Binds a connected source to a workspace/agent-group, recording a self-audit attributed to the real principal.

POST

/v1/m/sourcescope/bindings

curl --request POST \
  --url https://example.com/v1/m/sourcescope/bindings \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "cred_hint": "example", "cred_name": "example", "cred_ref": "example", "cred_ref_kind": "example", "effect": "example", "enabled": true, "folder_path": "example", "id": "example", "note": "example", "scope_ref": "example", "scope_tree": "example", "source_ref": "example", "source_type": "example" }'

• this engine

Binds a connected source to a workspace/agent-group, recording a self-audit attributed to the real principal.

Authorizations

• bearerAuth

Parameters

Header Parameters

X-Olivares-Tenant

string format: uuid

Target tenant id; required when the principal can act in more than one tenant.

Request Body ^required

Media type application/json

object

cred_hint

Any of:

string

Masked partial only; capped at 64 bytes.

string

null

null

cred_name

Any of:

string

Credential-reference tuple. When any tuple field is non-empty, name, ref_kind, and ref are all required.

string

null

null

cred_ref

Any of:

string

A credential locator, never an inline credential value.

string

null

null

cred_ref_kind

Any of:

string

Case-insensitive after trimming: env, vault, secret_manager, file, or other.

string

null

null

effect

Any of:

string

Case-insensitive after trimming. Empty defaults to allow; otherwise allow or forbid.

string

null

null

enabled

Any of:

boolean

boolean

null

null

folder_path

Any of:

string

Output-only projection accepted by the DTO but ignored; the store resolves it from scope_ref.

string

null

null

id

Any of:

string

Accepted by the DTO but ignored on input; identity comes from the store.

string

null

null

note

Any of:

string

Capped at 512 bytes.

string

null

null

scope_ref

Any of:

string

Required for every scope_tree except workspace; a blank workspace ref selects the default workspace.

string

null

null

scope_tree

required

Case-insensitive after trimming: workspace, agent_group, folder, session, agent, user, user_group, or role.

string

source_ref

required

After trimming it must be non-empty. On update the stored value wins.

string

source_type

required

Case-insensitive after trimming: mcp, model, provider, knowledge, or data. On update the stored value wins.

string

Example ^generated

{
  "cred_hint": "example",
  "cred_name": "example",
  "cred_ref": "example",
  "cred_ref_kind": "example",
  "effect": "example",
  "enabled": true,
  "folder_path": "example",
  "id": "example",
  "note": "example",
  "scope_ref": "example",
  "scope_tree": "example",
  "source_ref": "example",
  "source_type": "example"
}

Responses

200

OK

Media type application/json

object

Example ^generated

{}

400

Bad request

Media type application/json

object

Example ^generated

{}

401

Unauthenticated

Media type application/json

object

Example ^generated

{}

403

Forbidden

Media type application/json

object

Example ^generated

{}

404

Not found

Media type application/json

object

Example ^generated

{}

409

Conflict / setup required

Media type application/json

object

Example ^generated

{}

429

Rate limited

Media type application/json

object

Example ^generated

{}