> ## Documentation Index > Fetch the complete documentation index at: https://docs.getsales.io/llms.txt > Use this file to discover all available pages before exploring further. # Start provider OAuth connect > Leg 1 of connecting HubSpot: mint the consent URL to open in a browser and a signed state (15 minutes, single-use). Nothing is written: a connection exists only once a grant does. The browser lands in the app, which relays the code and the state to complete_provider_connection_oauth. 422 oauth_app_not_configured on a plane without the HubSpot app. Contract: - MCP tool `start_provider_connection_oauth`, registry package `mcp.integrations/provider_connections`, mount `integrations.providers`. - Operation `action`, response envelope `action`. - Flags: none. ## OpenAPI ````yaml /api-reference/integrations/openapi.yaml post /api/provider-connections/oauth/authorize openapi: 3.0.3 info: title: 'GetSales public contract: gs.service.integrations' description: >- The integrations service: the integration platform (the team's credentials for its own APIs and its CRM grants, the HTTP tools it defines over them, the execution log and the priced catalog of every outbound provider call) and the event plane (the platform-wide webhook subscriptions and the delivery state of each event). GENERATED. This document is projected from the Zod MCP tool registry in `product/mcp/gs.mcp` (one tool per public endpoint, 1:1). Do not edit it by hand; edit the tool definition and regenerate with `pnpm openapi:public`. Surface: the public `/api` contract of `gs.service.integrations`, 26 operations. This is the only OpenAPI document the platform publishes. Internal (`/internal`) and health endpoints are deliberately absent: they are not part of any contract, they can change without notice, and the service source is their only description. Conventions: - Auth is a bearer JWT, optionally narrowed by the `Team-SID` header. - Every success body is an MCP envelope: `success: true` plus one typed `operation` shape (`search`, `get`, `create`, `update`, `delete`, `metrics`, `group_by`, `action`), and a `meta` block with `trace_id` for support. - Every failure is the same `McpError` envelope with a code from a fixed 16-code taxonomy, so a client maps errors once. - Lists page with `page_size` (0 to 500, default 50) plus an opaque forward `cursor`; `page_size: 0` returns counts only. - On `GET` and `DELETE`, object-valued query parameters (`filter`, `sort`) travel as JSON text and array-valued ones repeat as `name[]=value`. - The MCP-only `_meta` field (usage analytics) never reaches the backend and is not part of this contract. version: '1.0' contact: name: GetSales url: https://getsales.io email: support@getsales.io license: name: Proprietary url: https://getsales.io/terms servers: - url: https://beta.getsales.io/integrations/v1 description: >- Production (the gateway path on the beta ring; the origin is provisioned per DEPLOY_MAP.md) security: - BearerJwt: [] TeamSid: [] tags: - name: custom_tools description: >- Registry package `mcp.integrations/custom_tools`, served on MCP mount `integrations.providers`. - name: provider_calls description: >- Registry package `mcp.integrations/provider_calls`, served on MCP mount `integrations.providers`. - name: provider_connections description: >- Registry package `mcp.integrations/provider_connections`, served on MCP mount `integrations.providers`. - name: webhook_logs description: >- Registry package `mcp.integrations/webhook_logs`, served on MCP mount `integrations.webhooks`. - name: webhooks description: >- Registry package `mcp.integrations/webhooks`, served on MCP mount `integrations.webhooks`. paths: /api/provider-connections/oauth/authorize: post: tags: - provider_connections summary: Start provider OAuth connect description: >- Leg 1 of connecting HubSpot: mint the consent URL to open in a browser and a signed state (15 minutes, single-use). Nothing is written: a connection exists only once a grant does. The browser lands in the app, which relays the code and the state to complete_provider_connection_oauth. 422 oauth_app_not_configured on a plane without the HubSpot app. Contract: - MCP tool `start_provider_connection_oauth`, registry package `mcp.integrations/provider_connections`, mount `integrations.providers`. - Operation `action`, response envelope `action`. - Flags: none. operationId: start_provider_connection_oauth requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/StartProviderConnectionOauthRequest' responses: '200': description: '`action` success envelope.' content: application/json: schema: $ref: '#/components/schemas/StartProviderConnectionOauthResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' components: schemas: StartProviderConnectionOauthRequest: type: object description: Request body of `start_provider_connection_oauth`. properties: provider: type: string enum: - hubspot description: hubspot. required: - provider StartProviderConnectionOauthResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string description: kebab-case verb; matches the route segment. item: {} result: type: object properties: authorize_url: type: string description: The provider's consent screen, state embedded. state: type: string description: Hand it back verbatim at completion. expires_at: type: string description: ISO 8601 UTC when the leg lapses. required: - authorize_url - state - expires_at meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: string nullable: true description: >- The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: string nullable: true description: >- user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - item - result - meta McpError: type: object properties: success: type: boolean enum: - false error: type: object properties: code: type: string enum: - validation_failed - nothing_to_update - not_found - relation_not_found - invalid_transition - limit_exceeded - payment_required - duplicate_rejected - conflict - delete_blocked - unauthorized - forbidden - rate_limited - internal_error - service_unavailable - not_implemented message: type: string recoverable: type: boolean suggestion: type: string field_errors: type: object additionalProperties: type: array items: type: object properties: rule: type: string message: type: string required: - rule - message blockers: type: array items: type: object properties: type: type: string description: >- Machine-readable blocker type (active_flow, pending_tasks, …). severity: type: string enum: - hard - soft description: >- hard = external action required; soft = acknowledge is enough. description: type: string entity_sid: type: string nullable: true count: type: integer resolution: type: string description: 'Hard: tool name to call. Soft: code for acknowledge[].' resolution_hint: type: string required: - type - severity - description - entity_sid - resolution - resolution_hint context: type: object additionalProperties: {} required: - code - message - recoverable meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: string nullable: true description: >- The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: string nullable: true description: >- user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - error responses: McpClientError: description: >- MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. content: application/json: schema: $ref: '#/components/schemas/McpError' McpServerError: description: >- MCP error envelope with `error.code` internal_error or service_unavailable. content: application/json: schema: $ref: '#/components/schemas/McpError' securitySchemes: BearerJwt: type: http scheme: bearer bearerFormat: JWT description: >- Access token issued by gs.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative. TeamSid: type: apiKey in: header name: Team-SID description: >- Team scope for tokens that do not carry one. Ignored when the token already names a team. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.