# Create Integration Creates an Integration object belonging to the Account matching {accountId}. Configures the Integration with the Provider specified in the request. Returns an Integration token for use with Integration APIs. Operation ID: integrations_create Endpoint: POST /v1/integrations/{accountId} Security: BearerAuth ## Path parameters: - `accountId` (string, required) ## Request fields (application/json): - `provider_config` (any, required) - `name` (string,null) Unique short name for this Integrations (lowercase [a-z0-9_-], can be used in URLs). Also used for case insensitive duplicate name detection and default sort order. Defaults to IntegrationId if both name and fullname are not specified. - `fullname` (string,null) Human friendly display name for this Integrations, will auto-generate 'name' field (if 'name' is not specified). Defaults to the same value as the 'name' field if not specified. - `integration_point_id` (string) - `bridge_selector` (any) - `webhook_config` (object) - `webhook_config.items` (array, required) List of webhooks for an integration. If the provider supports webhooks, they will be sent to the servers provided in this list. - `webhook_config.items.webhook_url` (string, required) Webhook URL. Events from providers will be sent to this URL. - `webhook_config.items.event_filter` (array,null) If specified, only events matching this list will be sent to webhook_url. If no filters are specified, all events sent from providers will be forwarded to webhook_url. Enum: "TicketCreated", "TicketUpdated", "TicketDeleted", "TicketCommentCreated", "TicketCommentDeleted" - `webhook_config.items.integrator_key` (string,null) The key used to sign outgoing web hook payloads. If not specified a random key is automatically generated. Use this key at the target URL to validate that the incoming payload was signed by Synqly. The payload is signed symmetrically with the integrator_key using the HMAC-SHA256 signature scheme. The key should be randomly generated and between 24 bytes (192 bits) and 64 bytes (512 bits) long. - `webhook_config.provider_key` (string,null) The key used by Synqly to verify incoming webhook payloads sent by the Provider. The format and requirements for this key is Provider specific: - ServiceNow: Webhook payload signing is not currently supported, so the integrity of incoming ServiceNow payloads cannot be verified. - Jira: Synqly does _not_ automatically configure Jira webhooks. A user with administrator privileges must configure the webhook, including the signing key. If this key is not specified, Synqly will _not_ validate incoming webhooks from Jira. It is strongly recommended that a key is specified and configured with Jira to ensure the integrity of incoming payloads. - `mappings` (array,null) A list of mapping chains to apply to the integration. Each mapping chain is a list of mappings to apply to the integration in the order they should be applied. Mappings are applied by operation ID. Leave this empty to use the default default mappings. - `mappings.mappings` (array, required) A list of mapping IDs to apply in the format {mapping_id}:{version}. - `mappings.operation_ids` (array, required) The operation IDs to apply the mappings to. - `additional_mappings` (array,null) Additional data mappings for this integration. This allows for custom data to be mapped to the custom_fields portion of the response. - `additional_mappings.resource` (string, required) Enum: "alerts", "applications", "audit_logs", "comments", "devices", "events", "evidence", "findings", "groups", "investigations", "iocs", "log_providers", "posture_scores", "projects", "scans", "scan_activities", "threats", "tickets", "users", "compliance", "cloudresourceinventory" - `additional_mappings.actions` (array, required) The actions that this mapping applies to. At least one action must be specified. Enum: "query", "read", "create", "update", "delete", "patch" - `additional_mappings.source` (string, required) The dot-separated path to the field in the source data coming from the provider. Use \. to escape literal dots in the field name. - `additional_mappings.destination` (string, required) The dot-separated path to where the data should reside in the custom fields object when data is returned from the provider. - `additional_mappings.data_type` (string, required) Enum: "string", "number", "datetime", "boolean", "array", "any" - `additional_mappings.literal` (boolean,null) When true, the value in 'source' is treated as a literal value rather than a mapping. This allows adding static values to custom fields. Default: false - `scheduled_operations` (array,null) Scheduled operations owned by this integration. During creation, a non-empty list is used as supplied; otherwise, the integration point's current scheduled_operations template is copied onto the integration, if present. The stored list is an independent snapshot: later changes to the integration point never affect it. Clearing this field from an existing integration removes its schedules and does not restore the integration point template. The integration does not require an integration point for these schedules to run. - `scheduled_operations.operation` (string, required) Enum: "assets_query_devices", "assets_query_alerts", "assets_query_utilization", "assets_query_vulnerabilities", "cloudsecurity_query_cloud_resource_inventory", "cloudsecurity_query_compliance_findings", "cloudsecurity_query_events", "cloudsecurity_query_ioms", "cloudsecurity_query_threats", "edr_query_alerts", "edr_query_applications", "edr_query_endpoints", "edr_query_iocs", "edr_query_posture_score", "edr_query_threatevents", "emailsecurity_query_threats", "emailsecurity_query_email_events", "endpointmanagement_query_devices", "endpointmanagement_query_compliance_findings", "identity_query_audit_log", "identity_query_groups", "identity_query_groups_enriched", "identity_query_users", "identity_query_users_enriched", "siem_query_events", "siem_query_investigations", "vulnerabilities_query_assets", "vulnerabilities_query_findings", "vulnerabilities_query_scans", "appsec_query_findings" - `scheduled_operations.enabled` (boolean, required) Whether the schedule is active. When false, no executions will occur. - `scheduled_operations.frequency` (any, required) - `scheduled_operations.filters` (array,null) Optional filters to apply when querying data from the source API. Format and available filters depend on the specific operation. Example: "severity[eq]critical" or "status[eq]active". - `scheduled_operations.backfill_from_time` (string,null) Starting point for the initial data collection. No data before this time will be fetched. Accepts: - RFC 3339 datetime: "2024-01-01T00:00:00Z" - Relative duration: "7d" (7 days ago), "24h" (24 hours ago), "30m" (30 minutes ago) - "max": the maximum one-year backfill window, resolved relative to operation creation The resolved starting point may be at most 1 year in the past; deeper backfills are rejected. If not specified, starts from the operation's creation time. - `scheduled_operations.incremental_config` (object) Controls how data is fetched from the source API on each execution. - `scheduled_operations.incremental_config.mode` (string, required) Strategy for fetching data from the source API. Enum: "incremental", "full_snapshot" - `scheduled_operations.incremental_config.time_filter_field` (string,null) Custom field to use for time-based filtering in incremental mode. Overrides the operation's default time filter field. Examples: "modified_time" or "finding.last_seen_time". The comparison operator is operation-specific: "[gt]" (greater than) by default, or "[gte]" (greater than or equal) for operations whose providers only accept inclusive range bounds — in which case the boundary record is re-fetched on each run. First run will use initial_backfill_start_time as the filter value, and subsequent runs use the last execution time. ## Response 200 fields (application/json): - `result` (object, required) - `result.integration` (object, required) Connects an Account to an external service - `result.integration.id` (string, required) - `result.integration.fullname` (string, required) Human friendly display name for this integration. - `result.integration.refresh_token_id` (string, required) - `result.integration.account_id` (string, required) - `result.integration.category` (string, required) Id of the Integrations category Enum: "appsec", "assets", "chat", "cloudsecurity", "custom", "edr", "emailsecurity", "endpointmanagement", "identity", "incidentresponse", "networksecurity", "notifications", "siem", "sink", "storage", "ticketing", "vulnerabilities" - `result.integration.provider_config` (any, required) - `result.integration.provider_fullname` (string, required) Human friendly display name for the provider. - `result.integration.provider_type` (string, required) Type of the provider for this Integration. - `result.integration.name` (string, required) Human-readable name for this resource - `result.integration.created_at` (string, required) Time object was originally created - `result.integration.updated_at` (string, required) Last time object was updated - `result.integration.account` (object) - `result.integration.account.id` (string, required) - `result.integration.account.fullname` (string, required) Human friendly display name for this account. - `result.integration.account.organization_id` (string, required) - `result.integration.account.environment` (string, required) Enum: "test", "prod" - `result.integration.account.name` (string, required) Human-readable name for this resource - `result.integration.account.created_at` (string, required) Time object was originally created - `result.integration.account.updated_at` (string, required) Last time object was updated - `result.integration.account.labels` (array,null) User defined labels that apply to this account. These values can be used in role bindings to limit the scope of permissions. - `result.integration.integration_point_id` (string) - `result.integration.integration_point` (object) Enables creation, editing and deletion of Integrations. - `result.integration.integration_point.id` (string, required) - `result.integration.integration_point.connector` (string, required) Id of the Integrations category Enum: "appsec", "assets", "chat", "cloudsecurity", "custom", "edr", "emailsecurity", "endpointmanagement", "identity", "incidentresponse", "networksecurity", "notifications", "siem", "sink", "storage", "ticketing", "vulnerabilities" - `result.integration.integration_point.environments` (object, required) - `result.integration.integration_point.environments.test` (array,null) List of allowed providers for test environment. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_sonarqube_server", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_jupiterone", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "endpointmanagement_ninjaone", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_github", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "networksecurity_aws", "networksecurity_azure", "networksecurity_google", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_bmchelix", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_xurrent", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_defender_easm", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_pentera", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "vulnerabilities_wiz", "*" - `result.integration.integration_point.environments.prod` (array,null) List of allowed providers for production environment. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_sonarqube_server", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_jupiterone", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "endpointmanagement_ninjaone", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_github", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "networksecurity_aws", "networksecurity_azure", "networksecurity_google", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_bmchelix", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_xurrent", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_defender_easm", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_pentera", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "vulnerabilities_wiz", "*" - `result.integration.integration_point.name` (string, required) Human-readable name for this resource - `result.integration.integration_point.created_at` (string, required) Time object was originally created - `result.integration.integration_point.updated_at` (string, required) Last time object was updated - `result.integration.integration_point.fullname` (string,null) Name of integration point, will be shown to end-users in the Connect UI. - `result.integration.integration_point.description` (string,null) Optional description of the Integration Point. Will not be displayed to end-users of Connect UI. - `result.integration.integration_point.mappings` (array,null) A list of mapping chains to apply to integrations using this integration point. Each mapping chain is a list of mappings to apply to the integration in the order they should be applied. Mappings are applied by operation ID. If an integration is created that declares its own mappings for an operation, they will override this list of mappings. Leave this empty to use the default default mappings. - `result.integration.integration_point.mappings.providers` (array, required) A list of provider ID strings that this mapping applies to. Mapping templates must have at least one provider. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_sonarqube_server", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_jupiterone", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "endpointmanagement_ninjaone", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_github", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "networksecurity_aws", "networksecurity_azure", "networksecurity_google", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_bmchelix", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_xurrent", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_defender_easm", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_pentera", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "vulnerabilities_wiz", "*" - `result.integration.integration_point.mappings.mappings` (array, required) A list of mapping IDs to apply in the format {mapping_id}:{version}. - `result.integration.integration_point.mappings.operation_ids` (array, required) The operation IDs to apply the mappings to. - `result.integration.integration_point.additional_mappings` (array,null) Additional data mappings for integrations added to this integration point. This allows for custom data to be mapped to the custom_fields portion of the response. - `result.integration.integration_point.additional_mappings.providers` (array, required) A list of provider ID strings that this mapping applies to. Mapping templates must have at least one provider. Enum: "appsec_amazon_inspector", "appsec_github", "appsec_gitlab", "appsec_hcl_appscan_on_cloud", "appsec_opentext_application_security", "appsec_opentext_core_application_security", "appsec_opentext_core_application_security_mock", "appsec_servicenow", "appsec_snyk", "appsec_sonarqube_server", "appsec_tenable", "appsec_veracode", "assets_armis_centrix", "assets_armis_centrix_mock", "assets_axonius", "assets_axonius_mock", "assets_claroty_xdome", "assets_crowdstrike", "assets_crowdstrike_mock", "assets_defender", "assets_iru", "assets_ivanti_neurons", "assets_ivanti_neurons_mock", "assets_jupiterone", "assets_nozomi_vantage", "assets_nozomi_vantage_mock", "assets_qualys_cloud", "assets_qualys_cloud_mock", "assets_servicenow", "assets_servicenow_mock", "assets_sevco", "assets_sevco_mock", "assets_tanium_cloud", "assets_tanium_cloud_mock", "assets_tenable_cloud", "assets_tenable_cloud_mock", "chat_microsoft_copilot", "chat_microsoft_teams", "chat_slack", "cloudsecurity_aws", "cloudsecurity_awseventbridgesqs", "cloudsecurity_crowdstrike", "cloudsecurity_crowdstrike_mock", "cloudsecurity_defender", "cloudsecurity_google", "cloudsecurity_paloalto", "cloudsecurity_upwind", "cloudsecurity_wiz", "custom_synqly", "edr_bitdefender", "edr_crowdstrike", "edr_crowdstrike_mock", "edr_defender", "edr_eset_connect", "edr_iru", "edr_malwarebytes", "edr_sentinelone", "edr_sophos", "edr_tanium", "edr_trellix", "edr_trellix_ens", "emailsecurity_defender_for_office", "emailsecurity_defender_for_office_mock", "emailsecurity_exchange_online", "emailsecurity_mimecast_cloud_gateway", "emailsecurity_mimecast_cloud_gateway_mock", "endpointmanagement_automox", "endpointmanagement_intune", "endpointmanagement_iru", "endpointmanagement_jamf", "endpointmanagement_ninjaone", "identity_ashby", "identity_aws_iam", "identity_entra_id", "identity_entra_id_mock", "identity_github", "identity_google", "identity_google_mock", "identity_greenhouse", "identity_okta", "identity_okta_mock", "identity_pingone", "identity_pingone_mock", "identity_workday", "incidentresponse_incidentio", "incidentresponse_pagerduty", "networksecurity_aws", "networksecurity_azure", "networksecurity_google", "notifications_jira", "notifications_mock_notifications", "notifications_slack_webhook", "notifications_slack", "notifications_teams", "siem_crowdstrike", "siem_datadog", "siem_elasticsearch", "siem_google_chronicle", "siem_google_security_operations", "siem_mock_siem", "siem_opensearch", "siem_panther", "siem_q_radar", "siem_rapid7_insightidr", "siem_sentinel", "siem_splunk", "siem_sumo_logic", "sink_aws_s3", "sink_aws_security_lake", "sink_aws_sqs", "sink_azure_blob", "sink_azure_monitor_logs", "sink_crowdstrike_hec", "sink_datadog", "sink_elasticsearch", "sink_gcs", "sink_google_sec_ops", "sink_google_security_operations", "sink_http", "sink_mock_sink", "sink_opensearch", "sink_panther", "sink_q_radar", "sink_splunk", "sink_sumo_logic", "sink_swimlane", "sink_trimedx", "storage_aws_s3", "storage_azure_blob", "storage_gcs", "storage_mock_storage", "ticketing_autotask", "ticketing_azure_devops", "ticketing_bmchelix", "ticketing_freshdesk", "ticketing_github", "ticketing_ivanti", "ticketing_ivanti_mock", "ticketing_jira", "ticketing_jira_service_management", "ticketing_linear", "ticketing_mock_ticketing", "ticketing_pagerduty", "ticketing_pagerduty_mock", "ticketing_servicenow", "ticketing_servicenow_sir", "ticketing_torq", "ticketing_xurrent", "ticketing_zendesk", "vulnerabilities_amazon_inspector", "vulnerabilities_axonius", "vulnerabilities_axonius_mock", "vulnerabilities_crowdstrike", "vulnerabilities_crowdstrike_mock", "vulnerabilities_defender", "vulnerabilities_defender_easm", "vulnerabilities_horizon3", "vulnerabilities_iru", "vulnerabilities_nucleus", "vulnerabilities_pentera", "vulnerabilities_qualys_cloud", "vulnerabilities_qualys_cloud_mock", "vulnerabilities_rapid7_insight_cloud", "vulnerabilities_rapid7_insight_cloud_mock", "vulnerabilities_servicenow_vr", "vulnerabilities_tanium_cloud", "vulnerabilities_tanium_cloud_mock", "vulnerabilities_tenable_cloud", "vulnerabilities_tenable_sc", "vulnerabilities_wiz", "*" - `result.integration.integration_point.additional_mappings.resource` (string, required) Enum: "alerts", "applications", "audit_logs", "comments", "devices", "events", "evidence", "findings", "groups", "investigations", "iocs", "log_providers", "posture_scores", "projects", "scans", "scan_activities", "threats", "tickets", "users", "compliance", "cloudresourceinventory" - `result.integration.integration_point.additional_mappings.actions` (array, required) The actions that this mapping applies to. At least one action must be specified. Enum: "query", "read", "create", "update", "delete", "patch" - `result.integration.integration_point.additional_mappings.source` (string, required) The dot-separated path to the field in the source data coming from the provider. Use \. to escape literal dots in the field name. - `result.integration.integration_point.additional_mappings.destination` (string, required) The dot-separated path to where the data should reside in the custom fields object when data is returned from the provider. - `result.integration.integration_point.additional_mappings.data_type` (string, required) Enum: "string", "number", "datetime", "boolean", "array", "any" - `result.integration.integration_point.additional_mappings.mapping_type` (string) Enum: "recommended", "optional", "fixed" - `result.integration.integration_point.additional_mappings.literal` (boolean,null) When true, the value in 'source' is treated as a literal value rather than a mapping. This allows adding static values to custom fields. Default: false - `result.integration.integration_point.scheduled_operations` (array,null) A creation template for integration scheduled operations. When an integration is created without a non-empty scheduled_operations list, this list is copied onto the integration and its operations are scheduled from that snapshot. Updating or clearing this template never changes integrations that already exist. - `result.integration.bridge_selector` (any) - `result.integration.webhook_config` (object) - `result.integration.mappings` (array,null) A list of mapping chains to apply to the integration. Each mapping chain is a list of mappings to apply to the integration in the order they should be applied. Mappings are applied by operation ID. Leave this empty to use the default default mappings. - `result.integration.additional_mappings` (array,null) Additional data mappings for this integration. This allows for custom data to be mapped to the custom_fields portion of the response. - `result.integration.scheduled_operations` (array,null) Scheduled operations owned by this integration. During creation, a non-empty list is used as supplied; otherwise, the integration point's current scheduled_operations template is copied onto the integration, if present. The stored list is an independent snapshot: later changes to the integration point never affect it. Clearing this field from an existing integration removes its schedules and does not restore the integration point template. The integration does not require an integration point for these schedules to run. - `result.token` (object, required) - `result.token.access` (object, required) - `result.token.access.secret` (string, required) Secret value for the token; used for authentication when making requests. - `result.token.access.expires` (string, required) Time when this token expires and can no longer be used again. - `result.token.access.permissions` (object, required) - `result.token.access.permissions.resource_id` (string, required) - `result.token.access.permissions.resource_type` (string, required) Type of the resource that this permission grants access to. Must be one of the following: "organization, "integration" - `result.token.access.permissions.parent_id` (string, required) - `result.token.access.permissions.id` (string, required) - `result.token.access.permissions.organization_id` (string, required) - `result.token.access.permissions.member_id` (string, required) - `result.token.access.permissions.role_binding` (array,null) Roles granted to this token. - `result.token.access.permissions.adhoc_role` (object) - `result.token.access.permissions.adhoc_role.resources` (object, required) - `result.token.access.permissions.adhoc_role.resources.organizations` (object) - `result.token.access.permissions.adhoc_role.resources.organizations.ids` (array, required) List of organization ids that this role definition grants access to. Use "*" to grant access to all organization ids. - `result.token.access.permissions.adhoc_role.resources.organizations.labels` (array,null) List of organization labels this role definition grants access to. - `result.token.access.permissions.adhoc_role.resources.accounts` (object) - `result.token.access.permissions.adhoc_role.resources.accounts.ids` (array, required) List of account ids that this role definition grants access to. Use "*" to grant access to all account ids. - `result.token.access.permissions.adhoc_role.resources.accounts.labels` (array,null) List of account labels this role definition grants access to. If both labels and environments are specified both must pass - `result.token.access.permissions.adhoc_role.resources.accounts.environments` (array,null) Account environments this role definition grants access to. If both labels and environments are specified both must pass Enum: "test", "prod" - `result.token.access.permissions.adhoc_role.resources.integrations` (object) - `result.token.access.permissions.adhoc_role.resources.integrations.categories` (array, required) List of categories ids that this role definition grants access to. Use "*" to grant access to all category ids. Enum: "appsec", "assets", "chat", "cloudsecurity", "custom", "edr", "emailsecurity", "endpointmanagement", "identity", "incidentresponse", "networksecurity", "notifications", "siem", "sink", "storage", "ticketing", "vulnerabilities" - `result.token.access.permissions.adhoc_role.permission_set` (string, required) Enum: "administrator", "viewer", "member", "account-manager", "connect-ui", "token-issuer", "mcp-integrations-use-only", "mcp-management" - `result.token.access.permissions.root_organization_id` (string) - `result.token.access.claims` (object,null) Additional claims added to the token. - `result.token.refresh` (object, required) - `result.credentials_created` (array,null) - `result.credentials_created.id` (string, required) - `result.credentials_created.owner_type` (string, required) Enum: "account", "integration", "integration_point", "organization_webhook" - `result.credentials_created.fullname` (string, required) Human friendly display name for this Credential. Defaults to the same value as the 'name' field if not specified. - `result.credentials_created.config` (object, required) - `result.credentials_created.config.type` (string, required) - `result.credentials_created.managed` (string, required) Enum: "Managed", "Unmanaged" - `result.credentials_created.name` (string, required) Human-readable name for this resource - `result.credentials_created.created_at` (string, required) Time object was originally created - `result.credentials_created.updated_at` (string, required) Last time object was updated - `result.credentials_created.account_id` (string) - `result.credentials_created.integration_id` (string) - `result.credentials_created.integration_point_id` (string) - `result.credentials_created.organization_webhook_id` (string) - `result.credentials_created.expires` (string,null) Time when this credential expires and can no longer be used again. - `messages` (object) - `messages.problems` (array,null) Warnings or issues that occurred during integration creation or verification that did not prevent the request from returning, but may indicate a problem with the integration configuration. - `messages.problems.occurred_at` (string, required) The date and time the problem occurred. - `messages.problems.status` (integer, required) The HTTP status code of the problem. Matches the HTTP response code sent by the server. - `messages.problems.instance` (string, required) A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced. - `messages.problems.message` (string, required) A short, display-friendly summary of the problem. - `messages.problems.type` (string) A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type. - `messages.problems.cause` (array,null) A list of the root cause(s) for this problem occurrence. Includes at minimum one root cause, and is otherwise an unordered list of causes. - `messages.problems.cause.type` (string, required) A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type. - `messages.problems.cause.message` (string, required) A short, display-friendly summary of the problem. - `messages.problems.cause.detail` (string,null) A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem. - `messages.problems.cause.remediation` (string,null) A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible. - `messages.problems.cause.context` (object) - `messages.problems.cause.context.parameter` (object) - `messages.problems.cause.context.parameter.id` (string, required) If the location of the parameter is body, this value is always a JSON Pointer, otherwise it's the name of the parameter. - `messages.problems.cause.context.parameter.location` (string, required) Enum: "header", "path", "query", "body" - `messages.problems.cause.context.parameter.value` (any,null) The given value of the parameter. - `messages.problems.cause.context.resources` (array,null) - `messages.problems.cause.context.resources.type` (string, required) Enum: "account", "bridge", "credential", "integration_point", "integration", "member", "operation", "organization_webhook", "role", "sub_org", "token", "transform" - `messages.problems.cause.context.resources.id` (string, required) ID of the related resource. - `messages.problems.cause.context.resources.rel` (string, required) Enum: "affected", "cause" - `messages.problems.cause.context.raw_error` (string,null) If available this represents the underlying raw error, for example an error response from a Provider. - `messages.problems.cause.context.provider_details` (object,null) If available this represents the underlying details from the provider. May include the error message, status code, and other details. - `messages.problems.detail` (string,null) A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem. - `messages.problems.remediation` (string,null) A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible. - `messages.problems.context` (object)