Integrations

List all integrations

get

List all configured integrations. Returns integration metadata without credentials.

Authentication: Requires Owner role. This endpoint is for administrative purposes to view and manage integrations.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

providerstring · enumOptional

Filter by provider: github or jira

Possible values:

Responses

200

List of integrations

No content

401

Unauthorized

403

Forbidden - Requires role: owner

get/sfp/api/integrations

GET /sfp/api/integrations HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Store credentials for external services (Jira, GitHub)

post

Securely store credentials for external integrations. Credentials are encrypted at rest using AES-256.

Authentication: Requires Owner role. Application tokens are not permitted for credential creation.

Scope options:

Global (isGlobal: true): Credentials available to all projects. Use for shared services like a company-wide Jira.
Project-scoped (projects: [...]): Credentials only for specific repositories. Projects must be registered first via POST /projects.

Common setups:

Jira: provider: "jira", authType: "basic_auth", credentials: { base_url, username, api_token }
GitHub PAT: provider: "github", authType: "pat", credentials: { token }

See full guide: https://docs.flxbl.io/sfp/api-reference/integrations

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

providerstring · enumRequired

External service to integrate with

Default: githubPossible values:

authTypestring · enumRequired

How to authenticate with the provider:

pat for GitHub/Azure DevOps tokens
basic_auth for Jira (email + API token)
oauth_client_credentials for Jira OAuth 2.0 (client_id + client_secret + cloud_id)
service_principal for Azure DevOps (client_id + client_secret + tenant_id)
app for GitHub App
oauth for OAuth flows
api_key for AI providers (Anthropic, OpenAI, Google)
bearer for AWS Bedrock

Default: patPossible values:

credentialsobjectRequired

Provider-specific credentials. Examples: - GitHub PAT: { token: "ghp_xxx" } - GitHub App: { appId: "123456", privateKey: "-----BEGIN RSA..." } - GitHub OAuth App: { client_id: "Iv1.xxx", client_secret: "xxx" } - Azure DevOps PAT: { organization_url: "https://dev.azure.com/org", token: "xxx" } - Azure DevOps Service Principal: { organization_url: "https://dev.azure.com/org", client_id: "xxx", client_secret: "xxx", tenant_id: "xxx", entra_authority_url: "https://login.microsoftonline.com" } - Jira basic_auth: { base_url: "https://company.atlassian.net", username: "email", api_token: "token" } - Jira oauth_client_credentials: { client_id: "...", client_secret: "...", cloud_id: "..." } - AI Anthropic: { api_key: "sk-ant-..." } - AI OpenAI: { api_key: "sk-..." } - AI Google: { api_key: "..." } - AI GitHub Copilot: { token: "ghu_..." } - AI Amazon Bedrock: { bearer_token: "...", region: "us-east-1" } - DataDog: { api_key: "dd-xxx" } (config: { site: "datadoghq.com" }) - New Relic: { api_key: "NRAK-xxx" } (config: { region: "US" }) - Splunk: { api_key: "splunk-hec-token" } (config: { host: "https://input-prd-xxx.cloud.splunk.com:8088" }) - Teams webhook: { webhook_url: "https://..." }

Example: {"token":"ghp_xxxx"}

projectsstring[]Optional

Repository identifiers to scope this integration to. Get these from GET /projects or register via POST /projects. Required if isGlobal is false.

Example: ["flxbl-io/sf-core","acme-corp/salesforce-main"]

isGlobalbooleanOptional

Set true to make credentials available to ALL projects. Use for shared services like a company-wide Jira instance. Either isGlobal or projects must be specified.

Example: true

isDefaultbooleanOptional

Mark as the system default for this provider category. Only global integrations can be default. AI providers are grouped — setting one AI provider as default unsets any other AI default.

Default: false

configobjectOptional

Provider-specific configuration options

Responses

201

Integration created successfully

No content

400

Invalid configuration, missing scope (isGlobal or projects), or project not found

401

Application tokens not permitted - requires user authentication

403

Forbidden - Requires role: owner

post/sfp/api/integrations

POST /sfp/api/integrations HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 179

{
  "provider": "github",
  "authType": "pat",
  "credentials": {
    "token": "ghp_xxxx"
  },
  "projects": [
    "flxbl-io/sf-core",
    "acme-corp/salesforce-main"
  ],
  "isGlobal": true,
  "isDefault": false,
  "config": {}
}

No content

Open a test ServiceNow change request

post

Create a real ServiceNow change request using the configured ServiceNow credentials for a project and a mock sfp release payload. Returns only sanitized change-request identifiers and a ServiceNow UI link; stored credentials are never returned.

Authentication: Requires Owner role.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

repositoryIdentifierstringRequired

Project repository identifier (owner/repo)

releaseCandidatestringOptional

Mock release candidate name to include in the test change request.

Example: core:SNOW-INTEGRATION-TEST

environmentsstring[]Optional

Mock target environment names to include in the test change request.

Example: ["uat"]

shortDescriptionstringOptional

Override the ServiceNow short_description used for the test change request.

descriptionstringOptional

Override the ServiceNow description used for the test change request.

correlationIdstringOptional

Override the generated correlation_id. Omit this to create a new test CR each time.

fieldsobjectOptional

Additional ServiceNow change_request fields for the mock payload. Values must be strings.

Example: {"category":"software","risk":"3"}

Responses

201

Test change request created successfully

No content

400

ServiceNow integration credentials are missing or the mock payload is invalid

403

Forbidden - Requires role: owner

502

ServiceNow rejected or failed the test change request

post/sfp/api/integrations/servicenow/change-requests/test

POST /sfp/api/integrations/servicenow/change-requests/test HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 216

{
  "repositoryIdentifier": "text",
  "releaseCandidate": "core:SNOW-INTEGRATION-TEST",
  "environments": [
    "uat"
  ],
  "shortDescription": "text",
  "description": "text",
  "correlationId": "text",
  "fields": {
    "category": "software",
    "risk": "3"
  }
}

No content

List default integrations

get

List all integrations marked as system defaults. One default per provider category (AI providers are grouped — only one default across all AI providers). Default integrations are used as fallback when a project has no project-specific integration.

Authentication: Requires Owner role.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

List of default integrations

No content

401

Unauthorized

403

Forbidden - Requires role: owner

get/sfp/api/integrations/defaults

GET /sfp/api/integrations/defaults HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Retrieve stored credentials

get

Fetch decrypted credentials for integrations. Returns credentials matching the filter criteria. All access is logged for audit purposes.

Authentication: Requires Owner role or Application token. Application tokens must specify a provider or project filter to prevent unscoped credential enumeration.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

providerstring · enumOptional

Filter by service: github or jira

Possible values:

projectstringOptional

Filter by registered project identifier (e.g., flxbl-io/sf-core). List projects via GET /projects.

Responses

200

Credentials retrieved successfully

No content

403

Forbidden - Requires role: owner, application

404

No integration found for the specified filters

get/sfp/api/integrations/credentials

GET /sfp/api/integrations/credentials HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

List approved AI models per provider

get

The manually-maintained APPROVED model catalog, per AI provider, in each provider's own model-id format. Newest first — the first entry is the provider's automatic default. Feeds the AI integration card's model chooser.

Authentication: Requires Owner role (same audience as the integration forms).

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

Approved models keyed by provider id

No content

401

Unauthorized

403

Forbidden - Requires role: owner

get/sfp/api/integrations/ai/models

GET /sfp/api/integrations/ai/models HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Delete an integration

delete

Permanently delete an integration and its encrypted credentials.

Authentication: Requires Owner role. This action cannot be undone.

Effects:

Removes the integration configuration
Deletes encrypted credentials from secure storage
Removes integration reference from associated projects
Logs deletion in audit trail

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Integration ID (UUID)

Responses

204

Integration deleted successfully

No content

401

Unauthorized

403

Forbidden - Requires role: owner

404

Integration not found

delete/sfp/api/integrations/{id}

DELETE /sfp/api/integrations/{id} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Update an integration

patch

Update credentials, config, or default status of an existing integration. Only provided fields are updated — omitted fields remain unchanged.

Authentication: Requires Owner role.

Updatable fields:

credentials: New encrypted credentials (replaces existing)
config: Provider-specific configuration
isDefault: Toggle default status for this provider category

Immutable fields (cannot be changed after creation):

provider
authType
projects / isGlobal

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Integration ID (UUID)

Body

credentialsobjectOptional

Updated credentials for the integration. Same format as create.

Example: {"token":"ghp_new_token"}

configobjectOptional

Updated provider-specific configuration options

isDefaultbooleanOptional

Update default status for this provider category. AI providers are grouped — setting one AI provider as default unsets any other AI default.

Example: true

Responses

200

Integration updated successfully

No content

400

Invalid update (e.g., setting non-global integration as default)

401

Unauthorized

403

Forbidden - Requires role: owner

404

Integration not found

patch/sfp/api/integrations/{id}

PATCH /sfp/api/integrations/{id} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 70

{
  "credentials": {
    "token": "ghp_new_token"
  },
  "config": {},
  "isDefault": true
}

No content

Resolve the ServiceNow release gate for a release request (internal)

post

Internal worker-only endpoint: used by the request-release flow to decide whether a release must be gated by a ServiceNow change request, and to retrieve the connection + change-request text (including the candidate baseline changelog). Restricted to the internal worker (application token).

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

repositoryIdentifierstringRequired

Repository identifier (owner/repo)

environmentsstring[]Required

Target environment names for this release request

releaseCandidatestringRequired

Release candidate being released (domain:RC-NAME)

Responses

201

Gate resolution returned

No content

403

Forbidden - Requires role: application

post/sfp/api/integrations/servicenow/release-gate

POST /sfp/api/integrations/servicenow/release-gate HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 220

{
  "repositoryIdentifier": "text",
  "environments": [
    "text"
  ],
  "releaseCandidate": "text",
  "sourceReference": {
    "type": "github",
    "repositoryIdentifier": "text",
    "issueNumber": 1,
    "organizationUrl": "text",
    "project": "text",
    "workItemId": 1
  }
}

No content

Open or reuse a ServiceNow release change request (internal)

post

Internal worker-only endpoint: resolves release-gate policy, opens/reuses the shared ServiceNow CR for the release candidate set, and registers the generic approval-gate record without returning ServiceNow credentials to the worker.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

repositoryIdentifierstringRequired

Repository identifier (owner/repo)

environmentsstring[]Required

Target environment names for this release request

releaseCandidatestringRequired

Release candidate being released (domain:RC-NAME)

requestedBystringOptional

Email of the human who requested the release

Responses

201

Change request opened or reused

No content

403

Forbidden - Requires role: application

post/sfp/api/integrations/servicenow/release-gate/open

POST /sfp/api/integrations/servicenow/release-gate/open HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 241

{
  "repositoryIdentifier": "text",
  "environments": [
    "text"
  ],
  "releaseCandidate": "text",
  "sourceReference": {
    "type": "github",
    "repositoryIdentifier": "text",
    "issueNumber": 1,
    "organizationUrl": "text",
    "project": "text",
    "workItemId": 1
  },
  "requestedBy": "text"
}

No content

Read or refresh a ServiceNow release gate decision (internal)

post

Internal worker-only endpoint: returns the cached ServiceNow gate decision and refreshes it from ServiceNow only when the per-gate cache is due.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

repositoryIdentifierstringRequired

Repository identifier (owner/repo)

releaseCandidatestringRequired

Release candidate being released (domain:RC-NAME)

environmentstringRequired

Target environment waiting on the ServiceNow gate

correlationIdstringRequired

Stable correlation id / approval gate id for this release CR

sysIdstringOptional

ServiceNow change request sys_id

changeNumberstringOptional

ServiceNow change request number

requestedBystringOptional

Email of the human who requested the release (audit requestedBy)

changeUrlstringOptional

Deep link to the change request in ServiceNow

Responses

201

Gate status returned

No content

403

Forbidden - Requires role: application

post/sfp/api/integrations/servicenow/release-gate/status

POST /sfp/api/integrations/servicenow/release-gate/status HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 317

{
  "repositoryIdentifier": "text",
  "releaseCandidate": "text",
  "environment": "text",
  "correlationId": "text",
  "sysId": "text",
  "changeNumber": "text",
  "requestedBy": "text",
  "changeUrl": "text",
  "sourceReference": {
    "type": "github",
    "repositoryIdentifier": "text",
    "issueNumber": 1,
    "organizationUrl": "text",
    "project": "text",
    "workItemId": 1
  }
}

No content

Record a ServiceNow gate lifecycle event to the approval audit trail (internal)

post

Internal worker-only endpoint: posted by the request-release worker when the change request is opened and when it is approved/rejected/timed out, so the gate appears in sfp_approval_audit. Does not create a pending approval. Restricted to the internal worker (application token).

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

eventstring · enumRequired

Gate lifecycle event

Possible values:

repositoryIdentifierstringRequired

Repository identifier (owner/repo)

releaseCandidatestringRequired

Release candidate being released (domain:RC-NAME)

environmentsstring[]Required

Target environment names for this release request

correlationIdstringRequired

Stable correlation id for this gate run (used as the audit entity id)

changeNumberstringOptional

ServiceNow change request number

sysIdstringOptional

ServiceNow change request sys_id

requestedBystringOptional

Email of the human who requested the release (audit requestedBy)

changeUrlstringOptional

Deep link to the change request in ServiceNow

Responses

201

Event recorded

No content

403

Forbidden - Requires role: application

post/sfp/api/integrations/servicenow/release-gate/event

POST /sfp/api/integrations/servicenow/release-gate/event HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 340

{
  "event": "requested",
  "repositoryIdentifier": "text",
  "releaseCandidate": "text",
  "environments": [
    "text"
  ],
  "correlationId": "text",
  "changeNumber": "text",
  "sysId": "text",
  "requestedBy": "text",
  "changeUrl": "text",
  "sourceReference": {
    "type": "github",
    "repositoryIdentifier": "text",
    "issueNumber": 1,
    "organizationUrl": "text",
    "project": "text",
    "workItemId": 1
  }
}

No content

Check health of platform integrations for registered projects

get

Verifies that the source control platform (GitHub or Azure DevOps) is reachable and that credentials are valid for each registered project.

How it works

Each project registered via POST /projects declares a platform field (github or azure-devops). This endpoint resolves the credentials for each project's platform and makes a lightweight API call to confirm access.

Credential resolution

Platform

What is checked

GitHub

Uses the GitHub App credentials (user-configured integration first, falls back to built-in App from server environment). Calls GET /repos/{owner}/{repo} to confirm repository access.

Azure DevOps

Uses the Service Principal credentials from the configured integration. Calls GET /_apis/connectiondata to confirm API connectivity.

Modes

Parameter

Behavior

No project

Lists all registered projects and checks each one. Useful for a full integration health overview.

project=flxbl-io/sf-core

Checks only the specified project. Useful for verifying a single onboarding.

Response statuses

Overall status

Meaning

healthy

All projects have working platform integrations

degraded

Some projects are healthy, others are not

unhealthy

No project has a working platform integration

Common failure causes

GitHub: App not installed on the organization, or repository is private and not accessible to the App
Azure DevOps: Service Principal not registered via POST /integrations, invalid client credentials, or organization URL is wrong

Authentication

Requires any authenticated role (Owner, Member, or Application token).

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

projectstringOptional

Project identifier to check (e.g., flxbl-io/sf-core for GitHub, org/project/repo for Azure DevOps). Omit to check all registered projects.

Example: flxbl-io/sf-core

Responses

200

Platform health check results

application/json

statusstring · enumRequired

Overall health across all checked projects:

healthy — every project's platform integration is reachable
degraded — at least one project is healthy but others are unhealthy or not configured
unhealthy — no project has a healthy platform integration

Example: healthyPossible values:

timestampstringRequired

ISO 8601 timestamp of when the health check was performed

Example: 2026-02-20T08:35:53.050Z

401

Unauthorized — missing or invalid bearer token

403

Forbidden - Requires role: owner, member, application

404

Project not found — the specified project identifier does not exist

get/sfp/api/integrations/platforms/health

GET /sfp/api/integrations/platforms/health HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "status": "healthy",
  "timestamp": "2026-02-20T08:35:53.050Z",
  "platforms": [
    {
      "provider": "github",
      "project": "flxbl-io/sf-core",
      "status": "healthy",
      "message": "GitHub App has access to flxbl-io/sf-core",
      "latency": 482
    }
  ]
}

Last updated 2 hours ago

Was this helpful?