MAQPNADocs

ConnectedAccount

ConnectedAccount (maqpna.com/v1alpha1): every field, type, default and validation rule, generated from the CRD schema.

ConnectedAccount is a status-only view of one user's OAuth connection in the gateway's per-user token vault (F-17). The gateway creates and updates it; deleting the user's connection (DELETE /v1/connect/ or the F-03 kill switch) marks it Revoked.

At a glance#

Property Value
API version maqpna.com/v1alpha1
Kind ConnectedAccount
Scope Namespaced
Plural connectedaccounts
Short names conn, ca
Categories maqpna
Status subresource yes 
kubectl get connectedaccounts -A
kubectl get conn <name> -o yaml
kubectl explain connectedaccounts.spec

Columns in kubectl get#

Column Type From
User string .spec.user
Provider string .spec.provider
Phase string .status.phase
Age date .metadata.creationTimestamp

Spec fields#

ConnectedAccountSpec identifies a user's connection to an OAuth provider. It never holds a token: the tokens live encrypted (AES-256-GCM under a customer-held key) in the gateway's token vault, never in etcd.

Field Type Required Description
provider string yes provider is the gateway tokenVault provider name. Pattern: ^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$. Rule: provider is immutable.
user string yes user is the delegating user (the AgentSession spec.user / act.sub). Min length: 1. Max length: 320. Rule: user is immutable.

Status fields#

ConnectedAccountStatus mirrors the vault record (metadata only).

The operator writes status; do not set it yourself.

Field Type Required Description
accessTokenExpiresAt string (date-time) accessTokenExpiresAt of the current access token.
connectedAt string (date-time)
grant string grant used: authorization_code (consent) or id-jag (Cross App Access).
keyID string keyID of the customer-held key sealing the tokens (not the key).
lastRefreshAt string (date-time) lastRefreshAt is the last access-token refresh.
message string
phase string phase: Connected | ReauthRequired | Revoked.
refreshTokenRotatedAt string (date-time) refreshTokenRotatedAt is the last refresh-token rotation.
scopes []string scopes granted by the provider.