> ## Documentation Index > Fetch the complete documentation index at: https://docs.conare.ai/llms.txt > Use this file to discover all available pages before exploring further. # Execute an action > Execute one provider-relative write through this end user's connected account. Conare appends `path` to the connection's fixed provider base URL and supplies the connection's stored credentials. Absolute URLs, authentication headers, and `GET` requests are rejected, so this is neither an SSRF primitive nor a generic read tunnel. Requires an Integration credential with `connectors:write` and a stable `Idempotency-Key`. Conare validates the request against the connected account's live contract before executing it and lazily enables that account's action gateway on the first valid write. A successfully completed upstream call returns HTTP 200 even when the provider rejects the write. Inspect `success` and `response.status`; this keeps provider 401/403/429 responses distinct from Conare authentication and rate-limit failures. ## OpenAPI ````yaml /api/openapi.yaml post /api/v1/connectors/{type}/actions openapi: 3.1.0 info: title: Conare API version: 1.3.0 summary: Per-end-user memory and connected-app actions for AI applications. description: > The Conare API gives your application a persistent, personalized memory layer. Production applications authenticate as an organization-owned Integration. Every request names an `endUserId`, and that end user's memory lives in its own isolated ConareDB namespace. The physical tenant is an opaque HMAC derived from the Integration and end-user ID; clients cannot select namespaces or address another tenant. On top of storage the API provides hybrid retrieval (vector + BM25, fused and reranked, sub-second), LLM-synthesized **deep recall**, **proactive suggestions** grounded in a user's memory, and explicitly scoped, idempotent writes through an end user's connected apps. Authentication normally uses a scoped server-side Integration Bearer key (`cint_...`). The secret is shown once and persisted by Conare only as a SHA-256 digest. Keep it in a server-side secret manager; never ship it to the browser. Legacy personal `cmem_...` keys remain accepted during migration. The stateless embeddings endpoint also accepts the platform key (`sk-conare-...`) that ConareDB accepts directly. A search service can use that one bearer for both embedding and database requests. Every response includes `X-Request-Id`. Send a caller-generated safe value (1–128 characters; first alphanumeric, then `A-Za-z0-9._:-`) to correlate one request through the Conare edge and memory plane; otherwise Conare generates one. Errors use a stable `{ statusCode, code, message, requestId, details? }` envelope and never include internal tenant IDs or backend error text. contact: name: Conare url: https://conare.ai email: artem@conare.ai servers: - url: https://api.conare.ai description: Production (dedicated partner-API host) - url: https://conare.ai description: Production (alias — same API, on the main host) security: - bearerAuth: [] tags: - name: Integration description: Credential, configuration, and backend readiness. - name: Memories description: Write and search a single end user's memory. - name: Recall description: LLM-synthesized personalization primitives. - name: Embeddings description: Embed text with Conare's own retrieval embedding model. - name: Reranking description: Rerank caller-owned candidates with Conare's live retrieval model. - name: Connectors description: >- Let end users sync ~200 data sources into memory and execute scoped writes through supported connected accounts. - name: Users description: End-user lifecycle (GDPR). paths: /api/v1/connectors/{type}/actions: post: tags: - Connectors summary: Execute an action description: | Execute one provider-relative write through this end user's connected account. Conare appends `path` to the connection's fixed provider base URL and supplies the connection's stored credentials. Absolute URLs, authentication headers, and `GET` requests are rejected, so this is neither an SSRF primitive nor a generic read tunnel. Requires an Integration credential with `connectors:write` and a stable `Idempotency-Key`. Conare validates the request against the connected account's live contract before executing it and lazily enables that account's action gateway on the first valid write. A successfully completed upstream call returns HTTP 200 even when the provider rejects the write. Inspect `success` and `response.status`; this keeps provider 401/403/429 responses distinct from Conare authentication and rate-limit failures. operationId: executeConnectorAction parameters: - name: type in: path required: true schema: $ref: '#/components/schemas/ConnectorType' - name: Idempotency-Key in: header required: true description: | Stable key for this logical upstream mutation. Reuse it only when retrying the exact same request. schema: $ref: '#/components/schemas/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ConnectorActionRequest' examples: updateAttioCompany: value: endUserId: u_123 method: PATCH path: /v2/objects/companies/records/rec_123 body: data: values: domains: - domain: caeros.com responses: '200': description: Provider call completed; inspect the enclosed provider response. content: application/json: schema: $ref: '#/components/schemas/ConnectorActionResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: >- The source is not connected for this end user (`connector_not_connected`). content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- The connected account does not support transactional actions (`connector_actions_unsupported`). content: application/json: schema: $ref: '#/components/schemas/Error' '413': $ref: '#/components/responses/PayloadTooLarge' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' components: schemas: ConnectorType: type: string pattern: ^[a-z0-9][a-z0-9_-]{0,63}$ description: | Data-source type id. Any source-capable type in the connector catalog (~200 sources — Gmail, Slack, HubSpot, Notion, Linear, Salesforce, warehouses, …); enumerate them via `GET /api/v1/connectors/catalog`. example: hubspot IdempotencyKey: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$ description: Optional stable source-event key. ConnectorActionRequest: type: object additionalProperties: false required: - endUserId - method - path properties: endUserId: $ref: '#/components/schemas/EndUserId' method: type: string enum: - POST - PUT - PATCH - DELETE path: type: string maxLength: 2048 pattern: ^/(?!/) description: | Provider-relative path without query or fragment. Use `query` or `rawQuery` for query parameters. query: type: object maxProperties: 100 additionalProperties: $ref: '#/components/schemas/ConnectorActionQueryValue' rawQuery: type: string maxLength: 4096 description: Exact encoded query fragment without a leading `?`. headers: type: object maxProperties: 50 additionalProperties: type: string maxLength: 8192 description: | Optional provider headers. Authentication, host, cookie, content length, connection, transfer-encoding, and every header blocked by the live connection contract are rejected. body: oneOf: - type: object additionalProperties: true - type: string - type: 'null' description: JSON object, string, or null; maximum 262144 UTF-8 bytes. ConnectorActionResponse: type: object required: - success - actionId - response properties: success: type: boolean description: True when the provider returned a 2xx status. actionId: type: - string - 'null' description: Audit correlation id for this provider call. response: type: object required: - status - contentType - headers - body - truncated - latencyMs properties: status: type: integer minimum: 100 maximum: 599 description: Provider HTTP status. contentType: type: - string - 'null' headers: type: object additionalProperties: type: string description: >- Provider response headers after connector-plane safety filtering. body: type: string description: Provider response body, unparsed. truncated: type: boolean description: >- True when the provider body exceeded the connection's response cap. latencyMs: type: - number - 'null' Error: type: object properties: statusCode: type: integer code: type: string description: Stable snake_case machine error code. message: type: string requestId: type: string description: Correlates this response through Conare services and logs. details: type: object additionalProperties: true required: - statusCode - code - message - requestId EndUserId: type: string pattern: ^[A-Za-z0-9@._-]{1,128}$ minLength: 1 maxLength: 128 description: Your stable internal user ID. No colon allowed. example: u_123 ConnectorActionQueryValue: oneOf: - type: string - type: number - type: boolean - type: 'null' - type: array maxItems: 100 items: type: - string - number - boolean - 'null' responses: BadRequest: description: Missing or invalid fields (e.g. bad `endUserId`, empty `query`). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid Bearer key. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The Integration credential does not include the required operation scope. content: application/json: schema: $ref: '#/components/schemas/Error' PayloadTooLarge: description: | `content` exceeds the 65536-byte (64 KB) cap. Save distilled observations, not raw documents. content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: > Rate limit exceeded (reads 300/min, writes 100/min on the current plan), enforced atomically per (account, end user). Rate-window exhaustion carries a `Retry-After` header (seconds); `details` also has `retryAfterSeconds`. headers: X-Request-Id: $ref: '#/components/headers/RequestId' Retry-After: description: Seconds to wait before retrying. schema: type: integer X-RateLimit-Limit: description: The per-minute request cap for this operation. schema: type: integer X-RateLimit-Remaining: description: Requests remaining in the current window. schema: type: integer X-RateLimit-Reset: description: Unix-seconds timestamp when the window resets. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' ServiceUnavailable: description: Integration namespace routing or the memory backend is not ready. headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/Error' headers: RequestId: description: Caller-provided or generated request correlation identifier. schema: type: string securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: cint_ description: | A scoped Integration key, prefixed `cint_`. Send as `Authorization: Bearer cint_...` on every request. Server-side only. Legacy personal `cmem_...` keys remain accepted during migration; team/org-scoped `cmem_...` keys are not valid on this API. ````