Connect a provider

Connect one provider to this workspace with the chosen capabilities and its non-secret config (topolo_crm: crmWorkspaceId; topolo_engage: engageWorkspaceId, plus optional campaignId and seatId, checked in Engage). Calls act as the caller's credential; no secret is stored. One connector per provider per workspace; reconnecting a disconnected one reactivates it with the new settings. Capabilities: contact_source (connectors.sync copies remote contacts into Nurture, source connector, source_ref crm:<id>); suppression_sync (connectors.sync pushes unsubscribed, hard_bounce, complaint and manual_block events for those contacts to TopoloCRM, and eligibility.reserve also reserves in TopoloCRM, stricter wins); interaction_writeback (records sends on the CRM timeline; nothing writes yet); lead_handoff (TopoloCRM: a task per newly qualified CRM-linked lead; TopoloEngage: enrol each newly qualified lead into the chosen campaign from the chosen seat, creating the Engage contact when missing).

Outcome

Before you start

Verify identity and pin the intended organization and environment before discovering the action.
Discover a granted Nurture workspace. The application permission is workspace:write; required workspace access is admin. A permission alone does not supply a workspace grant.
Organization and workspace come from verified context. Select resourceType/resourceId separately from action input; body fields cannot grant a different organization or workspace. The first authorized product action can initialize an identity-only workspace mirror.
Obtain authorization for the documented effect or personal-data export before supplying CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_nurture.connectors.connect --detail --json
topolo resources topolo-nurture --json
topolo workspaces list topolo-nurture --json
topolo actions get app_topolo_nurture.connectors.catalog --detail --json

provider: Provider key from connectors.catalog, not a connected connector id.

Request

POST /api/connectors

Save action input as payload.json. The reviewed plan separates path identifiers, query fields and HTTP body. Set NURTURE_WORKSPACE_ID from granted resource discovery; it is separate from action input.

Inspect and test this action in the signed action console. A test response still requires the verification below.

Input fields

Field	Required	Type	Constraints
`provider`	Required	string	Provider key from connectors.catalog, not a connected connector id. {"minLength":1,"maxLength":64}
`capabilities`	Required	array	{"minItems":1,"maxItems":5}
`config`	Required	object	{}

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "provider": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64
    },
    "capabilities": {
      "minItems": 1,
      "maxItems": 5,
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "contact_source",
          "suppression_sync",
          "interaction_writeback",
          "consent",
          "lead_handoff"
        ]
      }
    },
    "config": {
      "type": "object",
      "propertyNames": {
        "type": "string",
        "pattern": "^[A-Za-z][A-Za-z0-9_]{0,63}$"
      },
      "additionalProperties": {
        "type": "string",
        "maxLength": 500
      }
    }
  },
  "required": [
    "provider",
    "capabilities",
    "config"
  ],
  "additionalProperties": false
}

Effects

Creates (or reactivates) one active connector row. It contacts the provider only when connectors.sync or eligibility.reserve runs.

Interpret the response

The returned identifier path is $.connector.id for connector. Empty lists do not discover a target.

Call app_topolo_nurture.connectors.list and confirm the connector is active with the requested capabilities.

Exact success schema:

{
  "type": "object",
  "required": [
    "connector"
  ],
  "properties": {
    "connector": {
      "type": "object",
      "required": [
        "id",
        "provider",
        "capabilities",
        "status"
      ],
      "properties": {
        "id": {
          "type": "string"
        },
        "provider": {
          "type": "string"
        },
        "capabilities": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "contact_source",
              "suppression_sync",
              "interaction_writeback",
              "consent",
              "lead_handoff"
            ]
          }
        },
        "config": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "status": {
          "type": "string",
          "enum": [
            "active",
            "paused",
            "disconnected"
          ]
        },
        "lastSyncAt": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastSyncCursor": {
          "type": [
            "string",
            "null"
          ]
        },
        "lastError": {
          "type": [
            "string",
            "null"
          ]
        },
        "createdAt": {
          "type": "string"
        },
        "updatedAt": {
          "type": "string"
        }
      }
    }
  }
}

Worked examples

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Replace synthetic identifiers using credential-scoped discovery. A local success is not evidence of a deployed effect, configured provider or delivered message.

Successful request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{
  "provider": "topolo_crm",
  "capabilities": [
    "contact_source",
    "contact_source",
    "suppression_sync"
  ],
  "config": {
    "crmWorkspaceId": " crm_ws ",
    "extra": "dropped"
  }
}

CLI:

topolo actions validate app_topolo_nurture.connectors.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.connectors.connect",
    "input": {
      "provider": "topolo_crm",
      "capabilities": [
        "contact_source",
        "contact_source",
        "suppression_sync"
      ],
      "config": {
        "crmWorkspaceId": " crm_ws ",
        "extra": "dropped"
      }
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "connector": {
    "id": "con_21dcef8e235c46b3b249f747f3b72c7c",
    "provider": "topolo_crm",
    "capabilities": [
      "contact_source",
      "suppression_sync"
    ],
    "config": {
      "crmWorkspaceId": "crm_ws"
    },
    "status": "active",
    "lastSyncAt": null,
    "lastSyncCursor": null,
    "lastError": null,
    "createdAt": "2026-10-04T00:32:36.218Z",
    "updatedAt": "2026-10-04T00:32:36.218Z"
  }
}

HTTP 201. Call app_topolo_nurture.connectors.list and confirm the connector is active with the requested capabilities.

Another supported request

Input · payload.json:

{
  "provider": "topolo_crm",
  "capabilities": [
    "contact_source"
  ],
  "config": {
    "crmWorkspaceId": "crm_ws"
  }
}

CLI:

topolo actions validate app_topolo_nurture.connectors.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.connectors.connect",
    "input": {
      "provider": "topolo_crm",
      "capabilities": [
        "contact_source"
      ],
      "config": {
        "crmWorkspaceId": "crm_ws"
      }
    },
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 201:

{
  "connector": {
    "id": "con_22aa9b969cca481a962fed38b53f41c8",
    "provider": "topolo_crm",
    "capabilities": [
      "contact_source"
    ],
    "config": {
      "crmWorkspaceId": "crm_ws"
    },
    "status": "active",
    "lastSyncAt": null,
    "lastSyncCursor": null,
    "lastError": null,
    "createdAt": "2026-10-04T00:32:36.268Z",
    "updatedAt": "2026-10-04T00:32:36.268Z"
  }
}

HTTP 201. Call app_topolo_nurture.connectors.list and confirm the connector is active with the requested capabilities.

Refused request · invalid_config

Input · payload.json:

{
  "provider": "topolo_crm",
  "capabilities": [
    "contact_source"
  ],
  "config": {
    "crmWorkspaceId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  }
}

CLI:

topolo actions validate app_topolo_nurture.connectors.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 422:

{
  "error": {
    "code": "invalid_config",
    "message": "Config field crmWorkspaceId is missing or invalid.",
    "details": {
      "field": "crmWorkspaceId"
    }
  }
}

HTTP 422. Preserve the refusal details and do not claim success.

Refused request · unsupported_capability

Input · payload.json:

{
  "provider": "topolo_crm",
  "capabilities": [
    "consent"
  ],
  "config": {
    "crmWorkspaceId": "crm_ws"
  }
}

CLI:

topolo actions validate app_topolo_nurture.connectors.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 422:

{
  "error": {
    "code": "unsupported_capability",
    "message": "TopoloCRM does not support consent.",
    "details": {
      "capability": "consent"
    }
  }
}

HTTP 422. Preserve the refusal details and do not claim success.

Refused request · connector_already_connected

Input · payload.json:

{
  "provider": "topolo_crm",
  "capabilities": [
    "contact_source"
  ],
  "config": {
    "crmWorkspaceId": "crm_ws"
  }
}

CLI:

topolo actions validate app_topolo_nurture.connectors.connect --data @payload.json --json
topolo actions plan app_topolo_nurture.connectors.connect --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 409:

{
  "error": {
    "code": "connector_already_connected",
    "message": "TopoloCRM is already connected in this workspace.",
    "details": {
      "connectorId": "con_21dcef8e235c46b3b249f747f3b72c7c"
    }
  }
}

HTTP 409. Preserve the refusal details and do not claim success.

Verify the result

Call app_topolo_nurture.connectors.list and confirm the connector is active with the requested capabilities.

Errors and recovery

organization_required (HTTP 403): Select an organization available to the verified caller before choosing a Nurture workspace.
permission_denied (HTTP 403): Grant the credential the required Nurture workspace permission.
workspace_required (HTTP 409): Create a Nurture workspace, or pass the workspace resource context.
invalid_input (HTTP 422): Correct the fields named in error.details using inputSchema, then retry.
unknown_provider (HTTP 422): Pick a provider from app_topolo_nurture.connectors.catalog.
unsupported_capability (HTTP 422): Use only the capabilities app_topolo_nurture.connectors.catalog lists for the provider.
invalid_config (HTTP 422): Send every required config field app_topolo_nurture.connectors.catalog lists for the provider (error.details.field names the bad one), e.g. crmWorkspaceId for topolo_crm. For topolo_engage send campaignId and seatId together, picked from app_topolo_nurture.connectors.engage_options.
connector_credential_required (HTTP 503): Call with a credential TopoloEngage accepts; this deployment may also lack the Engage URL.
connector_unavailable (HTTP 502): TopoloEngage refused or failed while checking the campaign and seat; check the credential can read the Engage workspace, then retry.
connector_already_connected (HTTP 409): Change it with app_topolo_nurture.connectors.update, or disconnect it first.

Auth or gateway failures may precede this handler. Preserve the exact response shape, error string/code, request id and credential context; no synthetic fixture establishes live credential access.

Recovery boundary

Disconnect the connector created in error; contacts it already synced stay.

Sync a connector: Run one bounded sync as the caller: with contact_source, page the remote contacts (up to 50 pages, resuming from lastSyncCursor) and upsert them into Nurture contacts; with suppression_sync, push pending blocking ledger events for connector-sourced contacts. A sync only writes contact profiles: it never changes an unsubscribe or suppression, never unarchives a contact, and never takes over an address Nurture already holds from another source (counted as skipped). Safe to repeat.
List connectors: List the connectors in the caller's Nurture workspace (any status) with their enabled capabilities, config, last sync time, resume cursor and last error. A workspace that still has the retired settings.crmWorkspaceId link gets an equivalent TopoloCRM connector (contact_source) on this call.
Disconnect a connector: Stop using a connector: it no longer syncs or delegates eligibility. Contacts it synced stay in Nurture with their source, and nothing in the remote system changes. Repeating it is harmless.

Evidence

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Test scenario and capture digests are retained with each fixture.

Connect a provider

Outcome

Before you start

Discover the target

Request

Input fields

Effects

Interpret the response

Worked examples

Successful request

Another supported request

Refused request · invalid_config

Refused request · unsupported_capability

Refused request · connector_already_connected

Verify the result

Errors and recovery

Recovery boundary

Related actions

Evidence