Saved connectors

There are three separate configuration surfaces: saved connectors described here, cloud account setup, and each workflow node's configuration. A saved connector is not itself a running integration. The current runtime does not automatically resolve a saved connector ID into credentials for a node; configure the node's documented fields or environment credentials before running it.

Create a saved connector

1. Obtain credentials with the permissions required for your intended provider operation.
2. Open Integrations, choose the provider, and give the connection a useful name.
3. Enter provider settings and credentials, then save.
4. For OpenAI or Anthropic, run Test connection. For other types, test the actual node or client in a development flow; a saved record does not verify access.

API requests require authentication: connectors.read for reads, connectors.write for creation, updates, and tests, and connectors.delete for deletion.

curl --fail-with-body "$DAGY_API_URL/connectors/" \
  -H "Authorization: Bearer $DAGY_TOKEN" \
  -H 'Content-Type: application/json' \
  --data @connector.json

Example connector.json structure; replace the placeholder locally and keep the file out of source control:

{
  "name": "Document classification",
  "connector_type_id": "openai",
  "config": {"apiKey":"YOUR_PROVIDER_KEY","baseUrl":"https://api.openai.com/v1"},
  "enabled": true
}

The response is 201 with a connector_id, public config, configured_secret_fields, enabled, last_test_status, and timestamps. Secret values are excluded; for this example configured_secret_fields contains apiKey.

Configuration reference

Field names are case-sensitive. The following are the fields used by the integration forms. Use only the designated credential fields for secrets: arbitrary extra configuration keys are returned as ordinary configuration.

The API validates the connector type and name but does not comprehensively validate all provider fields at save time. Saving a connector successfully does not prove that its credentials, model name, or target resource will work.

The slack, smtp, and webhook records above are distinct from the notification channels used by run alert rules. To receive run alerts, create a notification channel and an alert rule.

Test an LLM provider connection

curl --fail-with-body -X POST \
  "$DAGY_API_URL/connectors/$CONNECTOR_ID/test" \
  -H "Authorization: Bearer $DAGY_TOKEN"

A successful result is:

{"status":"success","message":"OpenAI connection verified","tested_at":"2026-09-06T10:00:00+00:00"}

Only OpenAI and Anthropic currently support this API test. It requests the provider's model list; it does not execute an inference or prove access to every model. Both require apiKey. Optional baseUrl defaults to the corresponding provider endpoint. Custom URLs must use HTTPS and resolve to public addresses; redirects are rejected. The request timeout is 10 seconds.

Other types return 400 with a message that live connection testing is unavailable. This result does not mean the provider itself is unsupported by a workflow node.

Update or rotate credentials

Use PUT /connectors/{id} with name, config, or enabled:

{
  "config": {"apiKey":"YOUR_REPLACEMENT_KEY","baseUrl":"https://api.openai.com/v1"}
}

When sending config, include all public settings you want to keep: the public configuration is replaced. Existing credential values are retained if their field is omitted, null, or empty. Nonempty credential values replace previous values. There is no separate clear-credential operation; delete and recreate the connector when removal is required. The connector type cannot be changed.

Retest after rotation. enabled:false changes the saved record; it does not revoke a credential with its provider. Revoke compromised credentials at the provider as well.

Discover S3 buckets

The S3 connector form can discover bucket names using credentials you supply. The API operation requires connectors.read:

POST /connectors/discover/s3-buckets
Content-Type: application/json
Authorization: Bearer YOUR_DAGY_TOKEN

{
  "region": "us-east-1",
  "access_key_id": "YOUR_ACCESS_KEY",
  "secret_access_key": "YOUR_SECRET_KEY"
}

These discovery field names use snake case and differ from saved connector fields. Optional role_arn assumes a role first; no session-token request field is supported. Credentials are used for this request and are not saved as a connector. The response contains buckets: [{"name":"example-data","creation_date":"..."}]. The provider principal needs permission to list buckets.

List and remove connectors

GET /connectors/ returns {"connectors":[...]} and accepts connector_type_id and enabled filters. GET /connectors/{id} returns one safe record. DELETE /connectors/{id} removes the record and returns 200 with a null body. The collection's canonical URL has a trailing slash.

Troubleshoot

Before production, verify actual data reads/writes in a development environment, configure timeouts and retries for provider calls, and keep secrets in environment secrets when your execution path requires them.