Skip to main content
POST
/
v1
/
organizations
/
connections
Create Storage Connection
curl --request POST \
  --url https://api.mixpeek.com/v1/organizations/connections \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "<string>",
  "provider_type": "google_drive",
  "provider_config": {},
  "description": "<string>",
  "metadata": {},
  "test_before_save": true
}'
{
  "connection_id": "conn_abc123def456ghi",
  "created_by_user_id": "usr_admin123abc456",
  "description": "Team drive for marketing assets",
  "internal_id": "int_org123",
  "is_active": true,
  "metadata": {
    "team": "marketing"
  },
  "name": "Marketing Google Drive",
  "provider_config": {
    "credentials": {
      "client_email": "sync@project.iam.gserviceaccount.com",
      "type": "service_account"
    },
    "provider_type": "google_drive",
    "shared_drive_id": "0AH-Xabc123"
  },
  "provider_type": "google_drive",
  "status": "active"
}

Authorizations

​
Authorization
string
header
required

Bearer token authentication using your API key. Format: 'Bearer your_api_key'. To get an API key, create an account at mixpeek.com/start and generate a key in your account settings.

Headers

​
Authorization
string
required

REQUIRED: Bearer token authentication using your API key. Format: 'Bearer sk_xxxxxxxxxxxxx'. You can create API keys in the Mixpeek dashboard under Organization Settings.

Examples:

"Bearer sk_live_abc123def456"

"Bearer sk_test_xyz789"

Body

application/json

Request payload for creating a storage connection.

​
name
string
required
Required string length: 1 - 100
​
provider_type
enum<string>
required

Supported external storage providers for ingestion and sync.

Mixpeek can connect to external storage providers to automatically ingest objects and keep them synchronized with your namespaces.

Providers: GOOGLE_DRIVE: Google Drive and Google Workspace shared drives. - Authentication: Service account or OAuth2 - Features: Shared drive support, real-time sync, metadata preservation - Use cases: Marketing assets, team documents, knowledge bases - Limitations: Rate limits apply (10,000 requests/100 seconds per user)

S3: Amazon S3 and S3-compatible storage (MinIO, DigitalOcean Spaces, etc).
    - Authentication: Access keys or IAM role assumption
    - Features: Bucket notifications, prefix filtering, versioning support
    - Use cases: Data lakes, video archives, ML datasets, backups
    - Limitations: IAM role assumption preferred over access keys

Connection Requirements: - Valid credentials with read access to target files/buckets - Network connectivity from Mixpeek infrastructure - Appropriate IAM policies or share permissions configured

Examples: - Use GOOGLE_DRIVE for syncing team marketing materials - Use S3 for ingesting video archives from data lakes - Use S3 with IAM role for secure production deployments

Available options:
google_drive,
s3
​
provider_config
object
required
​
description
string | null
Maximum length: 500
​
metadata
object | null
​
test_before_save
boolean
default:true

Validate credentials before persisting

Response

Successful Response

Canonical representation of an external storage provider connection.

Storage connections enable Mixpeek to access external cloud storage providers (Google Drive, S3, etc.) for automated file ingestion and synchronization. Each connection represents a configured integration with credentials, health monitoring, and usage tracking.

Lifecycle States: - ACTIVE: Connection is healthy and ready for sync operations - SUSPENDED: Temporarily disabled by user (credentials preserved) - FAILED: Health checks failing (may need credential refresh) - ARCHIVED: Permanently retired (cannot be reactivated)

Security: - Sensitive credential fields are encrypted at rest using MongoDB client-side field level encryption (CSFLE) - Credentials never appear in API responses or logs - Failed authentication attempts are logged in last_error - Consecutive failures trigger automatic suspension

Use Cases: - Connect to team Google Drive for document ingestion - Sync files from customer S3 buckets - Monitor and process uploaded media files - Schedule periodic sync operations

Health Monitoring: - Automatic health checks validate connectivity and credentials - consecutive_failures tracks authentication/network issues - Auto-disable after 5 consecutive failures to prevent lockout - last_error stores diagnostic information for debugging

​
internal_id
string
required

REQUIRED. Organization internal identifier for multi-tenancy scoping. All connection operations are scoped to this organization. Format: int_{24-character secure token}.

Examples:

"int_org123abc456def789xyz012"

​
provider_type
enum<string>
required

REQUIRED. Storage provider implementation to use. Determines which client adapter is loaded for sync operations. Must be one of: google_drive, s3. See StorageProvider enum for full list.

Available options:
google_drive,
s3
​
provider_config
object
required

REQUIRED. Provider-specific configuration payload including credentials. Type depends on provider_type (GoogleDriveConfig, S3Config, etc.). SECURITY: Sensitive credential fields are encrypted at rest via MongoDB client-side field level encryption (CSFLE). Credentials never appear in API responses or logs. See provider_configs.py for detailed schemas. Google Drive and Google Workspace shared drive configuration.

This configuration enables Mixpeek to connect to Google Drive for automated file ingestion and synchronization. Supports both personal Drive and Google Workspace shared drives (formerly Team Drives).

Authentication Options: - Service Account: Recommended for production. No user interaction required. - OAuth2: Suitable for personal Drive access or development.

Requirements: - Google Drive API enabled in Google Cloud Console - Appropriate authentication credentials configured - Files/folders shared with the service account or OAuth user - Network connectivity to drive.googleapis.com

Use Cases: - Sync marketing materials from shared drives - Ingest documents from team collaboration folders - Monitor and process uploaded media files - Archive and search historical documents

  • GoogleDriveConfig
  • S3Config
  • Provider Config
Examples:
{
  "credentials": {
    "client_email": "sync@mixpeek-prod-456.iam.gserviceaccount.com",
    "client_id": "123456789012345678901",
    "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
    "private_key_id": "a1b2c3d4e5f6...",
    "project_id": "mixpeek-prod-456",
    "type": "service_account"
  },
  "description": "Service account accessing shared drive",
  "provider_type": "google_drive",
  "shared_drive_id": "0AH-Xabc123def456"
}
{
  "credentials": {
    "client_id": "123456789012-abc.apps.googleusercontent.com",
    "client_secret": "GOCSPX-abc123def456",
    "refresh_token": "1//0abc123def456...",
    "type": "oauth"
  },
  "description": "OAuth accessing personal Drive",
  "provider_type": "google_drive"
}
{
  "credentials": {
    "client_email": "sync@enterprise-sync.iam.gserviceaccount.com",
    "client_id": "987654321098765432109",
    "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
    "private_key_id": "xyz789...",
    "project_id": "enterprise-sync",
    "type": "service_account"
  },
  "description": "Service account with domain-wide delegation",
  "impersonate_user": "admin@company.com",
  "provider_type": "google_drive"
}
​
name
string
required

REQUIRED. Human-readable connection name for identification. Displayed in dashboards, sync logs, and API responses. Must be unique within the organization for clarity. Format: 1-100 characters, descriptive of the connection's purpose.

Required string length: 1 - 100
Examples:

"Marketing Google Drive"

"Production S3 Bucket"

"Customer Assets Archive"

​
created_by_user_id
string
required

REQUIRED. User identifier of the user who created this connection. Used for audit trails and permission checks. Format: usr_{15-character alphanumeric}. Immutable after creation.

Examples:

"usr_abc123def456ghi"

"usr_admin123abc456"

​
connection_id
string

Unique identifier for the storage connection. Auto-generated with 'conn_' prefix followed by secure random token. Format: conn_{15-character alphanumeric}. Used for API operations and audit trails.

Examples:

"conn_abc123def456ghi"

"conn_xyz789uvw012qrs"

​
description
string | null

NOT REQUIRED. Optional description explaining the connection's purpose and scope. Helpful for team collaboration and documentation. Format: Up to 500 characters.

Maximum length: 500
Examples:

"Shared drive for marketing team assets and campaign materials"

"Production S3 bucket containing customer-uploaded videos"

​
status
enum<string>

Operational status of the connection. ACTIVE: Connection is healthy and ready for use in sync operations. SUSPENDED: Temporarily disabled by user, credentials preserved but sync paused. FAILED: Health checks failing, credentials may be invalid or expired. ARCHIVED: Permanently retired, cannot be reactivated. Status transitions automatically based on health checks and user actions.

Available options:
PENDING,
IN_PROGRESS,
PROCESSING,
COMPLETED,
FAILED,
CANCELED,
UNKNOWN,
SKIPPED,
DRAFT,
ACTIVE,
ARCHIVED,
SUSPENDED
​
is_active
boolean
default:true

Quick boolean flag for filtering active connections in queries. True when status is ACTIVE, False for SUSPENDED/FAILED/ARCHIVED. Maintained automatically when status changes. Use for efficient filtering: db.connections.find({'is_active': True})

​
last_used_at
string<date-time> | null

NOT REQUIRED. UTC timestamp of the most recent successful sync operation. Updated automatically after each successful file sync/list operation. None if connection has never been used. Useful for identifying stale connections and usage analytics.

​
last_error
string | null

NOT REQUIRED. Most recent error message from failed health check or sync. Populated when authentication fails, network errors occur, or permissions denied. None when connection is healthy. Format: Error message truncated to 1000 characters. Used for diagnostics and troubleshooting.

Maximum length: 1000
Examples:

"Authentication failed: Invalid credentials"

"Permission denied: Unable to access shared drive"

"Network timeout: Failed to connect to storage.googleapis.com"

​
consecutive_failures
integer
default:0

Counter tracking consecutive failed health checks or sync attempts. Incremented on each failure, reset to 0 on success. Used to implement automatic connection suspension. Auto-suspend after 5 consecutive failures to prevent account lockout. Range: 0 to infinity (typically 0-10).

Required range: x >= 0
​
created_at
string<date-time>

UTC timestamp when the connection was created. Auto-generated using shared.utilities.helpers.current_time(). Immutable after creation. Format: ISO 8601 datetime.

​
updated_at
string<date-time>

UTC timestamp of the most recent update to the connection. Updated automatically on any field modification. Tracks configuration changes, status updates, and credential refreshes. Format: ISO 8601 datetime.

​
metadata
object

Arbitrary key-value metadata provided by the user. Useful for tagging, categorization, and custom annotations. NOT REQUIRED - defaults to empty dictionary. Common uses: team tags, cost center codes, project identifiers.

Examples:
{
  "cost_center": "CC-1234",
  "team": "marketing"
}
{
  "environment": "production",
  "project": "q4-campaign"
}
{
  "tags": ["customer-facing", "high-priority"]
}