Api-Key`` header name to send the raw credential with no prefix. - ``client_credentials``: exchange service-account credentials for a short-lived token at a custom token endpoint. Carried by the shared client-credentials config, whose ``auth_type`` selects the wire format (e.g. ``basic_json``: HTTP Basic auth + JSON body). - ``oauth``: standard OAuth 2.0 authorization-code + PKCE + Dynamic Client Registration (RFC 7591/7636). User-authorized at creation time via a popup; tokens are stored encrypted, refreshed on demand using the refresh token if the server issued one. ``auth_header_name`` / ``auth_scheme`` apply only to ``bearer_token``. The other two acquire a token whose transport is fixed by their own spec, and always send it as ``Authorization: Bearer <token>``. Multiple MCP servers per organization are achieved by creating multiple ``IntegrationInstance`` rows of type ``mcp`` via the v3 integrations API; each instance carries its own ``McpIntegration`` payload.
      - `type` 'mcp'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required
      - `tool_call_timeout_ms` integer
      - `blocked_tools` string[]
      - `auth_type` 'bearer_token' | 'client_credentials' | 'oauth'
      - `auth_token` string, password, nullable
      - `auth_header_name` string
      - `auth_scheme` string, nullable
      - `client_credentials` union
        - ClientCredentialsAuthBasicJson — HTTP Basic auth plus a JSON body. Credentials authenticate as HTTP Basic; endpoint-specific parameters travel in ``request_body`` as JSON. The token is read from ``token_response_key``.
          - `token_url` string, uri, required — Token endpoint URL
          - `client_id` string, password, required — Client identifier
          - `client_secret` string, password, required — Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential — A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required — Username for the Basic credential
            - `secret` string, password, required — Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'basic_json'
        - ClientCredentialsAuthHmacSigned — Token request authenticated by an HMAC signature carried in request headers. The caller signs ``{client_id}-{signature_version}-{timestamp_ms}`` with the base64-decoded ``client_secret`` (HMAC-SHA256, base64url-encoded) and sends the signature plus the app id, version, and timestamp as request headers. Endpoint-specific parameters travel in ``request_body`` as JSON; the token is read from ``token_response_key``.
          - `token_url` string, uri, required — Token endpoint URL
          - `client_id` string, password, required — Client identifier
          - `client_secret` string, password, required — Client secret
          - `request_body` object, nullable
          - `token_response_key` string
          - `forwarded_credential` BasicCredential — A static HTTP Basic credential (``base64(username:secret)``).
            - `username` string, required — Username for the Basic credential
            - `secret` string, password, required — Secret/token for the Basic credential
          - `forwarded_credential_header` string, nullable
          - `auth_type` 'hmac_signed'
          - `signature_version` string — Signing scheme version echoed in the signed message and header
      - `oauth_access_token` string, password, nullable
      - `oauth_refresh_token` string, password, nullable
      - `oauth_token_expires_at` string, date-time, nullable
      - `oauth_client_id` string, password, nullable
      - `oauth_client_secret` string, password, nullable
      - `oauth_token_endpoint` string, uri, nullable
      - `oauth_authorization_endpoint` string, uri, nullable
      - `oauth_token_endpoint_auth_method` string, nullable
      - `oauth_scope` string, nullable
      - `scope` 'organization'
      - `identity_mode` 'service_account'
    - SpinnakerIntegrationConfig — Spinnaker continuous-delivery platform integration. Self-hosted CD platform; auth method varies by deployment. Five auth modes are supported via the ``auth`` discriminated union — see each variant's docstring for details on when to use it. Attributes: type: Integration type discriminator for union resolution gate_url: Spinnaker Gate base URL (include port for X.509, e.g. :8085) auth: Authentication configuration (one of five variants) applications: Optional list of Spinnaker applications to scope queries to
      - `type` 'spinnaker'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `gate_url` string, uri, required — Spinnaker Gate base URL
      - `auth` union, required
        - SpinnakerX509Auth — Spinnaker X.509 client certificate (mTLS) authentication. Used when Gate is configured with X.509 client-cert auth on its dedicated API port (default 8085). Same auth mode the ``spin`` CLI uses. Attributes: auth_type: Discriminator for union type client_cert_pem: Client certificate PEM (required) client_key_pem: Client private key PEM (required) ca_bundle_pem: Optional CA bundle for verifying Gate's server cert
          - `auth_type` 'x509'
          - `client_cert_pem` string, password, required — Client certificate PEM
          - `client_key_pem` string, password, required — Client private key PEM
          - `ca_bundle_pem` string, password, nullable — Optional CA bundle PEM for server certificate verification
        - SpinnakerOAuthAuth — Spinnaker OAuth 2.0 client-credentials (OIDC) authentication. Exchanges service-account credentials at the IdP token endpoint for a short-lived bearer token, which is then sent to Gate. Requires Gate to be configured to accept the IdP's bearer tokens (typically a Spring resource-server filter validating against the IdP's JWKS). Attributes: auth_type: Discriminator for union type token_url: IdP token endpoint URL client_id: OAuth client ID client_secret: OAuth client secret scope: Optional OAuth scope(s) audience: Optional audience claim required by some IdPs
          - `auth_type` 'oauth_client_credentials'
          - `token_url` string, uri, required — IdP token endpoint URL
          - `client_id` string, password, required — OAuth client ID
          - `client_secret` string, password, required — OAuth client secret
          - `scope` string, nullable — OAuth scope(s)
          - `audience` string, nullable — Audience claim required by some IdPs (e.g. Auth0)
        - SpinnakerHeaderAuth — Spinnaker ``X-SPINNAKER-USER`` header authentication. Used when Gate's ``gate-header`` module is enabled and an upstream component (mTLS at the load balancer, an SSO proxy) has already authenticated the request. Gate trusts the header value as the principal. Only safe behind upstream authentication — the header is not a credential on its own. Attributes: auth_type: Discriminator for union type spinnaker_user: Email or principal sent in the X-SPINNAKER-USER header
          - `auth_type` 'spinnaker_user_header'
          - `spinnaker_user` string, required — Email or principal sent in the X-SPINNAKER-USER header
        - SpinnakerBasicAuth — Spinnaker HTTP basic authentication. Attributes: auth_type: Discriminator for union type username: Basic-auth username password: Basic-auth password
          - `auth_type` 'basic'
          - `username` string, required — Basic-auth username
          - `password` string, password, required — Basic-auth password
        - SpinnakerBearerAuth — Spinnaker static bearer token authentication. Attributes: auth_type: Discriminator for union type auth_token: Static bearer token sent as the Authorization header
          - `auth_type` 'bearer'
          - `auth_token` string, password, required — Static bearer token sent as Authorization header
      - `applications` string[], nullable — Optional list of Spinnaker application names to scope queries to
    - ArtifactoryIntegrationConfig — JFrog Artifactory container registry integration. Used primarily for querying Docker image tags and manifests to map container image digests back to git commit SHAs.
      - `type` 'artifactory'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `base_url` string, uri, required — Artifactory instance URL (e.g., https://artifactory.example.com)
      - `username` string, required — Username for authentication
      - `password` string, password, required — Password or API key for authentication
    - AwsCliIntegrationConfig — Customer AWS role Traversal can assume for terminal AWS CLI commands.
      - `type` 'aws_cli'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `account_id` string, required — 12-digit AWS account ID this integration represents.
      - `role_arn` string, required — Customer-owned IAM role ARN Traversal assumes for AWS CLI commands.
      - `external_id` string, password, required — External ID required by the customer's IAM role trust policy.
      - `region` string, required — AWS region used for STS and as the default AWS CLI region.
      - `session_duration_seconds` integer — Duration for short-lived AWS CLI credentials.
      - `session_name_prefix` string — Prefix used for STS role session names.
      - `allowed_domain_suffixes` string[] — Domain suffixes egress-proxy allows this session to dial directly. A bare suffix (no '*.' prefix) matches only that exact host, not its subdomains — see egress-proxy's matchesAnySuffix. Placeholder default, not a considered scoping policy — see egress_proxy_token_signing.EgressProxyTokenSigner.sign_for_domain_allowlist.
    - AmexWebexCaptionsIntegrationConfig — Amex Bridge Summarizer integration for retrieving Webex meeting captions. Authenticates via the Amex AuthBlue App2App client-credentials flow: ``username`` and ``password`` are HTTP-Basic-authed against ``authblue_signin_url`` (proxied through the org's relay) to mint a short-lived ``blueToken`` JWT. That token is sent as a Bearer header to ``bridge_captions_url`` to fetch caption records for a given bridge id and time window. Token minting goes through the shared ``basic_json_client_credentials`` client-credentials flow. App2App only accepts AD service accounts (e.g. ``svc.ai-ops``); real user LDAP creds are rejected. AuthBlue exposes different App2App hosts per environment (E1 dev, E2 qa, E3 prod), so the URL is configured per integration instance rather than hardcoded. Attributes: type: Integration type discriminator for union resolution. authblue_signin_url: AuthBlue App2App token endpoint that mints the ``blueToken`` (e.g. ``https://authbluetokens.aexp.com/v1/app2app/tokens`` for prod). Historical name kept for stored-config compatibility. bridge_captions_url: Bridge Summarizer endpoint that returns Webex caption records (e.g. ``https://bridgesummarization.aexp.com/get_webex_captions``). username: AD service account name (App2App rejects user LDAP creds). password: AuthBlue password for the service account.
      - `type` 'amex_webex_captions'
      - `enabled_data_types` IntegrationDataType[], required
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `authblue_signin_url` string, uri, required — AuthBlue App2App token endpoint that mints the blueToken (e.g. https://authbluetokens.aexp.com/v1/app2app/tokens for prod).
      - `bridge_captions_url` string, uri, required — Bridge Summarizer endpoint that returns Webex caption records (e.g. https://bridgesummarization.aexp.com/get_webex_captions).
      - `username` string, required — AD service account name (App2App rejects user LDAP creds).
      - `password` string, password, required — AuthBlue password for the service account.
    - DeptrackerIntegrationConfig — Configuration for a DigitalOcean deptracker REST endpoint. Attributes: type: Integration discriminator (always ``IntegrationType.DEPTRACKER``). enabled_data_types: Deptracker provides deployment events. server_url: Deptracker REST base URL (e.g. ``https://<traversal-domain>/dep-tracker``). The ``/api/v1/query`` path is appended by the client.
      - `type` 'deptracker'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required — Deptracker REST base URL
    - DoServiceCatalogIntegrationConfig — Configuration for DigitalOcean's internal Backstage-shaped catalog. Attributes: type: Integration discriminator (always ``IntegrationType.DO_SERVICE_CATALOG``). enabled_data_types: The catalog provides topology (service inventory + ``dependsOn`` edges + GitHub source links). server_url: Catalog base URL (e.g. ``https://servicecatalog.internal.digitalocean.com``). The client appends ``/entities`` for queries. auth_token: Bearer token presented in the ``Authorization`` header.
      - `type` 'do_service_catalog'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `server_url` string, uri, required — Service catalog base URL
      - `auth_token` string, password, required — Bearer token for the service catalog API
    - TraversalUserApiKeyIntegrationConfig — Container for Traversal API key configurations. Stores a list of API keys for an organization. Each organization can have multiple users with multiple keys each. Attributes: type: Integration type discriminator for union resolution. api_keys: List of Traversal API key configurations.
      - `type` 'traversal_api_key'
      - `enabled_data_types` IntegrationDataType[]
      - `relay_controller_proxy_url` string, uri, nullable
      - `network_access` string, nullable
      - `org_connector_id` string, nullable
      - `api_keys` TraversalUserApiKey[]
        - `id` string
        - `name` string, required
        - `user_id` string, required
        - `prefix` string, required
        - `hashed_secret` string, required
        - `created_at` string, date-time
  - `network_access` string, nullable — Name of the network this integration should connect through (e.g. an internal VPN). Omit or set to null to connect over the public internet.

## Response `201`

Successful Response

- IntegrationInstanceResponse — Metadata about a single integration instance. Credential fields are never included in this response. Use the integration-type-specific credential rotation endpoints to update secrets.
  - `id` string, required — Stable UUID for this integration instance. Use this in PUT /v3/integrations/{id} and DELETE /v3/integrations/{id}.
  - `organization_id` string, required — UUID of the organization that owns this integration instance.
  - `name` string, required — Human-readable display name set at creation time.
  - `description` string, nullable — Optional free-text description of this integration instance. Surfaced to Traversal's AI during investigations to help it understand when and how to use this integration.
  - `type` 'anthropic' | 'openai' | 'gradient_ai' | 'datadog' | 'elasticsearch' | 'prometheus' | 'mimir' | 'victoria_metrics' | 'grafana' | 'appdynamics' | 'servicenow' | 'github' | 'gitlab' | 'thousandeyes' | 'linear' | 'notion' | 'loki' | 'opensearch' | 'splunk' | 'gcp' | 'motherduck' | 'confluence' | 'coralogix' | 'firehydrant' | 'slack' | 'teams' | 'jira' | 'kubernetes' | 'traversal_webhook' | 'traversal_api_key' | 'incident_io' | 'sentry' | 'tempo' | 'alexandria' | 'honeycomb' | 'alertmanager' | 'emim' | 'trailblazer' | 'dynatrace' | 'cribl' | 'mcp' | 'aws_cli' | 'artifactory' | 'spinnaker' | 'amex_webex_captions' | 'deptracker' | 'do_service_catalog' | 'cloudwatch', required — Canonical integration platform types. Represents the platform or system where data originates from. Used to determine appropriate connectors, authentication, and API clients.
  - `third_party_id` string, nullable — Optional opaque identifier from the third-party system (e.g. a Log Store instance ID). Populated automatically from the integration payload when present.
  - `enabled_data_types` string[], required — List of data-type capabilities enabled for this integration (e.g. ``["logs", "metrics"]``). Controlled by the integration payload.
  - `metadata` object — Non-secret integration-specific metadata stored with this instance.
  - `created_at` string, date-time, nullable — ISO-8601 timestamp of when this integration instance was created.
  - `updated_at` string, date-time, nullable — ISO-8601 timestamp of the most recent update to this instance.
  - `created_by` string, nullable — UUID of the user who created this integration instance, if known.
  - `last_health_check` HealthCheckResponse — Aggregate result of an integration's connection health check.
    - `status` 'pending' | 'connected' | 'partial' | 'failed', required — Overall status of a connection health check.
    - `steps` HealthCheckStepResponse[], required
      - `step` 'connectivity' | 'auth' | 'query', required — Identifies which health check step a result is for.
      - `passed` boolean, required
      - `message` string, required
      - `details` object
    - `checked_at` string, date-time, required
  - `network_access` string, nullable — Name of the network this integration connects through (e.g. an internal VPN). Null when the integration connects over the public internet.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)