> ## Documentation Index > Fetch the complete documentation index at: https://docs.streamkap.com/llms.txt > Use this file to discover all available pages before exploring further. # Update Agent Connections > Bulk save the tenant's agent connections. Secrets are encrypted at rest. Service-layer ``ValueError`` (external MCP URL validation, intra-document duplicate id guard) surfaces as 422 with the message so the FE can point at the offending row. Unhandled, these would land as 500. ## OpenAPI ````yaml /openapi/openapi.json put /agents/connections openapi: 3.1.0 info: title: Streamkap REST API description: >- The Streamkap REST API allows you to programmatically manage your CDC pipelines, sources, destinations, transforms, and more. Authenticate using a bearer token obtained from the [Access Token](/api-reference/auth/access-token) endpoint with your API client credentials. contact: name: Streamkap Support url: https://streamkap.com/ email: support@streamkap.com license: name: Proprietary version: 2.0.0 servers: - url: https://api.streamkap.com description: Production security: [] tags: - name: Agents description: Create, deploy, and manage Flink-based AI agents. - name: Agents Observability description: >- Read-only views over the MCP audit log: agent rollup, sessions, spans, histograms, external-agent verify. - name: Alerts description: Manage alert subscribers, preferences, and notification credentials. - name: Authentication description: Obtain and refresh access tokens, manage client credentials and roles. - name: Billing description: Retrieve usage metrics, summaries, and export billing data. - name: Consumer Groups description: List, inspect, and reset Kafka consumer group offsets. - name: Dashboard description: Retrieve organisation-level statistics and overview data. - name: Destinations description: Create, configure, and manage data destinations and their lifecycle. - name: Kafka Access description: Manage Kafka users and their access permissions. - name: Logs description: Query and summarise system logs. - name: Pipelines description: Create, configure, and manage CDC pipelines and their lifecycle. - name: Project Keys description: Manage project keys that bundle API credentials and optional Kafka access. - name: Schema Registry description: Browse schema subjects, versions, and retrieve schema definitions. - name: Services description: View and switch service metadata. - name: Sources description: >- Create, configure, and manage data sources, snapshots, and their lifecycle. - name: Tags description: Create, update, and manage resource tags for organisation. - name: Topics description: Browse topic details, statistics, configurations, metrics, and messages. - name: Transforms description: >- Create, deploy, and manage data transforms, unit tests, and implementation details. paths: /agents/connections: put: tags: - Agents summary: Update Agent Connections description: >- Bulk save the tenant's agent connections. Secrets are encrypted at rest. Service-layer ``ValueError`` (external MCP URL validation, intra-document duplicate id guard) surfaces as 422 with the message so the FE can point at the offending row. Unhandled, these would land as 500. operationId: updateAgentConnections requestBody: content: application/json: schema: $ref: '#/components/schemas/AgentConnections' required: true responses: '200': description: Successful Response content: application/json: schema: additionalProperties: true type: object title: Response Updateagentconnections '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - FronteggHTTPAuthentication: [] components: schemas: AgentConnections: properties: llmConnections: items: $ref: '#/components/schemas/AgentLlmConnection' type: array title: Llmconnections description: >- Saved LLM connections - credentials + default tuning. Reusable across many agents. mcpConnections: items: oneOf: - $ref: '#/components/schemas/StreamkapMcpConnection' - $ref: '#/components/schemas/ExternalMcpNoneConnection' - $ref: '#/components/schemas/ExternalMcpBearerConnection' - $ref: '#/components/schemas/ExternalMcpHeaderConnection' type: array title: Mcpconnections description: Saved MCP connections (external-source only) httpConnections: items: $ref: '#/components/schemas/AgentHttpConnection' type: array title: Httpconnections description: >- Saved HTTP API connections. Referenced by HTTP tool rows via ``connectionId`` to inherit baseUrl + headers without duplicating them per tool. vectorStoreConnections: items: $ref: '#/components/schemas/AgentVectorStoreConnection' type: array title: Vectorstoreconnections description: >- Lightweight vector store credentials (apiKey + endpoint). Used by KBs and agent long-term memory. additionalProperties: false type: object title: AgentConnections description: >- Tenant-scoped saved agent connections. Stored in MongoDB agent_connections collection. The bulk shape behind ``GET /agents/connections`` and ``PUT /agents/connections``: per-tenant lists of LLM, MCP, and HTTP connection profiles that agents reference at deploy time. The Mongo collection is ``agent_connections``; per-row CRUD lives at ``/agents/connections/{kind}`` (see ``app.services.agent_connections_service``). HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError AgentLlmConnection: properties: id: anyOf: - type: string maxLength: 64 - type: 'null' title: Id description: >- Server-generated UUID — stable across renames. Null on first create, BE assigns. name: type: string maxLength: 100 minLength: 1 title: Name description: User-facing name; unique per tenant by FE convention provider: $ref: '#/components/schemas/AgentLlmProviderEnum' description: LLM provider apiKey: type: string maxLength: 512 title: Apikey description: API key — KMS-wrapped at rest, masked on GET default: '' baseUrl: anyOf: - type: string maxLength: 512 - type: 'null' title: Baseurl description: >- Base URL for Ollama / Azure / self-deployed OpenAI- or Anthropic-compatible servers (vLLM, LocalAI, TGI, LM Studio, LiteLLM gateways) capabilities: items: $ref: '#/components/schemas/ConnectionCapability' type: array minItems: 1 title: Capabilities description: >- Non-empty list of capabilities this connection powers. Each entry must be allowed by the provider per ``PROVIDER_CAPABILITIES``, and each listed capability must have its defaults block populated. chat: anyOf: - $ref: '#/components/schemas/ChatDefaults' - type: 'null' description: Chat-capability defaults. Required iff ``'chat' in capabilities``. embedding: anyOf: - $ref: '#/components/schemas/EmbeddingDefaults' - type: 'null' description: >- Embedding-capability defaults. Required iff ``'embedding' in capabilities``. description: anyOf: - type: string maxLength: 500 - type: 'null' title: Description description: Optional human-readable context for the connection additionalProperties: false type: object required: - name - provider - capabilities title: AgentLlmConnection description: |- Credentials + per-capability default tuning for a saved LLM connection. One row per (provider, baseUrl) carries a single credential bundle plus a non-empty ``capabilities`` set declaring which jobs the connection powers — ``chat`` for agents, ``embedding`` for knowledge bases, or both when the provider supports both. Defaults blocks (``chat`` / ``embedding``) are populated for the capabilities the row covers and ``None`` for the ones it doesn't. ``apiKey`` defaults to ``""`` so users can save a row creds-empty and test later; the same goes for each defaults block's ``model``. Ollama runs auth-less so its rows can legitimately stay apiKey-empty. StreamkapMcpConnection: properties: source: type: string const: streamkap title: Source description: Discriminator - must be 'streamkap' for this variant default: streamkap name: type: string maxLength: 100 minLength: 1 title: Name description: Connection name (e.g. 'Production Streamkap MCP') serverUrl: type: string maxLength: 2048 title: Serverurl headers: additionalProperties: type: string type: object maxProperties: 32 title: Headers description: >- Auth headers. Set 'X-Streamkap-Project-Key' to the base64-encoded credential file downloaded when the Project Key was created. additionalProperties: false type: object required: - name title: StreamkapMcpConnection description: >- A saved Streamkap MCP server connection. Authenticated via a pasted Project Key credential file in ``headers["X-Streamkap-Project-Key"]``. The BE structurally validates the blob on save, encrypts every header value at rest, and the MCP server (``streamkap-tools``) enforces the PK's stored ``tool_profile`` / ``allowed_tools`` / ``blocked_tools`` scoping per session. ExternalMcpNoneConnection: properties: source: type: string const: external title: Source description: Discriminator - must be 'external' default: external name: type: string maxLength: 100 minLength: 1 pattern: ^[^/\r\n\x00]+$ title: Name description: Connection name (e.g. 'AWS Knowledge', 'Zapier Personal') serverUrl: type: string maxLength: 2048 minLength: 1 title: Serverurl authMode: type: string const: none title: Authmode additionalProperties: false type: object required: - name - serverUrl - authMode title: ExternalMcpNoneConnection description: External MCP with no authentication header (public / open servers). ExternalMcpBearerConnection: properties: source: type: string const: external title: Source description: Discriminator - must be 'external' default: external name: type: string maxLength: 100 minLength: 1 pattern: ^[^/\r\n\x00]+$ title: Name description: Connection name (e.g. 'AWS Knowledge', 'Zapier Personal') serverUrl: type: string maxLength: 2048 minLength: 1 title: Serverurl authMode: type: string const: bearer title: Authmode bearerToken: type: string maxLength: 8192 minLength: 1 title: Bearertoken description: Bearer token - encrypted at rest, masked on GET additionalProperties: false type: object required: - name - serverUrl - authMode - bearerToken title: ExternalMcpBearerConnection description: 'External MCP authenticated via ``Authorization: Bearer ``.' ExternalMcpHeaderConnection: properties: source: type: string const: external title: Source description: Discriminator - must be 'external' default: external name: type: string maxLength: 100 minLength: 1 pattern: ^[^/\r\n\x00]+$ title: Name description: Connection name (e.g. 'AWS Knowledge', 'Zapier Personal') serverUrl: type: string maxLength: 2048 minLength: 1 title: Serverurl authMode: type: string const: header title: Authmode headerName: type: string maxLength: 200 minLength: 1 pattern: ^[A-Za-z0-9-]+$ title: Headername description: HTTP header name (RFC 7230 token alphabet, narrowed) headerValue: type: string maxLength: 8192 minLength: 1 title: Headervalue description: Header value - encrypted at rest, masked on GET additionalProperties: false type: object required: - name - serverUrl - authMode - headerName - headerValue title: ExternalMcpHeaderConnection description: External MCP authenticated via a single custom header (API-key style). AgentHttpConnection: properties: id: anyOf: - type: string maxLength: 64 - type: 'null' title: Id description: >- Server-generated UUID - stable across renames. Null on first create, BE assigns. name: type: string maxLength: 100 minLength: 1 title: Name description: >- User-facing name; unique per tenant by FE convention (e.g. 'Stripe API') baseUrl: anyOf: - type: string maxLength: 2048 - type: 'null' title: Baseurl description: >- Base URL prepended to a referencing tool's relative URL. Tools with an absolute URL ignore this. Optional - a connection can be header-only (e.g. shared auth across hosts). headers: additionalProperties: type: string type: object maxProperties: 32 title: Headers description: >- HTTP headers merged into every referencing tool's request. Values are KMS-encrypted at rest and full-masked on GET. description: anyOf: - type: string maxLength: 500 - type: 'null' title: Description description: Optional human-readable context for the connection additionalProperties: false type: object required: - name title: AgentHttpConnection description: |- A saved HTTP API connection. Reusable across multiple HTTP tools. Solves the duplication problem when several HTTP tools target the same upstream API (e.g. five tools hitting the Stripe API): instead of pasting auth headers into every tool row, the customer saves one connection here and references it from each tool by ``id``. Identical encryption + masking guarantees as MCP saved connections. Header values are KMS-wrapped at rest and full-mask on GET; the encrypt walker recurses into ``headers`` so we get this for free. The ``baseUrl`` is prepended to a tool's relative ``url`` at deploy time; if the tool ships an absolute URL, ``baseUrl`` is ignored (lets a tool override the connection's base for one-off endpoints). AgentVectorStoreConnection: properties: id: anyOf: - type: string maxLength: 64 - type: 'null' title: Id description: Server-generated UUID. Null on first create, BE assigns. name: type: string maxLength: 100 minLength: 1 title: Name description: User-facing name provider: $ref: '#/components/schemas/VectorStoreProviderEnum' description: Vector store provider apiKey: type: string maxLength: 512 title: Apikey description: Pinecone API key — KMS-wrapped at rest, masked on GET default: '' endpoint: anyOf: - type: string maxLength: 2048 - type: 'null' title: Endpoint description: Pinecone index host URL defaultNamespace: anyOf: - type: string maxLength: 200 - type: 'null' title: Defaultnamespace description: Default namespace / collection (overridable per KB or agent) allowHashFallback: type: boolean title: Allowhashfallback description: >- Opt in to the non-semantic hash-embedding fallback when the vector index lacks integrated inference. Default False = fail-hard (throws instead of silently degrading recall). default: false jdbcUrl: anyOf: - type: string maxLength: 2048 - type: 'null' title: Jdbcurl description: >- pgvector: `jdbc:postgresql://host:port/db`. Never embed userinfo here; put credentials in `username` / `password`. username: anyOf: - type: string maxLength: 512 - type: 'null' title: Username description: pgvector username. Supports `${SECRET:...}` template. password: anyOf: - type: string maxLength: 512 - type: 'null' title: Password description: pgvector password. Supports `${SECRET:...}` template. table: anyOf: - type: string maxLength: 128 - type: 'null' title: Table description: pgvector table name used as the vector collection. dims: anyOf: - type: integer minimum: 0 - type: 'null' title: Dims description: >- pgvector: embedding output dimensions. `0`/unset inherits from the embedding model. Must match the embedding model's output. metric: anyOf: - type: string maxLength: 32 - type: 'null' title: Metric description: pgvector distance metric. Only `cosine` is currently supported. properties: anyOf: - additionalProperties: true type: object - type: 'null' title: Properties description: >- Free-form `Map` for pass-through providers. Copied straight into the framework's `ResourceDescriptor.addInitialArgument` pairs at deploy time. Framework validates required keys at open-time. Not used for `pinecone` or `pgvector` (they have named typed fields). description: anyOf: - type: string maxLength: 500 - type: 'null' title: Description description: Optional human-readable context additionalProperties: false type: object required: - name - provider title: AgentVectorStoreConnection description: >- Lightweight saved vector store connection — credentials + endpoint info. Two provider shapes are supported (integration guide §3b.4): - ``pinecone`` — ``apiKey`` + ``endpoint`` (index host). - ``pgvector`` — ``jdbcUrl`` + ``username`` + ``password`` + ``table``, plus optional ``dims`` and ``metric``. Per-provider required fields are enforced by ``_validate_provider_shape``; fields for the other provider stay ``None`` on GET. ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError AgentLlmProviderEnum: type: string enum: - anthropic - openai - openai-responses - ollama - azure - azure-openai - bedrock - qwen - openai-compatible title: AgentLlmProviderEnum description: >- Unified LLM provider enum. A single ``AgentLlmConnection`` row carries one provider and a set of capabilities (chat / embedding). ``PROVIDER_CAPABILITIES`` below pins which capabilities each provider can serve — picked by the FE Connections drawer and re-validated server-side on every write. ConnectionCapability: type: string enum: - chat - embedding title: ConnectionCapability description: |- What a saved LLM connection can power. ``chat`` covers agent runtime + system-prompt suggestion + test-run. ``embedding`` covers knowledge-base embedding generation. A single connection can carry both when the provider supports both (OpenAI / Azure / Ollama) — one saved credential, two capabilities. ChatDefaults: properties: model: type: string maxLength: 200 title: Model description: >- Default chat model, e.g. claude-sonnet-4-20250514. Empty = fill at agent creation. default: '' temperature: anyOf: - type: number maximum: 2 minimum: 0 - type: 'null' title: Temperature description: Default sampling temperature (null = matrix-skipped) default: 0.1 maxTokens: anyOf: - type: integer maximum: 100000 minimum: 1 - type: 'null' title: Maxtokens description: Default max output tokens (null = matrix-skipped) default: 1024 timeout: anyOf: - type: integer maximum: 600 minimum: 1 - type: 'null' title: Timeout description: Default request timeout (seconds, null = matrix-skipped) default: 120 reasoningEffort: anyOf: - type: string enum: - none - minimal - low - medium - high - xhigh - type: 'null' title: Reasoningeffort description: >- Default reasoning effort. Accepted set is per-model — the matrix in ``app/utils/llm_capabilities.py`` rejects values not in ``caps.reasoning_effort_values`` for the picked (provider, model). thinkingBudgetTokens: anyOf: - type: integer maximum: 64000 minimum: 0 - type: 'null' title: Thinkingbudgettokens description: >- Default Anthropic Claude 4 extended-thinking budget (tokens). Non-null enables thinking. ollamaThink: anyOf: - type: boolean - type: 'null' title: Ollamathink description: Default Ollama 'think' toggle for reasoning models maxRetries: anyOf: - type: integer maximum: 20 minimum: 0 - type: 'null' title: Maxretries description: >- Universal — max retry attempts on LLM call. Accepted by every provider. region: anyOf: - type: string maxLength: 64 - type: 'null' title: Region description: >- Bedrock chat: AWS region (e.g. us-east-1). Ignored for non-bedrock providers. strict: anyOf: - type: boolean - type: 'null' title: Strict description: >- openai-responses: enable JSON-schema strict mode. Ignored for other providers. store: anyOf: - type: boolean - type: 'null' title: Store description: >- openai-responses: server-side response storage flag. Ignored for other providers. instructions: anyOf: - type: string maxLength: 8192 - type: 'null' title: Instructions description: >- openai-responses: system-level instructions passed as a top-level Responses param. additionalKwargs: anyOf: - additionalProperties: true type: object - type: 'null' title: Additionalkwargs description: >- openai-responses / azure-openai: free-form extra request params forwarded verbatim by the runtime. Use for provider-specific fields not modelled above. apiVersion: anyOf: - type: string maxLength: 32 - type: 'null' title: Apiversion description: >- azure-openai: Azure OpenAI API version (e.g. '2024-02-01'). Required for azure-openai. azureEndpoint: anyOf: - type: string maxLength: 512 - type: 'null' title: Azureendpoint description: >- azure-openai: Azure resource endpoint (e.g. https://.openai.azure.com). Required. azureUrlPathMode: anyOf: - type: string enum: - AUTO - LEGACY - UNIFIED - type: 'null' title: Azureurlpathmode description: >- azure-openai: URL path resolution — AUTO / LEGACY / UNIFIED. Optional. additionalProperties: false type: object title: ChatDefaults description: |- Default tuning for the ``chat`` capability of a saved LLM connection. Carries the same shape as ``AgentLlmConfig`` (the inline per-agent blob): model + sampling controls + reasoning controls. The wizard prefills these into ``agentConfig.llm`` and the user can override per-agent. ``None`` on any optional field means "use the matrix default at the picked model" so reasoning-only OpenAI models with no temperature don't 422 on save. EmbeddingDefaults: properties: model: type: string maxLength: 200 title: Model description: >- Default embedding model, e.g. text-embedding-3-small. Empty = fill at KB creation. default: '' dimensions: anyOf: - type: integer maximum: 65536 minimum: 1 - type: 'null' title: Dimensions description: Output embedding dimensions override (provider-dependent) batchSize: type: integer maximum: 2048 minimum: 1 title: Batchsize description: Records per embedding batch call default: 100 region: anyOf: - type: string maxLength: 64 - type: 'null' title: Region description: >- AWS region for bedrock embedding provider (e.g. us-east-1). Ignored for non-bedrock rows. maxRetries: anyOf: - type: integer maximum: 20 minimum: 0 - type: 'null' title: Maxretries description: Bedrock retry cap. Ignored for non-bedrock rows. additionalProperties: false type: object title: EmbeddingDefaults description: >- Default tuning for the ``embedding`` capability of a saved LLM connection. Embedding-only fields — no temperature / reasoning controls because embedding endpoints don't accept them. The KB wizard prefills these into ``KBEmbeddingConfig`` and the user can override per-KB. VectorStoreProviderEnum: type: string enum: - pgvector - pinecone - milvus - opensearch - elasticsearch - s3vectors - redis title: VectorStoreProviderEnum description: >- Vector-store providers supported by the Flink runtime (integration guide §3b.4). Two shape families: - **Typed-field providers** — ``pgvector`` and ``pinecone``. Each has a fixed set of named fields on ``AgentVectorStoreConnection``. - **Pass-through providers** — ``milvus``, ``opensearch``, ``elasticsearch``, ``s3vectors``. Each carries a free-form ``properties`` map that gets copied straight into the framework's ``ResourceDescriptor.addInitialArgument(key, value)`` pairs at deploy time. Framework validates required keys at open-time. ``redis`` is retained for legacy saved connections but is not accepted by the current runtime. securitySchemes: FronteggHTTPAuthentication: type: http scheme: bearer ````