> ## Documentation Index > Fetch the complete documentation index at: https://docs.getsales.io/llms.txt > Use this file to discover all available pages before exploring further. # Complete provider OAuth connect > Leg 2: exchange the relayed authorization code and land the HubSpot connection. Upserts by portal (team, provider, external_account_id): re-consenting a portal already held rotates that row in place (result.reconnected true; same sid, the counter cleared, a failed row revived) instead of colliding with the name guard; a new portal is created (result.created true). The state is checked against the caller's team and spent once (422 oauth_state_invalid, _replayed, _expired, _team_mismatch); a refused code is 422 oauth_exchange_failed; a provider that gave no answer is 409 oauth_exchange_unconfirmed: start the connect again. The grant itself never appears in any response. Contract: - MCP tool `complete_provider_connection_oauth`, registry package `mcp.integrations/provider_connections`, mount `integrations.providers`. - Operation `action`, response envelope `action`. - Flags: none. ## OpenAPI ````yaml /api-reference/integrations/openapi.yaml post /api/provider-connections/oauth/complete openapi: 3.0.3 info: title: 'GetSales public contract: gs.service.integrations' description: >- The integrations service: the integration platform (the team's credentials for its own APIs and its CRM grants, the HTTP tools it defines over them, the execution log and the priced catalog of every outbound provider call) and the event plane (the platform-wide webhook subscriptions and the delivery state of each event). GENERATED. This document is projected from the Zod MCP tool registry in `product/mcp/gs.mcp` (one tool per public endpoint, 1:1). Do not edit it by hand; edit the tool definition and regenerate with `pnpm openapi:public`. Surface: the public `/api` contract of `gs.service.integrations`, 26 operations. This is the only OpenAPI document the platform publishes. Internal (`/internal`) and health endpoints are deliberately absent: they are not part of any contract, they can change without notice, and the service source is their only description. Conventions: - Auth is a bearer JWT, optionally narrowed by the `Team-SID` header. - Every success body is an MCP envelope: `success: true` plus one typed `operation` shape (`search`, `get`, `create`, `update`, `delete`, `metrics`, `group_by`, `action`), and a `meta` block with `trace_id` for support. - Every failure is the same `McpError` envelope with a code from a fixed 16-code taxonomy, so a client maps errors once. - Lists page with `page_size` (0 to 500, default 50) plus an opaque forward `cursor`; `page_size: 0` returns counts only. - On `GET` and `DELETE`, object-valued query parameters (`filter`, `sort`) travel as JSON text and array-valued ones repeat as `name[]=value`. - The MCP-only `_meta` field (usage analytics) never reaches the backend and is not part of this contract. version: '1.0' contact: name: GetSales url: https://getsales.io email: support@getsales.io license: name: Proprietary url: https://getsales.io/terms servers: - url: https://beta.getsales.io/integrations/v1 description: >- Production (the gateway path on the beta ring; the origin is provisioned per DEPLOY_MAP.md) security: - BearerJwt: [] TeamSid: [] tags: - name: custom_tools description: >- Registry package `mcp.integrations/custom_tools`, served on MCP mount `integrations.providers`. - name: provider_calls description: >- Registry package `mcp.integrations/provider_calls`, served on MCP mount `integrations.providers`. - name: provider_connections description: >- Registry package `mcp.integrations/provider_connections`, served on MCP mount `integrations.providers`. - name: webhook_logs description: >- Registry package `mcp.integrations/webhook_logs`, served on MCP mount `integrations.webhooks`. - name: webhooks description: >- Registry package `mcp.integrations/webhooks`, served on MCP mount `integrations.webhooks`. paths: /api/provider-connections/oauth/complete: post: tags: - provider_connections summary: Complete provider OAuth connect description: >- Leg 2: exchange the relayed authorization code and land the HubSpot connection. Upserts by portal (team, provider, external_account_id): re-consenting a portal already held rotates that row in place (result.reconnected true; same sid, the counter cleared, a failed row revived) instead of colliding with the name guard; a new portal is created (result.created true). The state is checked against the caller's team and spent once (422 oauth_state_invalid, _replayed, _expired, _team_mismatch); a refused code is 422 oauth_exchange_failed; a provider that gave no answer is 409 oauth_exchange_unconfirmed: start the connect again. The grant itself never appears in any response. Contract: - MCP tool `complete_provider_connection_oauth`, registry package `mcp.integrations/provider_connections`, mount `integrations.providers`. - Operation `action`, response envelope `action`. - Flags: none. operationId: complete_provider_connection_oauth requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CompleteProviderConnectionOauthRequest' responses: '200': description: '`action` success envelope.' content: application/json: schema: $ref: '#/components/schemas/CompleteProviderConnectionOauthResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' components: schemas: CompleteProviderConnectionOauthRequest: type: object description: Request body of `complete_provider_connection_oauth`. properties: provider: type: string enum: - hubspot description: hubspot. authorization_code: type: string minLength: 1 maxLength: 2048 description: The code the provider redirect carried. state: type: string minLength: 1 maxLength: 8192 description: The state from start_provider_connection_oauth. required: - provider - authorization_code - state CompleteProviderConnectionOauthResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string description: kebab-case verb; matches the route segment. item: type: object nullable: true properties: sid: type: string description: Connection sid (in_cn_...). team_sid: type: string description: The owning workspace (ts_tm_...). name: type: string description: Display name, unique within the team among live rows. provider: type: string enum: - openai - anthropic - google - deepseek - xai - voyage - cohere - hunter - findymail - anymailfinder - emaillistverify - custom - hubspot - serper description: custom (the team's own API) or hubspot (a CRM grant); immutable. auth_type: type: string enum: - api_key - bearer - basic - header - query - oauth description: The shape of the stored secret; oauth on a HubSpot grant. external_account_id: type: string nullable: true description: >- The provider-side account of an OAuth grant (the HubSpot portal id): the reconnect key; null on key auth. status: type: string enum: - 'on' - 'off' - failed description: >- on; off (paused by hand); failed (auto-disabled after five auth failures in a row, revived by update or a reconnect). consecutive_failed_attempts: type: integer description: >- Auth-classified failures in a row; any non-cache success or a rotation resets it. last_failure_at: type: string nullable: true description: ISO 8601 UTC of the last auth failure. created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string nullable: true team_sid: type: string actor_name: type: string nullable: true description: >- The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: string nullable: true description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: string nullable: true description: >- Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: >- Internal audit context: the grant set the actor held at write time. Not a contract. cluster_id: type: integer nullable: true description: 'Internal audit context: the cluster that served the write.' trace_id: type: string nullable: true description: >- Internal audit context: the trace id of the request that wrote the row. required: - actor_type - actor_sid - team_sid - permissions description: Who stored it. deleted_by: type: object nullable: true properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: string nullable: true team_sid: type: string actor_name: type: string nullable: true description: >- The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: string nullable: true description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: string nullable: true description: >- Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: >- Internal audit context: the grant set the actor held at write time. Not a contract. cluster_id: type: integer nullable: true description: 'Internal audit context: the cluster that served the write.' trace_id: type: string nullable: true description: >- Internal audit context: the trace id of the request that wrote the row. required: - actor_type - actor_sid - team_sid - permissions description: Who deleted it; null while live. created_at: type: string description: ISO 8601 UTC. updated_at: type: string description: ISO 8601 UTC. deleted_at: type: string nullable: true description: ISO 8601 UTC; the secret is scrubbed with it. required: - sid - team_sid - name - provider - auth_type - external_account_id - status - consecutive_failed_attempts - last_failure_at - created_by - deleted_by - created_at - updated_at - deleted_at result: type: object properties: created: type: boolean description: >- true = a new connection; false = an existing portal connection was rotated. reconnected: type: boolean description: The opposite of created. external_account_id: type: string nullable: true description: The portal this grant belongs to. required: - created - reconnected - external_account_id meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: string nullable: true description: >- The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: string nullable: true description: >- user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - item - result - meta McpError: type: object properties: success: type: boolean enum: - false error: type: object properties: code: type: string enum: - validation_failed - nothing_to_update - not_found - relation_not_found - invalid_transition - limit_exceeded - payment_required - duplicate_rejected - conflict - delete_blocked - unauthorized - forbidden - rate_limited - internal_error - service_unavailable - not_implemented message: type: string recoverable: type: boolean suggestion: type: string field_errors: type: object additionalProperties: type: array items: type: object properties: rule: type: string message: type: string required: - rule - message blockers: type: array items: type: object properties: type: type: string description: >- Machine-readable blocker type (active_flow, pending_tasks, …). severity: type: string enum: - hard - soft description: >- hard = external action required; soft = acknowledge is enough. description: type: string entity_sid: type: string nullable: true count: type: integer resolution: type: string description: 'Hard: tool name to call. Soft: code for acknowledge[].' resolution_hint: type: string required: - type - severity - description - entity_sid - resolution - resolution_hint context: type: object additionalProperties: {} required: - code - message - recoverable meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: string nullable: true description: >- The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: string nullable: true description: >- user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - error responses: McpClientError: description: >- MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. content: application/json: schema: $ref: '#/components/schemas/McpError' McpServerError: description: >- MCP error envelope with `error.code` internal_error or service_unavailable. content: application/json: schema: $ref: '#/components/schemas/McpError' securitySchemes: BearerJwt: type: http scheme: bearer bearerFormat: JWT description: >- Access token issued by gs.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative. TeamSid: type: apiKey in: header name: Team-SID description: >- Team scope for tokens that do not carry one. Ignored when the token already names a team. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.