Connections

#What a connection is

By default, a run's output is just a downloadable artifact (GET /v1/runs/:id/artifacts/:artifactId). A connection is a workspace-configured delivery target the save_output tool can also deliver to — email, an outgoing webhook, or S3-compatible object storage:

Provider	Status
`email`	Available
`webhook`	Available
`s3`	Available — any S3-compatible endpoint (AWS S3, Cloudflare R2, MinIO, ...)
`gdrive`	Not yet implemented — `501`
`sharepoint`	Not yet implemented — `501`

#Creating one

bash

curl -X POST "https://api.agentflowbind.com/v1/connections" \
  -H "Authorization: Bearer afb_live_xxxxxxxxxxxx" -H "Content-Type: application/json" \
  -d '{
    "provider": "s3",
    "name": "Finance archive bucket",
    "config": {
      "endpoint": "https://s3.eu-central-1.amazonaws.com",
      "bucket": "afb-finance-archive",
      "region": "eu-central-1",
      "accessKeyId": "AKIA...",
      "secretAccessKey": "..."
    }
  }'

json

{
  "id": "7d2e9f10-...",
  "provider": "s3",
  "name": "Finance archive bucket",
  "status": "active",
  "metadata": { "endpoint": "https://s3.eu-central-1.amazonaws.com", "bucket": "afb-finance-archive", "region": "eu-central-1" },
  "createdAt": "2026-03-14T09:00:00.000Z",
  "updatedAt": "2026-03-14T09:00:00.000Z"
}

Secret fields (accessKeyId/secretAccessKey for s3, a webhook's signing secret, ...) are split out and sealed at rest — they never come back in a GET/POST response, only the non-secret metadata. Trying gdrive/sharepoint today returns:

json

{ "error": { "code": "storage.not_implemented", "message": "coming_soon" } }

at 501.

#Testing a connection

POST /v1/connections/:id/test performs a non-destructive connectivity/credential check (e.g. an S3 HeadBucket, or verifying an email sender is configured) without writing anything:

bash

curl -X POST "https://api.agentflowbind.com/v1/connections/7d2e9f10-.../test" -H "Authorization: Bearer afb_live_xxxxxxxxxxxx"

#Using a connection from a run

Pass the connection's id as input.fields.saveTarget when creating a run; every document preset's save_output tool step reads it and delivers there in addition to writing the run's own output artifact:

bash

curl -X POST "https://api.agentflowbind.com/v1/runs" \
  -H "Authorization: Bearer afb_live_xxxxxxxxxxxx" -H "Content-Type: application/json" \
  -d '{
    "agentId": "3c1a9e40-...-77bd",
    "input": { "fileIds": ["b4a0c9e1-...-1f0a"], "fields": { "saveTarget": "7d2e9f10-..." } }
  }'

GET /v1/runs/:id/steps?include=io shows where save_output actually delivered to, in that step's output.

#Listing and removing

bash

curl "https://api.agentflowbind.com/v1/connections" -H "Authorization: Bearer afb_live_xxxxxxxxxxxx"
curl -X DELETE "https://api.agentflowbind.com/v1/connections/7d2e9f10-..." -H "Authorization: Bearer afb_live_xxxxxxxxxxxx"

DELETE returns 204; both endpoints currently share the webhooks:manage scope with run-event webhook subscriptions — an unrelated but coincidentally similarly-named concept — pending a dedicated connections:manage scope.