Integrations

Integrations hold provider credentials. Secrets are stored encrypted, are write-only over the API, and are never returned in plaintext. A project has whatever its operator connected, so nothing that drives a provider carries a provider table — you discover the contract.

List what a project has connected:

{ "name": "integrations_list", "arguments": { "project_id": "pr_acme" } }

curl "$DASH_BASE_URL/api/v1/projects/pr_acme/integrations" \
  -H "Authorization: Bearer pat_..."

integrations_get returns one integration WITH what it can do: for every operation its id, risk, whether it needs approval, a summary, and required_input keys. Those rows are generated from the same typed registry that executes the call, so they cannot drift from what runs — read them, then request one operation. Full arguments for every tool are in MCP Tools.

Acting versus reading — the two paths, and which is which

integrations_action is how an agent ACTS on a provider. It requests exactly one typed operation by id; Dash owns the connection, the credentials, the endpoint, the policy, the approval, and the idempotency, and fills the outcome on a durable action row. Every push goes through it.

integrations_call is the read-only proxy, for the providers that publish no typed operations yet: request in, response out, secret injected server-side, the credential never visible to the caller. It can never send: an endpoint that mutates delivery state is refused with send_endpoint_denied, and a write at all when the project's run mode permits reads only, with mode_forbids_provider_write. The proxy is not a back door around the risk classes below — it is the read half of the same posture.

Risk classes — the whole permission story

• read — allowed in every run mode.
• draft_build / draft_preload — real provider writes whose target is proven draft/inactive first (draft_preload_blocked otherwise). The only class an agent or skill ever executes.
• control / send — start, resume, activate, broadcast send. Closed to every agent, skill, and model, unconditionally. Requested by one, the action returns pending and nothing reaches the provider.

Named gaps

A gap is something a provider will not let an API do. Dash never papers over one: it rides the durable action row so the status chip explains it, and the run still succeeds. The full gap and refusal vocabulary is in Reference / Errors.