Integrations

Store credentials for external services (Jira, GitHub)

POST/sfp/api/integrations

Securely store credentials for external integrations. Credentials are encrypted at rest using AES-256.

Authentication: Requires Owner role. Application tokens are not permitted for credential creation.

Scope options:

Global (isGlobal: true): Credentials available to all projects. Use for shared services like a company-wide Jira.
Project-scoped (projects: [...]): Credentials only for specific repositories. Projects must be registered first via POST /projects.

Common setups:

Jira: provider: "jira", authType: "basic_auth", credentials: { base_url, username, api_token }
GitHub PAT: provider: "github", authType: "pat", credentials: { token }

See full guide: https://docs.flxbl.io/sfp/api-reference/integrations

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

provider*IntegrationProvider

External service to integrate with

Default"github"

Value in

"github"
"azuredevops"
"jfrog"
"gitlab"
"npm"
"github_packages"
"jira"
"azure-devops"
"servicenow"
"ai_anthropic"
"ai_openai"
"ai_google"
"ai_github_copilot"
"ai_amazon_bedrock"
"ai_google_vertex"
"ai_cloudflare_gateway"
"ai_anthropic_platform"
"datadog"
"newrelic"
"splunk"
"browserbase"
"slack"
"teams"

authType*IntegrationAuthType

How to authenticate with the provider:

pat for GitHub/Azure DevOps tokens
basic_auth for Jira (email + API token)
oauth_client_credentials for Jira OAuth 2.0 (client_id + client_secret + cloud_id)
service_principal for Azure DevOps (client_id + client_secret + tenant_id)
app for GitHub App
oauth for OAuth flows
api_key for AI providers (Anthropic, OpenAI, Google)
bearer for AWS Bedrock
service_account for Claude on Google Vertex (project + location + service account JSON)

Default"pat"

Value in

"pat"
"oauth"
"app"
"basic"
"basic_auth"
"oauth_client_credentials"
"service_principal"
"api_key"
"bearer"
"service_account"
"slack_webhook"
"teams_webhook"

credentials*

Provider-specific credentials. Examples: - GitHub PAT: { token: "ghp_xxx" } - GitHub App: { appId: "123456", privateKey: "-----BEGIN RSA..." } - GitHub OAuth App: { client_id: "Iv1.xxx", client_secret: "xxx" } - Azure DevOps PAT: { organization_url: "https://dev.azure.com/org", token: "xxx" } - Azure DevOps Service Principal: { organization_url: "https://dev.azure.com/org", client_id: "xxx", client_secret: "xxx", tenant_id: "xxx", entra_authority_url: "https://login.microsoftonline.com" } - Jira basic_auth: { base_url: "https://company.atlassian.net", username: "email", api_token: "token" } - Jira oauth_client_credentials: { client_id: "...", client_secret: "...", cloud_id: "..." } - AI Anthropic: { api_key: "sk-ant-..." } - AI OpenAI: { api_key: "sk-..." } - AI Google: { api_key: "..." } - AI GitHub Copilot: { token: "ghu_..." } - AI Amazon Bedrock: { bearer_token: "...", region: "us-east-1" } - AI Cloudflare Gateway (platform-managed): { api_token: "...", account_id: "...", gateway_id: "..." } — always global; upserted as a hidden system integration, re-creating rotates the credentials - AI Google Vertex: { project: "my-project-123456", location: "us", service_account_json: "{ ... }" } - DataDog: { api_key: "dd-xxx" } (config: { site: "datadoghq.com" }) - New Relic: { api_key: "NRAK-xxx" } (config: { region: "US" }) - Splunk: { api_key: "splunk-hec-token" } (config: { host: "https://input-prd-xxx.cloud.splunk.com:8088" }) - Teams webhook: { webhook_url: "https://..." }

projects?array<string>

Repository identifiers to scope this integration to. Get these from GET /projects or register via POST /projects. Required if isGlobal is false.

isGlobal?boolean

Set true to make credentials available to ALL projects. Use for shared services like a company-wide Jira instance. Either isGlobal or projects must be specified.

isDefault?boolean

Mark as the system default for this provider category. Only global integrations can be default. AI providers are grouped — setting one AI provider as default unsets any other AI default.

Defaultfalse

config?

Provider-specific configuration options

Response Body

curl -X POST "https://example.com/sfp/api/integrations" \  -H "Content-Type: application/json" \  -d '{    "provider": "github",    "authType": "pat",    "credentials": {      "token": "ghp_xxxx"    }  }'

Empty

List all integrations

GET/sfp/api/integrations

List all configured integrations. Returns integration metadata without credentials.

Authentication: Requires Owner role. This endpoint is for administrative purposes to view and manage integrations.

Authorization

access-token

AuthorizationBearer <token>

In: header

Query Parameters

provider?string

Filter by provider: github or jira

Value in

"github"
"azuredevops"
"jfrog"
"gitlab"
"npm"
"github_packages"
"jira"
"azure-devops"
"servicenow"
"ai_anthropic"
"ai_openai"
"ai_google"
"ai_github_copilot"
"ai_amazon_bedrock"
"ai_google_vertex"
"ai_cloudflare_gateway"
"ai_anthropic_platform"
"datadog"
"newrelic"
"splunk"
"browserbase"
"slack"
"teams"

Response Body

curl -X GET "https://example.com/sfp/api/integrations"

Empty

List default integrations

GET/sfp/api/integrations/defaults

List all integrations marked as system defaults. One default per provider category (AI providers are grouped — only one default across all AI providers). Default integrations are used as fallback when a project has no project-specific integration.

Authentication: Requires Owner role.

Authorization

access-token

AuthorizationBearer <token>

In: header

Response Body

curl -X GET "https://example.com/sfp/api/integrations/defaults"

Empty

Retrieve integration credentials (application tokens) or metadata (owners)

GET/sfp/api/integrations/credentials

Fetch integrations matching the filter criteria. All access is logged for audit purposes.

Authentication: Requires Owner role or Application token. Application tokens must specify a provider or project filter to prevent unscoped credential enumeration.

Secret material is returned to application tokens only (workers/CI — the machinery that consumes the credential). Human callers (Owners) receive integration METADATA only — credentials is omitted from every entry, so no stored secret ever reaches a browser or terminal session.

Authorization

access-token

AuthorizationBearer <token>

In: header

Query Parameters

provider?string

Filter by service: github or jira

Value in

"github"
"azuredevops"
"jfrog"
"gitlab"
"npm"
"github_packages"
"jira"
"azure-devops"
"servicenow"
"ai_anthropic"
"ai_openai"
"ai_google"
"ai_github_copilot"
"ai_amazon_bedrock"
"ai_google_vertex"
"ai_cloudflare_gateway"
"ai_anthropic_platform"
"datadog"
"newrelic"
"splunk"
"browserbase"
"slack"
"teams"

project?string

Filter by registered project identifier (e.g., flxbl-io/sf-core). List projects via GET /projects.

feature*string

workItemRef*string

Response Body

curl -X GET "https://example.com/sfp/api/integrations/credentials?feature=string&workItemRef=string"

Empty

List approved AI models per provider

GET/sfp/api/integrations/ai/models

The manually-maintained APPROVED model catalog, per AI provider, in each provider's own model-id format. Newest first — the first entry is the provider's automatic default. Feeds the AI integration card's model chooser.

Authentication: Requires Owner role (same audience as the integration forms).

Authorization

access-token

AuthorizationBearer <token>

In: header

Response Body

curl -X GET "https://example.com/sfp/api/integrations/ai/models"

Empty

Resolve cherry-to target and AI availability policy

GET/sfp/api/integrations/ai/cherry-to-policy

Returns a non-secret, deterministic policy result for the cherry-to CLI. Credential material is never included; application callers retrieve the selected integration through the audited credentials endpoint.

Authorization

access-token

AuthorizationBearer <token>

In: header

Query Parameters

project*string

Registered repository identifier

target?string

Target branch to evaluate against cherryTo.targetBranches

Response Body

`application/json`

curl -X GET "https://example.com/sfp/api/integrations/ai/cherry-to-policy?project=string"

{  "enabled": true,  "targetAllowed": true,  "status": "available",  "reason": "cherry_to_not_configured",  "integrationProvider": "ai_anthropic",  "runtimeProvider": "anthropic",  "model": "string",  "integrationId": "string"}

Update an integration

PATCH/sfp/api/integrations/{id}

Update credentials, config, or default status of an existing integration. Only provided fields are updated — omitted fields remain unchanged.

Authentication: Requires Owner role.

Updatable fields:

credentials: Credential fields to update — merged onto the stored credentials. Omitted keys and blank strings keep their stored value; an explicit null clears a field.
config: Provider-specific configuration
isDefault: Toggle default status for this provider category

Immutable fields (cannot be changed after creation):

provider
authType
projects / isGlobal

Authorization

access-token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Integration ID (UUID)

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

credentials?

Credential fields to update, same format as create. Merged onto the stored credentials: omitted keys and blank strings keep their stored value; an explicit null clears a field.

config?

Updated provider-specific configuration options

isDefault?boolean

Update default status for this provider category. AI providers are grouped — setting one AI provider as default unsets any other AI default.

Response Body

curl -X PATCH "https://example.com/sfp/api/integrations/string" \  -H "Content-Type: application/json" \  -d '{}'

Empty

Delete an integration

DELETE/sfp/api/integrations/{id}

Permanently delete an integration and its encrypted credentials.

Authentication: Requires Owner role. This action cannot be undone.

Effects:

Removes the integration configuration
Deletes encrypted credentials from secure storage
Removes integration reference from associated projects
Logs deletion in audit trail

Authorization

access-token

AuthorizationBearer <token>

In: header

Path Parameters

id*string

Integration ID (UUID)

Response Body

curl -X DELETE "https://example.com/sfp/api/integrations/string"

Empty

Resolve the ServiceNow release gate for a release request (internal)

POST/sfp/api/integrations/servicenow/release-gate

Internal worker-only endpoint: used by the request-release flow to decide whether a release must be gated by a ServiceNow change request, and to retrieve the connection + change-request text (including the candidate baseline changelog). Restricted to the internal worker (application token).

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

repositoryIdentifier*string

Repository identifier (owner/repo)

environments*array<string>

Target environment names for this release request

releaseCandidate*string

Release candidate being released (domain:RC-NAME)

sourceReference?

GitHub/ADO issue that triggered the release request

Response Body

curl -X POST "https://example.com/sfp/api/integrations/servicenow/release-gate" \  -H "Content-Type: application/json" \  -d '{    "repositoryIdentifier": "string",    "environments": [      "string"    ],    "releaseCandidate": "string"  }'

Empty

Open or reuse a ServiceNow release change request (internal)

POST/sfp/api/integrations/servicenow/release-gate/open

Internal worker-only endpoint: resolves release-gate policy, opens/reuses the shared ServiceNow CR for the release candidate set, and registers the generic approval-gate record without returning ServiceNow credentials to the worker.

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

repositoryIdentifier*string

Repository identifier (owner/repo)

environments*array<string>

Target environment names for this release request

releaseCandidate*string

Release candidate being released (domain:RC-NAME)

sourceReference?

GitHub/ADO issue that triggered the release request

requestedBy?string

Email of the human who requested the release

Response Body

curl -X POST "https://example.com/sfp/api/integrations/servicenow/release-gate/open" \  -H "Content-Type: application/json" \  -d '{    "repositoryIdentifier": "string",    "environments": [      "string"    ],    "releaseCandidate": "string"  }'

Empty

Read or refresh a ServiceNow release gate decision (internal)

POST/sfp/api/integrations/servicenow/release-gate/status

Internal worker-only endpoint: returns the cached ServiceNow gate decision and refreshes it from ServiceNow only when the per-gate cache is due.

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

repositoryIdentifier*string

Repository identifier (owner/repo)

releaseCandidate*string

Release candidate being released (domain:RC-NAME)

environment*string

Target environment waiting on the ServiceNow gate

correlationId*string

Stable correlation id / approval gate id for this release CR

sysId?string

ServiceNow change request sys_id

changeNumber?string

ServiceNow change request number

requestedBy?string

Email of the human who requested the release (audit requestedBy)

changeUrl?string

Deep link to the change request in ServiceNow

sourceReference?

GitHub/ADO issue that triggered the release request

Response Body

curl -X POST "https://example.com/sfp/api/integrations/servicenow/release-gate/status" \  -H "Content-Type: application/json" \  -d '{    "repositoryIdentifier": "string",    "releaseCandidate": "string",    "environment": "string",    "correlationId": "string"  }'

Empty

Record a ServiceNow gate lifecycle event to the approval audit trail (internal)

POST/sfp/api/integrations/servicenow/release-gate/event

Internal worker-only endpoint: posted by the request-release worker when the change request is opened and when it is approved/rejected/timed out, so the gate appears in sfp_approval_audit. Does not create a pending approval. Restricted to the internal worker (application token).

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

event*string

Gate lifecycle event

Value in

"requested"
"approved"
"rejected"
"cancelled"
"timeout"

repositoryIdentifier*string

Repository identifier (owner/repo)

releaseCandidate*string

Release candidate being released (domain:RC-NAME)

environments*array<string>

Target environment names for this release request

correlationId*string

Stable correlation id for this gate run (used as the audit entity id)

changeNumber?string

ServiceNow change request number

sysId?string

ServiceNow change request sys_id

requestedBy?string

Email of the human who requested the release (audit requestedBy)

changeUrl?string

Deep link to the change request in ServiceNow

sourceReference?

GitHub/ADO issue that triggered the release request

Response Body

curl -X POST "https://example.com/sfp/api/integrations/servicenow/release-gate/event" \  -H "Content-Type: application/json" \  -d '{    "event": "requested",    "repositoryIdentifier": "string",    "releaseCandidate": "string",    "environments": [      "string"    ],    "correlationId": "string"  }'

Empty

Open a test ServiceNow change request

POST/sfp/api/integrations/servicenow/change-requests/test

Creates a real ServiceNow change request using the project integration and the same configured field rendering as the release gate. Stored credentials are never returned.

Authorization

access-token

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

repositoryIdentifier*string

Project repository identifier (owner/repo)

releaseCandidate?string

Mock release candidate name to include in the test change request.

environments?array<string>

Mock target environment names to include in the test change request.

shortDescription?string

Override the ServiceNow short_description used for the test change request.

description?string

Override the ServiceNow description used for the test change request.

correlationId?string

Override the generated correlation_id. Omit this to create a new test CR each time.

fields?

Additional ServiceNow change_request fields for the mock payload. Values must be strings.

Response Body

curl -X POST "https://example.com/sfp/api/integrations/servicenow/change-requests/test" \  -H "Content-Type: application/json" \  -d '{    "repositoryIdentifier": "string"  }'

Empty

ServiceNow change-request merge-field catalogue

GET/sfp/api/integrations/servicenow/field-catalog

Returns the server-owned merge fields available to serviceNowChangeRequest.fieldTemplate.

Authorization

access-token

AuthorizationBearer <token>

In: header

Response Body

curl -X GET "https://example.com/sfp/api/integrations/servicenow/field-catalog"

Empty

Check health of platform integrations for registered projects

GET/sfp/api/integrations/platforms/health

Verifies that the source control platform (GitHub or Azure DevOps) is reachable and that credentials are valid for each registered project.

How it works

Each project registered via POST /projects declares a platform field (github or azure-devops). This endpoint resolves the credentials for each project's platform and makes a lightweight API call to confirm access.

Credential resolution

Platform	What is checked
GitHub	Uses the GitHub App credentials (user-configured integration first, falls back to built-in App from server environment). Calls `GET /repos/{owner}/{repo}` to confirm repository access.
Azure DevOps	Uses the Service Principal credentials from the configured integration. Calls `GET /_apis/connectiondata` to confirm API connectivity.

Modes

Parameter	Behavior
No `project`	Lists all registered projects and checks each one. Useful for a full integration health overview.
`project=flxbl-io/sf-core`	Checks only the specified project. Useful for verifying a single onboarding.

Response statuses

Overall status	Meaning
`healthy`	All projects have working platform integrations
`degraded`	Some projects are healthy, others are not
`unhealthy`	No project has a working platform integration

Common failure causes

GitHub: App not installed on the organization, or repository is private and not accessible to the App
Azure DevOps: Service Principal not registered via POST /integrations, invalid client credentials, or organization URL is wrong

Authentication

Requires any authenticated role (Owner, Member, or Application token).

Authorization

access-token

AuthorizationBearer <token>

In: header

Query Parameters

project?string

Project identifier to check (e.g., flxbl-io/sf-core for GitHub, org/project/repo for Azure DevOps). Omit to check all registered projects.

Response Body

`application/json`

curl -X GET "https://example.com/sfp/api/integrations/platforms/health"

{  "status": "healthy",  "timestamp": "2026-02-20T08:35:53.050Z",  "platforms": [    {      "provider": "github",      "project": "flxbl-io/sf-core",      "status": "healthy",      "message": "GitHub App has access to flxbl-io/sf-core",      "latency": 482    }  ]}

201

400

401

403

200

401

403

200

401

403

200

403

404

200

401

403

200application/json

403

200

400

401

403

404

204

401

403

404

201

403

201

403

201

403

201

403

201

400

403

502

200

403

How it works

Credential resolution

Modes

Response statuses

Common failure causes

Authentication

200application/json

401

403

404

`application/json`

`application/json`