---
# @generated by sylphx-gen. Do not edit.
title: "Adopt a connection provider"
description: "`connections.connection_providers.adopt` (POST /v1/{parent}/connection_providers:adopt): Adopts an existing GitHub App whose non-exportable custody already exists."
type: reference
product: platform
summary: "Adopts an existing GitHub App whose non-exportable custody already exists."
updated: 2026-09-28
nav: false
---

Adopts an existing GitHub App whose non-exportable custody already exists. The server observes public SPKI metadata and verifies signed GET /app before atomically registering the SIGN Key and provider. No private key is accepted.

- **Path** `POST https://api.sylphx.com/v1/orgs/acme/connection_providers:adopt`
- **Scope** `connections:admin`
- **Effect** `write` — a successful call changes state.
- **Collection** [connection_providers](/docs/api/connection_providers)

## Request

| Field | Type | What it is |
| --- | --- | --- |
| `parent` | `string` | Organization owning both the provider and the public SIGN Key target. Required. |
| `connection_provider_id` | `string` | Explicit immutable provider identity. Required. |
| `github_app` | `GitHubAppConfig` | Existing App identity and unused full environment-scoped SIGN Key target. An optional webhook_secret must already name this organization's Secret. Required. |
| `reason` | `string` | Accountable operator's reason for adopting the existing App. Required. |

### GitHubAppConfig

| Field | Type | What it is |
| --- | --- | --- |
| `app_id` | `int64` | The App's numeric id. Required. |
| `slug` | `string` | The App's slug, for example `sylphx`. Required. |
| `client_id` | `string` | The App's OAuth client id. |
| `signing_key` | `string` | The imported, non-exportable SIGN Key (RS256) that signs App assertions; only the credential service may use it. Required. |
| `webhook_secret` | `string` | The Secret holding the webhook secret that verifies deliveries. |

## Response

| Field | Type | What it is |
| --- | --- | --- |
| `connection_provider` | `ConnectionProvider` | Provider ready for ordinary CreateConnection installation verification. |

### ConnectionProvider

| Field | Type | What it is |
| --- | --- | --- |
| `name` | `string` | `orgs/{org}/connection_providers/{connection_provider}`. |
| `uid` | `string` | `cnp_<cell><ulid>`. Output only. |
| `meta` | `ResourceMeta` | Resource metadata. |
| `spec` | `ConnectionProviderSpec` | Desired state. Required. |
| `status` | `ConnectionProviderStatus` | Observed state. Output only. |

### ResourceMeta

| Field | Type | What it is |
| --- | --- | --- |
| `generation` | `int64` | Increases by one on every change to `spec`. Output only. |
| `etag` | `string` | Strong ETag (AIP-154): changes on any change to spec, status, or metadata. Send it back as `If-Match` or `etag` to make Update and Delete conditional; a mismatch fails with ABORTED / 409 `ETAG_MISMATCH`. Output only. |
| `create_time` | `timestamp` | When the Resource was created. Output only. |
| `update_time` | `timestamp` | When the Resource last changed. Output only. |
| `delete_time` | `timestamp` | Set while the Resource is being deleted. Output only. |
| `labels` | `map<string, string>` | Caller-writable, indexed labels (AIP-122 label rules). |
| `annotations` | `map<string, string>` | Caller-writable, unindexed annotations. |
| `display_name` | `string` | Caller-writable human-readable name. |
| `creator` | `string` | The principal that created the Resource. Output only. |

### ConnectionProviderSpec

| Field | Type | What it is |
| --- | --- | --- |
| `github_app` | `GitHubAppConfig` | A GitHub App. One of the `config` group. |

### ConnectionProviderStatus

| Field | Type | What it is |
| --- | --- | --- |
| `observed_generation` | `int64` | The generation this status was computed from. Output only. |
| `conditions` | `Condition[]` | Ready, Reconciling, Stalled. Output only. |
| `kind` | `string` | The provider's plugin kind, for example `github_app`. Output only. |
| `connection_count` | `int32` | How many active Connections the provider has. Output only. |

### GitHubAppConfig

| Field | Type | What it is |
| --- | --- | --- |
| `app_id` | `int64` | The App's numeric id. Required. |
| `slug` | `string` | The App's slug, for example `sylphx`. Required. |
| `client_id` | `string` | The App's OAuth client id. |
| `signing_key` | `string` | The imported, non-exportable SIGN Key (RS256) that signs App assertions; only the credential service may use it. Required. |
| `webhook_secret` | `string` | The Secret holding the webhook secret that verifies deliveries. |

### Condition

| Field | Type | What it is |
| --- | --- | --- |
| `type` | `string` | The condition type, for example `Ready`. |
| `status` | `ConditionStatus` | Whether the condition holds. One of `true`, `false`, `unknown`. |
| `observed_generation` | `int64` | The generation this observation was made against. |
| `reason` | `string` | A machine-readable UpperCamelCase reason. |
| `message` | `string` | A customer-safe human-readable message. |
| `severity` | `Severity` | How severe a FALSE condition is. One of `info`, `warning`, `error`. |
| `transition_time` | `timestamp` | When `status` last changed. |

## Errors

- [`UNAUTHENTICATED`](/docs/api/errors/UNAUTHENTICATED) — No valid key or token was presented.
- [`PERMISSION_DENIED`](/docs/api/errors/PERMISSION_DENIED) — The key lacks the method's permission.
- [`INVALID_FIELD`](/docs/api/errors/INVALID_FIELD) — A field failed validation.
- [`INVALID_STATE`](/docs/api/errors/INVALID_STATE) — The Resource is in a state that forbids the call.
- [`RESOURCE_ALREADY_EXISTS`](/docs/api/errors/RESOURCE_ALREADY_EXISTS) — A Resource with this name exists.
- [`IDEMPOTENCY_KEY_REUSED`](/docs/api/errors/IDEMPOTENCY_KEY_REUSED) — An Idempotency-Key was reused with another body.
- [`IDEMPOTENCY_IN_PROGRESS`](/docs/api/errors/IDEMPOTENCY_IN_PROGRESS) — The first call with this Idempotency-Key is still running.

Every error arrives in the body [Errors](/docs/platform/errors) describes.

## Examples

**cURL**

```curl
curl -X POST "https://api.sylphx.com/v1/orgs/acme/connection_providers:adopt" \
  -H "Authorization: Bearer $SYLPHX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"connection_provider_id":"…","github_app":{"app_id":1,"signing_key":"…","slug":"…"},"reason":"…"}'
```

**TypeScript**

```ts
const response = await sylphx.connections.connectionProviders.adopt({ connectionProviderId: '…', githubApp: { appId: 1, signingKey: '…', slug: '…' }, parent: 'orgs/acme', reason: '…' })
```

**Rust**

```rust
let mut req = sylphx::connections::AdoptConnectionProviderRequest::default();
req.connection_provider_id = "…".to_string();
req.github_app = Some(sylphx::connections::GitHubAppConfig {
    app_id: 1,
    signing_key: "…".to_string(),
    slug: "…".to_string(),
    ..Default::default()
});
req.parent = "orgs/acme".to_string();
req.reason = "…".to_string();
let response = sx.connections().connection_providers().adopt(req).await?;
```

**CLI**

```bash
sylphx connections connection-providers adopt orgs/acme
```

**MCP**

```json
{ "method_id": "connections.connection_providers.adopt", "args": {"connection_provider_id":"…","github_app":{"app_id":1,"signing_key":"…","slug":"…"},"parent":"orgs/acme","reason":"…"} }
```