# Migrate external authentication connection

POST https://services.leadconnectorhq.com/marketplace/external-auth/migration

Migrates an external authentication connection credentials (basic or oauth2) for a specific app and location. This endpoint validates the app configuration, stores credentials safely in CRM's native encrypted storage. With this the lifecycle of the token is managed by CRM.

## Authentication

Send `Authorization: Bearer <token>` using any one of:

- **Sub-Account token: OAuth access token or Private Integration Token.** Scopes: `marketplace-external-auth-migration.write`
- **Sub-Account token: OAuth access token only (Private Integration Tokens are not accepted).** Scopes: `marketplace-external-auth-migration.write`

## Parameters

### Header Parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `Version` | string | Yes | API Version |

## OpenAPI Specification

```json
{
  "openapi": "3.0.0",
  "info": {
    "title": "LeadConnector API",
    "version": "v3"
  },
  "servers": [
    {
      "url": "https://services.leadconnectorhq.com"
    }
  ],
  "paths": {
    "/marketplace/external-auth/migration": {
      "post": {
        "summary": "Migrate external authentication connection",
        "operationId": "migrateExternalAuthenticationConnection",
        "description": "Migrates an external authentication connection credentials (basic or oauth2) for a specific app and location. This endpoint validates the app configuration, stores credentials safely in CRM's native encrypted storage. With this the lifecycle of the token is managed by CRM.",
        "parameters": [
          {
            "name": "Version",
            "in": "header",
            "description": "API Version",
            "required": true,
            "schema": {
              "type": "string",
              "enum": [
                "v3"
              ]
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MigrateConnectionDto"
              }
            }
          }
        },
        "responses": {
          "201": {
            "description": "Connection migrated successfully",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MigrateConnectionResponseDto"
                }
              }
            }
          },
          "400": {
            "description": "Bad request - invalid input or auth type mismatch",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BadRequestDTO"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized - invalid or missing token",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UnauthorizedDTO"
                }
              }
            }
          },
          "404": {
            "description": "App not found"
          },
          "500": {
            "description": "Internal server error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalServerErrorDTO"
                }
              }
            }
          }
        },
        "security": [
          {
            "Location-Access": [
              "marketplace-external-auth-migration.write"
            ]
          },
          {
            "Location-Access-Only": [
              "marketplace-external-auth-migration.write"
            ]
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearer": {
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "name": "Authorization",
        "in": "header",
        "description": "Use the Access Token generated with user type as Sub-Account (OR) Private Integration Token of Sub-Account.",
        "type": "http"
      },
      "Location-Access": {
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "name": "Authorization",
        "in": "header",
        "description": "Use the Access Token generated with user type as Sub-Account (OR) Private Integration Token of Sub-Account.",
        "type": "http"
      },
      "Location-Access-Only": {
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "name": "Authorization",
        "in": "header",
        "description": "Use the Access Token generated with user type as Sub-Account.",
        "type": "http"
      },
      "Agency-Access": {
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "name": "Authorization",
        "in": "header",
        "description": "Use the Access Token generated with user type as Agency (OR) Private Integration Token of Agency.",
        "type": "http"
      },
      "Agency-Access-Only": {
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "name": "Authorization",
        "in": "header",
        "description": "Use the Access Token generated with user type as Agency.",
        "type": "http"
      }
    },
    "schemas": {
      "MigrateConnectionDto": {
        "type": "object",
        "properties": {
          "type": {
            "type": "string",
            "enum": [
              "oauth2",
              "basic"
            ],
            "example": "oauth2",
            "description": "Type of authentication - basic or oauth2"
          },
          "locationId": {
            "type": "string",
            "example": "location_12345",
            "description": "Location ID"
          },
          "appId": {
            "type": "string",
            "example": "507f1f77bcf86cd799439011",
            "description": "App ID"
          },
          "appVersionId": {
            "type": "string",
            "example": "507f1f77bcf86cd799439012",
            "description": "App Version ID"
          },
          "accountId": {
            "type": "string",
            "example": "my-connection-identifier",
            "description": "Connection identifier"
          },
          "apiKey": {
            "type": "string",
            "example": "sk_test_1234567890",
            "description": "API Key (supported when type is basic)"
          },
          "basicCredentials": {
            "type": "object",
            "example": {
              "email": "user@example.com",
              "password": "p@ssw0rd"
            },
            "description": "Basic auth credentials as key/value pairs (supported when type is basic). Keys are validated against the app version externalAuthConfig.fields."
          },
          "accessToken": {
            "type": "string",
            "example": "ya29.a0AfH6SMBx...",
            "description": "Access token (required when type is oauth2)"
          },
          "refreshToken": {
            "type": "string",
            "example": "1//0gHq5F...",
            "description": "Refresh token. Omit only when the provider issues long-lived, non-refreshable tokens (e.g. TikTok Marketing API, ClickUp) and therefore never returns one. Callers are responsible for supplying it whenever their app has a refresh endpoint configured: the migration stores exactly what it is given and replaces any previously stored secret, so omitting a refresh token the connection needs will leave it unable to refresh once the access token expires. Must be a non-empty string when supplied — null is rejected."
          },
          "expiryIn": {
            "type": "number",
            "example": 3600000,
            "description": "Access token expiry time in milliseconds (optional for oauth2)"
          },
          "expiryAt": {
            "type": "number",
            "example": 1735689600000,
            "description": "Timestamp for access token expiry (optional for oauth2)"
          },
          "scopes": {
            "example": [
              "contacts.readonly",
              "contacts.write"
            ],
            "description": "OAuth2 scopes (optional for oauth2)",
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "displayName": {
            "type": "string",
            "example": "My Connection Display Name",
            "description": "Display name for the connection (optional, defaults to accountId)"
          },
          "email": {
            "type": "string",
            "example": "user@example.com",
            "description": "Account email metadata for the migrated connection"
          },
          "identitySource": {
            "type": "string",
            "enum": [
              "provider",
              "manual"
            ],
            "example": "manual",
            "description": "Source of the account identity metadata"
          },
          "isDefault": {
            "type": "boolean",
            "example": false,
            "description": "Whether this is the default connection for the location (optional, defaults to false)"
          }
        },
        "required": [
          "type",
          "locationId",
          "appId",
          "appVersionId",
          "accountId"
        ],
        "title": "MigrateConnectionDto"
      },
      "MigrateConnectionResponseDto": {
        "type": "object",
        "properties": {
          "success": {
            "type": "boolean",
            "example": true,
            "description": "Indicates if the migration was successful"
          },
          "identifier": {
            "type": "string",
            "example": "migration_12345",
            "description": "Unique identifier for the migrated connection"
          },
          "message": {
            "type": "string",
            "example": "Connection migrated successfully",
            "description": "Message describing the result"
          }
        },
        "required": [
          "success",
          "identifier"
        ],
        "title": "MigrateConnectionResponseDto"
      },
      "BadRequestDTO": {
        "type": "object",
        "properties": {
          "statusCode": {
            "type": "number",
            "example": 400
          },
          "message": {
            "type": "string",
            "example": "Bad Request"
          }
        },
        "title": "BadRequestDTO"
      },
      "UnauthorizedDTO": {
        "type": "object",
        "properties": {
          "statusCode": {
            "type": "number",
            "example": 401
          },
          "message": {
            "type": "string",
            "example": "Invalid token: access token is invalid"
          },
          "error": {
            "type": "string",
            "example": "Unauthorized"
          }
        },
        "title": "UnauthorizedDTO"
      },
      "InternalServerErrorDTO": {
        "type": "object",
        "properties": {
          "statusCode": {
            "type": "number",
            "description": "HTTP status code",
            "example": 500
          },
          "message": {
            "type": "string",
            "description": "Error message describing the internal server error",
            "example": "Internal Server Error"
          }
        },
        "title": "InternalServerErrorDTO"
      }
    }
  }
}
```

## Code Examples

**cURL**

```bash
curl -L -X POST 'https://services.leadconnectorhq.com/marketplace/external-auth/migration' \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Version: v3' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "type": "oauth2",
  "locationId": "location_12345",
  "appId": "507f1f77bcf86cd799439011",
  "appVersionId": "507f1f77bcf86cd799439012",
  "accountId": "my-connection-identifier",
  "apiKey": "sk_test_1234567890",
  "basicCredentials": {
    "email": "user@example.com",
    "password": "p@ssw0rd"
  },
  "accessToken": "ya29.a0AfH6SMBx...",
  "refreshToken": "1//0gHq5F...",
  "expiryIn": 3600000,
  "expiryAt": 1735689600000,
  "scopes": [
    "contacts.readonly",
    "contacts.write"
  ],
  "displayName": "My Connection Display Name",
  "email": "user@example.com",
  "identitySource": "manual",
  "isDefault": false
}'
```

**Node.js**

```javascript
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <TOKEN>',
    Version: 'v3',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
      "type": "oauth2",
      "locationId": "location_12345",
      "appId": "507f1f77bcf86cd799439011",
      "appVersionId": "507f1f77bcf86cd799439012",
      "accountId": "my-connection-identifier",
      "apiKey": "sk_test_1234567890",
      "basicCredentials": {
        "email": "user@example.com",
        "password": "p@ssw0rd"
      },
      "accessToken": "ya29.a0AfH6SMBx...",
      "refreshToken": "1//0gHq5F...",
      "expiryIn": 3600000,
      "expiryAt": 1735689600000,
      "scopes": [
        "contacts.readonly",
        "contacts.write"
      ],
      "displayName": "My Connection Display Name",
      "email": "user@example.com",
      "identitySource": "manual",
      "isDefault": false
  })
};

try {
  const response = await fetch('https://services.leadconnectorhq.com/marketplace/external-auth/migration', options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

**Python**

```python
import requests

url = "https://services.leadconnectorhq.com/marketplace/external-auth/migration"

headers = {
    "Authorization": "Bearer <TOKEN>",
    "Version": "v3"
}

payload = {
    "type": "oauth2",
    "locationId": "location_12345",
    "appId": "507f1f77bcf86cd799439011",
    "appVersionId": "507f1f77bcf86cd799439012",
    "accountId": "my-connection-identifier",
    "apiKey": "sk_test_1234567890",
    "basicCredentials": {
        "email": "user@example.com",
        "password": "p@ssw0rd"
    },
    "accessToken": "ya29.a0AfH6SMBx...",
    "refreshToken": "1//0gHq5F...",
    "expiryIn": 3600000,
    "expiryAt": 1735689600000,
    "scopes": [
        "contacts.readonly",
        "contacts.write"
    ],
    "displayName": "My Connection Display Name",
    "email": "user@example.com",
    "identitySource": "manual",
    "isDefault": false
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())
```

**PHP**

```php
<?php
$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => 'https://services.leadconnectorhq.com/marketplace/external-auth/migration',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer <TOKEN>',
    'Version: v3',
    'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS => '{
  "type": "oauth2",
  "locationId": "location_12345",
  "appId": "507f1f77bcf86cd799439011",
  "appVersionId": "507f1f77bcf86cd799439012",
  "accountId": "my-connection-identifier",
  "apiKey": "sk_test_1234567890",
  "basicCredentials": {
    "email": "user@example.com",
    "password": "p@ssw0rd"
  },
  "accessToken": "ya29.a0AfH6SMBx...",
  "refreshToken": "1//0gHq5F...",
  "expiryIn": 3600000,
  "expiryAt": 1735689600000,
  "scopes": [
    "contacts.readonly",
    "contacts.write"
  ],
  "displayName": "My Connection Display Name",
  "email": "user@example.com",
  "identitySource": "manual",
  "isDefault": false
}',
]);

$response = curl_exec($curl);
curl_close($curl);
echo $response;
```

**Java**

```java
HttpResponse<String> response = Unirest
  .post("https://services.leadconnectorhq.com/marketplace/external-auth/migration")
  .header("Authorization", "Bearer <TOKEN>")
  .header("Version", "v3")
  .header("Content-Type", "application/json")
  .body("{\"type\":\"oauth2\",\"locationId\":\"location_12345\",\"appId\":\"507f1f77bcf86cd799439011\",\"appVersionId\":\"507f1f77bcf86cd799439012\",\"accountId\":\"my-connection-identifier\",\"apiKey\":\"sk_test_1234567890\",\"basicCredentials\":{\"email\":\"user@example.com\",\"password\":\"p@ssw0rd\"},\"accessToken\":\"ya29.a0AfH6SMBx...\",\"refreshToken\":\"1//0gHq5F...\",\"expiryIn\":3600000,\"expiryAt\":1735689600000,\"scopes\":[\"contacts.readonly\",\"contacts.write\"],\"displayName\":\"My Connection Display Name\",\"email\":\"user@example.com\",\"identitySource\":\"manual\",\"isDefault\":false}")
  .asString();
```

**Go**

```go
package main

import (
  "fmt"
  "net/http"
  "io"
  "strings"
)

func main() {
  url := "https://services.leadconnectorhq.com/marketplace/external-auth/migration"
  payload := strings.NewReader(`{
  "type": "oauth2",
  "locationId": "location_12345",
  "appId": "507f1f77bcf86cd799439011",
  "appVersionId": "507f1f77bcf86cd799439012",
  "accountId": "my-connection-identifier",
  "apiKey": "sk_test_1234567890",
  "basicCredentials": {
    "email": "user@example.com",
    "password": "p@ssw0rd"
  },
  "accessToken": "ya29.a0AfH6SMBx...",
  "refreshToken": "1//0gHq5F...",
  "expiryIn": 3600000,
  "expiryAt": 1735689600000,
  "scopes": [
    "contacts.readonly",
    "contacts.write"
  ],
  "displayName": "My Connection Display Name",
  "email": "user@example.com",
  "identitySource": "manual",
  "isDefault": false
}`)
  req, _ := http.NewRequest("POST", url, payload)
  req.Header.Add("Authorization", "Bearer <TOKEN>")
  req.Header.Add("Version", "v3")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)
  fmt.Println(string(body))
}
```

**Ruby**

```ruby
require 'uri'
require 'net/http'

url = URI("https://services.leadconnectorhq.com/marketplace/external-auth/migration")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = "Bearer <TOKEN>"
request["Version"] = "v3"
request["Content-Type"] = "application/json"
request.body = '{
  "type": "oauth2",
  "locationId": "location_12345",
  "appId": "507f1f77bcf86cd799439011",
  "appVersionId": "507f1f77bcf86cd799439012",
  "accountId": "my-connection-identifier",
  "apiKey": "sk_test_1234567890",
  "basicCredentials": {
    "email": "user@example.com",
    "password": "p@ssw0rd"
  },
  "accessToken": "ya29.a0AfH6SMBx...",
  "refreshToken": "1//0gHq5F...",
  "expiryIn": 3600000,
  "expiryAt": 1735689600000,
  "scopes": [
    "contacts.readonly",
    "contacts.write"
  ],
  "displayName": "My Connection Display Name",
  "email": "user@example.com",
  "identitySource": "manual",
  "isDefault": false
}'

response = http.request(request)
puts response.read_body
```

**PowerShell**

```powershell
$headers = @{
  "Authorization" = "Bearer <TOKEN>"
  "Version" = "v3"
}

$body = '{
  "type": "oauth2",
  "locationId": "location_12345",
  "appId": "507f1f77bcf86cd799439011",
  "appVersionId": "507f1f77bcf86cd799439012",
  "accountId": "my-connection-identifier",
  "apiKey": "sk_test_1234567890",
  "basicCredentials": {
    "email": "user@example.com",
    "password": "p@ssw0rd"
  },
  "accessToken": "ya29.a0AfH6SMBx...",
  "refreshToken": "1//0gHq5F...",
  "expiryIn": 3600000,
  "expiryAt": 1735689600000,
  "scopes": [
    "contacts.readonly",
    "contacts.write"
  ],
  "displayName": "My Connection Display Name",
  "email": "user@example.com",
  "identitySource": "manual",
  "isDefault": false
}'

$response = Invoke-RestMethod -Uri 'https://services.leadconnectorhq.com/marketplace/external-auth/migration' -Method 'POST' -Headers $headers -Body $body -ContentType 'application/json'
$response | ConvertTo-Json
```