---
updatedAt: 2026-08-27T06:35:57.000Z
agentTools:
  projectIndex: https://docs.cast.ai/llms.txt
---

# /external-connections/v1beta/organizations/{organizationId}/connections:upsert

Creates or updates a connection with the full desired state.
 The connection is uniquely identified by organization_id, cloud, and scope_key.
 If a connection already exists, it will be replaced with the new state.

# OpenAPI definition

```json
{
  "openapi": "3.0.3",
  "servers": [
    {
      "url": "https://api.cast.ai/",
      "description": "US endpoint"
    },
    {
      "url": "https://api.eu.cast.ai/",
      "description": "EU endpoint"
    }
  ],
  "info": {
    "title": "External Connections",
    "version": "0.0.1",
    "description": "ExternalConnectionsAPI manages external connections."
  },
  "security": [
    {
      "BearerAuth": []
    },
    {
      "ApiKeyAuth": []
    }
  ],
  "paths": {
    "/external-connections/v1beta/organizations/{organizationId}/connections:upsert": {
      "post": {
        "tags": [
          "ExternalConnectionsAPI"
        ],
        "description": "Creates or updates a connection with the full desired state.\n The connection is uniquely identified by organization_id, cloud, and scope_key.\n If a connection already exists, it will be replaced with the new state.",
        "operationId": "ExternalConnectionsAPI_UpsertConnection",
        "parameters": [
          {
            "name": "organizationId",
            "in": "path",
            "description": "The organization ID to create/update the connection for.",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UpsertConnectionRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UpsertConnectionResponse"
                }
              }
            }
          },
          "default": {
            "description": "Default error response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Status"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      },
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key"
      }
    },
    "schemas": {
      "AWSConnectionMetadata": {
        "type": "object",
        "properties": {
          "roleArn": {
            "type": "string",
            "description": "The IAM role ARN in the customer's AWS account that Cast assumes."
          }
        },
        "description": "AWS-specific connection metadata."
      },
      "AzureApp": {
        "required": [
          "clientId",
          "tenantId"
        ],
        "type": "object",
        "properties": {
          "clientId": {
            "type": "string",
            "description": "The client (application) ID of the Entra app registration."
          },
          "tenantId": {
            "type": "string",
            "description": "The tenant ID of the Entra app registration."
          }
        },
        "description": "Azure Entra app registration details for a single feature."
      },
      "AzureConnectionMetadata": {
        "type": "object",
        "properties": {
          "subscriptionId": {
            "type": "string",
            "description": "The Azure subscription scoped to this connection."
          },
          "apps": {
            "type": "object",
            "additionalProperties": {
              "$ref": "#/components/schemas/AzureApp"
            },
            "description": "Per-feature Azure Entra app registration details. Keyed by feature ID."
          },
          "intermediateSaEmails": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Per-feature intermediate (jumper) service account emails provisioned in\n Cast's identity project. Keyed by feature ID."
          }
        },
        "description": "Azure-specific connection metadata."
      },
      "Connection": {
        "required": [
          "id",
          "organizationId",
          "cloud",
          "scopeKey",
          "scope",
          "resourceSuffix",
          "enabledFeatures",
          "createTime",
          "updateTime"
        ],
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "The unique identifier of the connection."
          },
          "organizationId": {
            "type": "string",
            "description": "The organization ID this connection belongs to."
          },
          "cloud": {
            "enum": [
              "CLOUD_UNSPECIFIED",
              "GCP",
              "AWS",
              "AZURE",
              "ORACLE",
              "NEBIUS"
            ],
            "type": "string",
            "description": "The cloud provider.",
            "format": "enum"
          },
          "scopeKey": {
            "type": "string",
            "description": "Unique identifier for the scope."
          },
          "scope": {
            "enum": [
              "CONNECTION_SCOPE_UNSPECIFIED",
              "AWS_ACCOUNT",
              "AWS_ORGANIZATION",
              "GCP_PROJECT",
              "GCP_ORGANIZATION",
              "AZURE_SUBSCRIPTION"
            ],
            "type": "string",
            "description": "The connection scope (account or organization).",
            "format": "enum"
          },
          "resourceSuffix": {
            "type": "string",
            "description": "Suffix for generated cloud resources."
          },
          "enabledFeatures": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/EnabledFeature"
            },
            "description": "Features enabled for this connection."
          },
          "createTime": {
            "type": "string",
            "description": "Timestamp when the connection was created.",
            "format": "date-time"
          },
          "updateTime": {
            "type": "string",
            "description": "Timestamp when the connection was last updated.",
            "format": "date-time"
          }
        },
        "description": "A connection represents a customer's cloud account connection to CAST AI."
      },
      "ConnectionMetadata": {
        "type": "object",
        "properties": {
          "gcp": {
            "allOf": [
              {
                "$ref": "#/components/schemas/GCPConnectionMetadata"
              }
            ],
            "description": "GCP-specific metadata."
          },
          "aws": {
            "allOf": [
              {
                "$ref": "#/components/schemas/AWSConnectionMetadata"
              }
            ],
            "description": "AWS-specific metadata."
          },
          "azure": {
            "allOf": [
              {
                "$ref": "#/components/schemas/AzureConnectionMetadata"
              }
            ],
            "description": "Azure-specific metadata."
          }
        },
        "description": "Cloud-specific metadata for a connection. Exactly one cloud variant is set\n per connection."
      },
      "EnabledFeature": {
        "required": [
          "feature",
          "registryVersion"
        ],
        "type": "object",
        "properties": {
          "feature": {
            "enum": [
              "TYPE_UNSPECIFIED",
              "CLOUD_CONNECT",
              "KIMCHI",
              "NODE_AUTOSCALING",
              "APA",
              "OMNI",
              "DBO",
              "STORAGE_AUTOSCALING",
              "WORKLOAD_AUTOSCALING",
              "COST_MONITORING",
              "POD_MUTATIONS",
              "KARPENTER_ENTERPRISE"
            ],
            "type": "string",
            "description": "The feature type. Required.",
            "format": "enum"
          },
          "subFeatures": {
            "type": "array",
            "items": {
              "enum": [
                "TYPE_UNSPECIFIED",
                "CLOUD_CONNECT_FULL_ACCESS",
                "CLOUD_CONNECT_MINIMAL_PERMISSIONS",
                "CLOUD_CONNECT_COMMITMENTS",
                "CLOUD_CONNECT_AI_SERVICES",
                "CLOUD_CONNECT_CUR_BUCKET",
                "KIMCHI_MODEL_REGISTRIES",
                "KIMCHI_MODELS_CACHE",
                "KIMCHI_PROXY_STORAGE",
                "NODE_AUTOSCALING_IPV6",
                "NODE_AUTOSCALING_LOAD_BALANCERS_TARGET_BACKEND_POOLS",
                "NODE_AUTOSCALING_LOAD_BALANCERS_UNMANAGED_INSTANCE_GROUPS",
                "COST_MONITORING_STORAGE_METRICS",
                "COST_MONITORING_NETWORK_CONTEXT",
                "NODE_AUTOSCALING_SPOT_INTERRUPTION_HANDLING",
                "NODE_AUTOSCALING_POD_PINNING",
                "NODE_AUTOSCALING_CONTAINER_LIVE_MIGRATION",
                "POD_MUTATIONS_ENFORCEMENT",
                "WORKLOAD_AUTOSCALING_GPU_AWARE_SCALING",
                "WORKLOAD_AUTOSCALING_RESOURCE_QUOTA_AWARE_SCALING",
                "COST_MONITORING_NETWORK_MONITORING",
                "COST_MONITORING_GPU_MONITORING"
              ],
              "type": "string",
              "format": "enum"
            },
            "description": "Sub-features included. Empty means base permissions only."
          },
          "registryVersion": {
            "type": "string",
            "description": "Registry version of the feature at the time the connection was created,\n used for drift detection."
          }
        },
        "description": "EnabledFeature represents a feature that is enabled on a connection,\n including the registry version that was current at the time the\n connection was upserted."
      },
      "FeatureSelection": {
        "required": [
          "feature"
        ],
        "type": "object",
        "properties": {
          "feature": {
            "enum": [
              "TYPE_UNSPECIFIED",
              "CLOUD_CONNECT",
              "KIMCHI",
              "NODE_AUTOSCALING",
              "APA",
              "OMNI",
              "DBO",
              "STORAGE_AUTOSCALING",
              "WORKLOAD_AUTOSCALING",
              "COST_MONITORING",
              "POD_MUTATIONS",
              "KARPENTER_ENTERPRISE"
            ],
            "type": "string",
            "description": "The feature type. Required.",
            "format": "enum"
          },
          "subFeatures": {
            "type": "array",
            "items": {
              "enum": [
                "TYPE_UNSPECIFIED",
                "CLOUD_CONNECT_FULL_ACCESS",
                "CLOUD_CONNECT_MINIMAL_PERMISSIONS",
                "CLOUD_CONNECT_COMMITMENTS",
                "CLOUD_CONNECT_AI_SERVICES",
                "CLOUD_CONNECT_CUR_BUCKET",
                "KIMCHI_MODEL_REGISTRIES",
                "KIMCHI_MODELS_CACHE",
                "KIMCHI_PROXY_STORAGE",
                "NODE_AUTOSCALING_IPV6",
                "NODE_AUTOSCALING_LOAD_BALANCERS_TARGET_BACKEND_POOLS",
                "NODE_AUTOSCALING_LOAD_BALANCERS_UNMANAGED_INSTANCE_GROUPS",
                "COST_MONITORING_STORAGE_METRICS",
                "COST_MONITORING_NETWORK_CONTEXT",
                "NODE_AUTOSCALING_SPOT_INTERRUPTION_HANDLING",
                "NODE_AUTOSCALING_POD_PINNING",
                "NODE_AUTOSCALING_CONTAINER_LIVE_MIGRATION",
                "POD_MUTATIONS_ENFORCEMENT",
                "WORKLOAD_AUTOSCALING_GPU_AWARE_SCALING",
                "WORKLOAD_AUTOSCALING_RESOURCE_QUOTA_AWARE_SCALING",
                "COST_MONITORING_NETWORK_MONITORING",
                "COST_MONITORING_GPU_MONITORING"
              ],
              "type": "string",
              "format": "enum"
            },
            "description": "Sub-features to include. Empty means base permissions only (no sub-features)."
          },
          "registryVersion": {
            "type": "string",
            "description": "Registry version to pin for this feature. When set (> 0), the connection is\n stamped with that version's permissions snapshot rather than the latest.\n Used by UpsertConnection callers who set up IAM permissions for a specific\n version and need the connection to match. When unset (0), the latest\n version is used."
          }
        },
        "description": "Selects a feature and the desired sub-features for a connection setup."
      },
      "GCPConnectionMetadata": {
        "type": "object",
        "properties": {
          "serviceAccountEmails": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Per-feature customer service account emails the customer created in their\n GCP project. Keyed by feature ID."
          },
          "intermediateSaEmails": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            },
            "description": "Per-feature intermediate (jumper) service account emails provisioned in\n Cast's identity project. Keyed by feature ID."
          }
        },
        "description": "GCP-specific connection metadata."
      },
      "GoogleProtobufAny": {
        "type": "object",
        "properties": {
          "@type": {
            "type": "string",
            "description": "The type of the serialized message."
          }
        },
        "additionalProperties": true,
        "description": "Contains an arbitrary serialized message along with a @type that describes the type of the serialized message."
      },
      "Status": {
        "type": "object",
        "properties": {
          "code": {
            "type": "integer",
            "description": "The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].",
            "format": "int32"
          },
          "message": {
            "type": "string",
            "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client."
          },
          "details": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/GoogleProtobufAny"
            },
            "description": "A list of messages that carry the error details.  There is a common set of message types for APIs to use."
          }
        },
        "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors)."
      },
      "UpsertConnectionRequest": {
        "required": [
          "organizationId",
          "cloud",
          "scopeKey",
          "connectionScope",
          "resourceSuffix",
          "enabledFeatures"
        ],
        "type": "object",
        "properties": {
          "organizationId": {
            "type": "string",
            "description": "The organization ID to create/update the connection for."
          },
          "cloud": {
            "enum": [
              "CLOUD_UNSPECIFIED",
              "GCP",
              "AWS",
              "AZURE",
              "ORACLE",
              "NEBIUS"
            ],
            "type": "string",
            "description": "The cloud provider for this connection.",
            "format": "enum"
          },
          "scopeKey": {
            "type": "string",
            "description": "Unique identifier for the scope (e.g., account ID, project ID, subscription ID)."
          },
          "connectionScope": {
            "enum": [
              "CONNECTION_SCOPE_UNSPECIFIED",
              "AWS_ACCOUNT",
              "AWS_ORGANIZATION",
              "GCP_PROJECT",
              "GCP_ORGANIZATION",
              "AZURE_SUBSCRIPTION"
            ],
            "type": "string",
            "description": "Whether this connection is at account or organization scope.",
            "format": "enum"
          },
          "resourceSuffix": {
            "type": "string",
            "description": "Suffix for generated cloud resources."
          },
          "enabledFeatures": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/FeatureSelection"
            },
            "description": "Features enabled for this connection with their selected sub-features."
          },
          "metadata": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ConnectionMetadata"
              }
            ],
            "description": "Cloud-specific metadata for the connection. Includes the customer-side\n service accounts, Azure Entra app registrations, AWS role ARN, and the\n Cast-side intermediate service account emails used in the impersonation\n chain. The customer sends this after provisioning and establishing trust\n on their side."
          }
        },
        "description": "Request to upsert a connection."
      },
      "UpsertConnectionResponse": {
        "required": [
          "connection"
        ],
        "type": "object",
        "properties": {
          "connection": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Connection"
              }
            ],
            "description": "The upserted connection."
          }
        },
        "description": "Response containing the upserted connection."
      }
    }
  },
  "tags": [
    {
      "name": "ExternalConnectionsAPI"
    }
  ]
}
```