Skip to main content
POST
Get OAuth installation URL

Query Parameters

integration
enum<string>
required
Available options:
acronis,
action1,
admin-by-request,
agger-labs,
anthropic,
aws,
axonius,
barracuda-cloudgen-firewall,
bitwarden,
box,
checkpoint-firewall,
checkpoint-harmony,
cisco-asa,
cisco-catalyst,
cisco-duo,
cisco-meraki,
cisco-secure-access,
cisco-secure-endpoint,
cisco-umbrella,
cloudflare,
connectwise-psa,
crowdstrike-falcon,
cursor,
cyberark,
darktrace,
darktrace-email-security,
datto-edr,
dfir-iris,
email,
exium,
fleet-dm,
fortianalyzer,
fortinet,
freshservice,
generic-json,
generic-syslog,
github,
github-enterprise-cloud,
google-alert-center,
google-chronicle,
google-cloud-audit-logs,
google-directory,
google-security-center,
halcyon,
halo-itsm,
have-i-been-pwned,
horizon3,
hyas-protect,
ipinfo,
jamf-internet-security,
jamf-pro,
jamf-protect,
jira-cloud,
jira-data-center,
jumpcloud,
kandji,
manage-engine-ad-audit-plus,
microsoft,
microsoft-entra,
microsoft-teams,
microsoft-teams-v2,
mimecast,
netskope,
ninjaone,
odoo-helpdesk,
okta,
one-password,
onelogin,
openai,
openvpn-access-server,
orca-security,
pager-duty,
palo-alto-networks-cortex,
palo-alto-ngfw,
perception-point,
pfsense,
picus,
ping-one,
proofpoint,
reversing-labs,
safebreach,
sandfly,
sentinel-one,
service-now,
slack,
sms,
smtp,
sonic-wall,
sophos,
sophos-firewall,
splunk,
stairwell,
sublime-security,
tenable-nessus,
thinkst-canary,
threatlocker,
three-cx,
tracebit,
unifi,
upwind,
varonis-datadvantage,
vectra,
vmware-vsphere,
watchguard-firebox,
windows-event-logs,
wirespeed,
wiz,
wordfence,
zabbix,
zscaler-zpa

Body

application/json
retentionType
enum<string>
deprecated

Deprecated. Ignored: raw data retention is not configurable through the API, so new integrations use their default retention. Removal scheduled for 2027-01-15.

Available options:
THIRTY_DAYS,
NINETY_DAYS,
ONE_YEAR,
THIRTEEN_MONTHS
fields
object[]

Integration configuration fields

externalRedirect
string

External URL to redirect to after OAuth completes instead of the default callback

integrationId
string

Existing integration to reconnect/update. When set, the OAuth callback updates this integration by id instead of matching on identity fields, so reconnecting from a specific integration always targets that row.

chatOpsEnabled
boolean

Whether this integration should participate in Chat Ops delivery. Only meaningful for integrations that support sending messages. Ignored on reconnect (existing value is preserved).

Response

url
string
required

URL for the integration endpoint

integrationId
string

Integration row reserved while the install link is outstanding, when applicable.