Organisations

Replace the organisation's data key

Makes a new data key for the organisation, seals every connector's token again under it, and destroys the old key.

POST/orgs/{org}/connectors/rotate-key

TL;DR

Question	Answer
What does it do?	Replace the organisation's data key.
What does it take?	`org` in the path.
What does it return?	Status 200 with a body of type `OrgConnectors`.
What can go wrong?	`401` not signed in; `403` not the owner or an admin, or the origin may not make changes; `404` no such organisation, the caller is not a member of it, or no connector for that provider; `409` a stored token can no longer be opened (`connectors.token_unreadable`); `429` too many requests; `503` this server cannot keep a token (`connectors.unavailable`). Every failure uses the one error envelope.

Makes a new data key for the organisation, seals every connector's token again under it, and destroys the old key.

Field	Type	Required	Description
`org`	`string`	yes	The organisation's id or its slug.

Status	Meaning	Body
200	The organisation's connectors now.	`OrgConnectors`
401	Not signed in.	`ErrorResponse`
403	Not the owner or an admin, or the origin may not make changes.	`ErrorResponse`
404	No such organisation, the caller is not a member of it, or no connector for that provider.	`ErrorResponse`
409	A stored token can no longer be opened (`connectors.token_unreadable`).	`ErrorResponse`
429	Too many requests.	`ErrorResponse`
503	This server cannot keep a token (`connectors.unavailable`).	`ErrorResponse`

A 200 answer has the type OrgConnectors.

Field	Type	Required	Description
`available`	`boolean`	yes	Whether the plan has connectors: Enterprise.
`plan`	`string`	yes
`domains`	`string[]`	yes	The domains the organisation verified, which a From address must be on.
`email`	`OrgEmailConnector[]`	yes	The email connectors, at most one a provider: the default first, then in the order they were added.
`email[].provider`	`"resend" \| "sendgrid" \| "postmark" \| "mailgun" \| "brevo"`	yes
`email[].fromEmail`	`string`	yes
`email[].fromName`	`string \| null`	yes
`email[].replyTo`	`string \| null`	yes
`email[].region`	`"us" \| "eu" \| null`	yes	Mailgun's region; null for every other provider.
`email[].tokenLast4`	`string`	yes	The last four characters of the token. The token itself is never answered.
`email[].enabled`	`boolean`	yes
`email[].isDefault`	`boolean`	yes	Whether it is the default, the connector tried first. At most one is.
`email[].testedAt`	`integer \| null`	yes
`email[].lastError`	`string \| null`	yes	Why the last email through it failed, in our words, or null.
`email[].lastErrorAt`	`integer \| null`	yes
`email[].keyVersion`	`integer`	yes	The version of the organisation's data key the token is sealed with.
`email[].updatedAt`	`integer`	yes
`defaultProvider`	`"resend" \| "sendgrid" \| "postmark" \| "mailgun" \| "brevo" \| null`	yes	The provider tried first, or null when there is no connector.

Doc	Why
API reference	Every endpoint, and the error envelope
Schemas	Every request and response type
Tool reference	The operations as callable tools