connectorAuthorization

What it does

Review an AI-assistant sign-in request (Claude, ChatGPT, …) — who is asking, where the sign-in code would be sent, and which of your organizations it could act in.

Validate + resolve ONE connector authorize request for the consent face: the client's words + the redirect host + YOUR eligible orgs. EVERY invalid request refuses typed (the face SHOWS the error and never redirects — the open-redirect law). Any ACTIVE member of an organization consents to their own assistant (the eligible organizations are those where they hold a role; an owner's every active organization); a person with no role anywhere is refused. Template class SELF.

What happens

Read-only; mints nothing. The organizations offered are those where you hold a role (every active organization you own, for an owner). An invalid or unknown request shows the error here and never redirects anywhere.

Careful

Your own consent — any active member of an organization may connect their own assistant; a person with no role anywhere is refused.

Who may call it

Capability area: Your own session — What every signed-in person may do for themselves — their session, their profile and their own work.

Owner
System Administrator
Manager
Associate Manager
Warehouse Associate
Sales Associate
Cashier
An API key whose scope allows api:connectorAuthorization

Arguments

Name	Type	Required	Notes
`responseType`	String `String!`	yes	No further notes.
`clientId`	String `String!`	yes	No further notes.
`redirectUri`	String `String!`	yes	No further notes.
`codeChallenge`	String `String!`	yes	No further notes.
`codeChallengeMethod`	String `String!`	yes	No further notes.
`state`	String	no	No further notes.
`scope`	String	no	No further notes.
`resource`	String	no	No further notes.

Returns

ConnectorAuthorizationReview ConnectorAuthorizationReview! — A VALIDATED connector authorize request, resolved for the consent face: the client's words + the redirect host PROMINENT (the consent MUST) + the RFC 8252 loopback flag + the scope story + YOUR eligible orgs. An invalid request REFUSES typed and the face shows the error — the wire never builds a redirect from an unvalidated request (the open-redirect law).

Example request

query ExampleConnectorAuthorization($responseType: String!, $clientId: String!, $redirectUri: String!, $codeChallenge: String!, $codeChallengeMethod: String!, $state: String) {
  connectorAuthorization(responseType: $responseType, clientId: $clientId, redirectUri: $redirectUri, codeChallenge: $codeChallenge, codeChallengeMethod: $codeChallengeMethod, state: $state) {
    clientId
    clientName
    clientSource
    redirectUri
    redirectHost
    loopback
    scope
    offlineAccess
    changesHint
    resource
  }
}

Variables:

{
  "responseType": "<response type>",
  "clientId": "<client id>",
  "redirectUri": "<redirect uri>",
  "codeChallenge": "<code challenge>",
  "codeChallengeMethod": "<code challenge method>",
  "state": "<state>"
}

Example response

{
  "data": {
    "connectorAuthorization": {
      "clientId": "<client id>",
      "clientName": "Blue jeans",
      "clientSource": "<client source>",
      "redirectUri": "<redirect uri>",
      "redirectHost": "<redirect host>",
      "loopback": true,
      "scope": "<scope>",
      "offlineAccess": true,
      "changesHint": true,
      "resource": "<resource>"
    }
  },
  "extensions": {
    "at": {
      "callId": "01EXAMPLE-CALL-ID",
      "version": {
        "requested": null,
        "serviced": {
          "name": "genesis",
          "number": 0
        }
      }
    }
  }
}

Errors this call can answer

VALIDATION/INVALID — Something in the request is not valid. (VALIDATION)
AUTHN/REQUIRED — Sign in to do this. (AUTHN)
AUTHZ/FORBIDDEN — Your role does not allow this action. (AUTHZ)
RATE_LIMIT/THROTTLED — Too many requests in a short time. (RATE_LIMIT)

Used in

Connect your AI assistant