Health Check Connector Permissions
For setup, see Discover Dependencies.
This reference lists the minimum scope or IAM action each secret-backed health-check connector needs. It keeps the token, API key, and basic-auth connectors in one table and the AWS SigV4 checks in another so the required access stays easy to scan.
Token, API key, and basic-auth connectors
| Connector | Authenticated call | Minimum permission |
|---|---|---|
github | Octokit.rest.users.getAuthenticated() (GET /user) | Classic OAuth/PAT scope read:user. |
openai | openai.models.list() (GET /v1/models) | No additional OAuth scope; API key only. |
anthropic | anthropic.models.list() (GET /v1/models) | No additional OAuth scope; API key only. |
notion | notion.users.me() (GET /v1/users/me) | No additional OAuth scope; integration token only. |
gitlab | Gitlab.Users.showCurrentUser() (GET /user) | PAT or access token scope read_user. |
bitbucket | Bitbucket.users.getAuthedUser() (GET /2.0/user) | OAuth access token scope account. |
clerk | clerk.users.getCount() (GET /v1/users/count) | No additional scope; Clerk secret key only. |
linear | linear.viewer GraphQL query | No additional scope; Linear API key only. |
slack | WebClient.auth.test() | No additional bot-token scopes; any token Slack accepts on auth.test. |
atlassian | Version3Client.myself.getCurrentUser() (GET /rest/api/3/myself) | HTTP Basic with email and API token; no OAuth scope model. |
AWS SigV4 checks
| Connector | Authenticated call | Minimum permission |
|---|---|---|
aws | STSClient.send(new GetCallerIdentityCommand({})) | No additional IAM action beyond valid SigV4 credentials. |
aws-kms | DescribeKeyCommand({ KeyId }) when keyId is set; otherwise ListKeysCommand({ Limit: 1 }) | Use kms:DescribeKey on the specific key ARN when keyId is set, or kms:ListKeys on * when it is not. |
aws-bedrock | ListFoundationModelsCommand({}) | bedrock:ListFoundationModels on *. |
aws-cloudwatch-logs | DescribeLogGroupsCommand({ limit: 1 }) | logs:DescribeLogGroups on *. |
aws-secrets-manager | ListSecretsCommand({ MaxResults: 1 }) | secretsmanager:ListSecrets on *. |