Data connectors

Returns the JSON Schemas of the four documents your connector serves (manifest, account card, account search and view page) and their limits. Use it to build or validate your connector before registering it. It reads nothing of your data and is safe to repeat.

Required scope: connectors:read.

Use it while you build your connector, before you register it: send the manifest, an account card, an account search answer or a view page exactly as you serve them, and get every place that does not follow lelemon-connector/v1 with its path (such as $.sections[0].components[1].value) and the reason, never the value. It runs the same validator that checks the real answers of your system, so a document that passes here passes there. Nothing is stored and nothing is sent to your system, so it is safe to repeat. For an account card send baseUrl or allowedOrigins, or its action links are rejected. To check the manifest your registered system serves, use POST /v2/data-connectors/{id}/check.

Required scope: connectors:read.

Newest first. It does not call your systems.

Required scope: connectors:read.

Registers the API of your system that serves lelemon-connector/v1: account cards and views that Lelemon reads live and never stores. The base URL must be https, public, and its site must be allowed for this key: an http URL, one with a user or password, or a private address answers 422 action_destination_blocked. It does not call your system: read the signing secret with GET /v2/data-connectors/{id}/signing-secret, serve the format, then call POST /v2/data-connectors/{id}/check. Until the check passes the connector is pending and gives no tools to the copilot.

Required scope: connectors:write.

Its status and the origin of its base URL. It does not call your system.

Required scope: connectors:read.

Stops every read through it and removes its tools from the copilot. The audit of past reads is kept for two years.

Required scope: connectors:write.

Changes only what you send. A new baseUrl or new allowedOrigins put the connector back to pending and drop its stored manifest until you call the check endpoint again. The sites must be allowed for this key.

Required scope: connectors:write.

Every call of Lelemon to your connector carries a Lelemon-Signature header. Pass the whole secrets list, the method, the full URL and the raw body (empty) to verifyRequest of the SDK with domain connector. The signature covers the path and query, so it is worthless for any other route, and it expires in 60 seconds. It needs connectors:write because it is a secret. Read only: it returns the same secrets until you rotate.

Required scope: connectors:write.

Creates a new secret. The previous one keeps signing alongside the new one for 24 hours, so you can change it in your system without a cut. Every call rotates again, and the secret of the earlier rotation stops being listed: send an Idempotency-Key so a retry does not rotate twice. The response carries no secret: read it with GET /v2/data-connectors/{id}/signing-secret. Use dryRun=true to see when the previous secret would stop working; nothing rotates.

Required scope: connectors:write.

Calls GET {baseUrl}/manifest signed, validates it against lelemon-connector/v1 and stores the manifest. If it passes, the connector becomes active and its views become tools for the copilot. If the response does not follow the format, it answers 200 with ok false and the failing paths (never the values). It reads the manifest only: account cards, searches and views are validated when they are read, and a read that fails answers 422 data_connector_invalid_response with its failing paths; test them before with POST /v2/data-connectors/format/validate. If the connector does not answer, it answers 422 data_connector_unavailable and the connector goes to error. It calls your system and is safe to repeat, up to 20 checks per minute for an organization: the next one answers 429 rate_limited with Retry-After.

Required scope: connectors:write.

The manifest stored by the last check: its views and how accounts are looked up. It does not call your system; use it to know which views and filters exist before reading one.

Required scope: connectors:read.

Asks your connector live for the accounts whose email matches. Use it to get the stable account id; the email is only for searching, store the id as the externalRef of the contact. Titles come back masked when they look like a RUT, email or phone. Nothing is stored, only the audit of who looked. Use GET /v2/data-connectors/{id}/accounts/{account} when you already have the id.

Required scope: connectors:read.

Asks your connector for the card of one account and returns it masked: fields marked sensitive and any value shaped like a RUT, email or phone come back with value null and masked true. Nothing is stored; the read is audited. To see one masked value use POST /v2/data-connectors/{id}/accounts/{account}/reveal. Answers 404 when your connector does not know the account.

Required scope: connectors:read.

Reads the card live again and returns the real value of one field. The audit records the key, the account (as a keyed hash) and the field, never the value, and it is written before the value is returned. Fields marked specialCategory cannot be revealed (403). The response is never stored for idempotent replay. Use it only when the person must see the value.

Required scope: connectors:reveal.

Reads the card live and returns the https link of one action, only if its host is inside the sites of the connector. Lelemon never calls the link: the person opens it in a new tab with rel=noopener noreferrer. The click is audited. The link may carry a one-time token, so the response is never stored for idempotent replay.

Required scope: connectors:read.

Asks your connector for one page of a view declared in its manifest, for example the accounts in trial. Filters go as filter[name]=value and only the names the manifest declares are accepted (422 otherwise). The page keeps the connector order and cursor; sensitive columns and values shaped like a RUT, email or phone come back masked. Nothing is stored; the read is audited.

Required scope: connectors:read.

Newest first. Each access has the key or member, the kind (read_account, read_view, reveal, open_action...), the view, the field and an account hash; it never has a value. integrity is tampered when a row no longer matches its signature. Kept for two years. Filter by accountId to answer a data subject request.

Required scope: connectors:audit-read.