Negotiate connector capabilities
A CMS module declares what it is (`cms`, `version`), which marketplace edition it runs as (`sku`) and which capabilities it can provide. The response is the effective set: only the capabilities that are declared, allowed by the SKU and covered by the organization's cloud plan are returned in `effective`; everything else is listed in `denied` with the reason (`not_declared`, `sku`, `plan`) and, for plan denials, the minimum tier required. The set can never exceed SKU ∩ plan — treat the response as the server-side contract for which features to switch on. A SKU that the current plan cannot carry at all (a `shop`, `b2b` or `enterprise` edition on the free tier) is refused with `403` and a `ConnectorHandshakeRefused` body. Stateless: call it after install and on a schedule, the platform stores nothing.
Операция для полного ключа
A CMS module declares what it is (cms, version), which marketplace edition it runs as (sku) and which capabilities it can provide. The response is the effective set: only the capabilities that are declared, allowed by the SKU and covered by the organization's cloud plan are returned in effective; everything else is listed in denied with the reason (not_declared, sku, plan) and, for plan denials, the minimum tier required. The set can never exceed SKU ∩ plan — treat the response as the server-side contract for which features to switch on. A SKU that the current plan cannot carry at all (a shop, b2b or enterprise edition on the free tier) is refused with 403 and a ConnectorHandshakeRefused body. Stateless: call it after install and on a schedule, the platform stores nothing.
Authorization
api_key_header Every request carries an organization API key. A key has one of two scopes. A full key reaches every operation in this document and belongs on your server. A search key is the one to ship in a browser widget or a storefront page: it reaches only the operations marked x-nova-key-scope: search — searching, federated search, recommendations, event ingestion, and the visitor-facing AI operations (semantic and image search, voice transcription and voice search, assistant chat, and the visitor's own conversation). It cannot write documents or read or change configuration; any other operation answers 403. AI operations are paid in credits from the organization's wallet whichever key calls them (402 when the balance runs out), and a search key needs X-NOVA-SESSION-ID on them: the session is what a conversation belongs to, and what the per-session allowance (429) is counted against. A key of either scope may additionally carry restrictions set in the console: an allowlist of collections (403 elsewhere), a forced filter_by per collection that is ANDed into every search (document-level access control), an allowlist of fields (include_fields is limited to it and a request naming any other field in query_by, facet_by, sort_by, filter_by or highlight_fields answers 400), an IP/CIDR allowlist and an Origin/Referer allowlist (403), and a per-key rate limit (429 with Retry-After).
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/connectors/handshake" \ -H "Content-Type: application/json" \ -d '{ "cms": "bitrix", "version": "1.8.0", "sku": "site", "capabilities": [ "full_export", "events", "sku_join" ] }'{ "plan": "starter", "sku": "site", "effective": [ "full_export", "events" ], "denied": [ { "capability": "sku_join", "reason": "plan", "requires": "pro" } ]}Create a connector POST
Creates a connector bound to one collection. The response includes the signing `secret` once — store it in the CMS module (`connector_id` / `connector_secret`). Catalogue writes then go through `POST /connectors/{id}/webhook`.
Retrieve a connector GET
Returns connector configuration (secret is not included; only `secret_preview`).