fivetran v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-fivetran-api-key

Custody

customer_vault

Injection

header (Authorization)

A Fivetran API key-secret pair, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Basic', one separating space, then the base64 of 'api_key:api_secret' — 'Basic <base64(api_key:api_secret)>'. Token issuance is external and manual: a key is generated in the Fivetran dashboard (username > API Key), and Fivetran shows the secret only once at generation; the deployment stores the encoded header value under this reference and the executor injects it verbatim — the injector performs no key lifecycle itself. A scoped API key is tied to the Fivetran user who generated it and inherits that user's RBAC permissions, tracking any later permission changes: generate the key from a dedicated least-privilege service user whose role covers only the groups and operations this pack registers (Fivetran also documents organization-managed System keys and, in private preview, service-account keys — either is preferable to a personal user's key where the plan supports it). Expiry and revocation: the pair does not expire on its own; regenerating the API secret instantly invalidates the old key-secret pair, and deleting the owning user deletes and revokes the key — because every request is authenticated against the key, revocation takes effect on the next call and there is no already-issued token that outlives it. An invalid pair fails closed with a 401. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• fivetran-account (api, internal): https://fivetran-api.invalid/v1

The endpoint host 'fivetran-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute Fivetran's real API host api.fivetran.com before enabling, in every endpoint, in the resource locator and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. The placeholder stands in for a single global API host that serves every Fivetran account (there is no per-tenant hostname); the account scoping comes from the API key, not the host. CONNECTION_ID in the paths is a placeholder the deployment binds to a concrete connection before enabling. Naming and versioning: Fivetran renamed 'connectors' to 'connections' in the current REST API; this pack registers the current /v1/connections/... paths (the legacy /v1/connectors/... aliases still serve the same operations but are not registered). The current API negotiates version 2 through the Accept header (application/json;version=2); the documented examples set it, and how the HTTP connector pins that header is a deployment binding decision — the registration records the endpoint, and a response rendered under a different negotiated version is a compatibility review, not a different capability. Tiering rationale: sync and re-sync are registered with the deploy action at the R3 floor rather than as ordinary executions — a sync moves customer data from source systems into the destination, and a historical re-sync re-reads the source and rewrites destination tables, so both are data-movement operations whose blast radius is the connected systems; deploy is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer). Documented exclusions — this pack does not register: connection creation (POST /v1/connections), because its config/auth payload embeds the source system's credentials and writing third-party secrets through a governed capability needs its own credential-handling review; Retrieve Connection Details (GET /v1/connections/{connectionId}), because the fetched connection-details page's response EXAMPLE echoes a credential-valued config field (api_key) — the example does not prove live responses return unmasked secrets, but the response must be treated as credential-bearing until proven otherwise, and a read that may return live secrets is excluded until the deployment demonstrates log and trace hygiene for response bodies (the collection read is registered instead); Move a Connection (POST /v1/connections/{connectionId}/move), whose BACKFILL and CONTINUE_WITH_DATA behaviors copy or rewrite data between destinations — transfer-class semantics requiring a separate review; the connection schema configuration endpoints (including PATCH schema/table/column config and drop-columns, which deletes columns from the destination); Run Connection Setup Tests; and the rest of the account-administration surface — users, teams, roles, system keys, certificates, external secrets managers, hybrid deployment agents, private links and webhooks (destination WRITES stay excluded; destination listing is registered above) — none of which the integration this pack models requires. A documented exclusion, not an approximated capability.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://fivetran.com/docs/rest-api/getting-started (retrieved 2026-09-21)
• https://fivetran.com/docs/developer-resources/rest-api/api-reference/connections (retrieved 2026-09-21)
• https://fivetran.com/docs/developer-resources/rest-api/api-reference/connections/sync-connection (retrieved 2026-09-21)
• https://fivetran.com/docs/rest-api/api-reference/connections/resync-connection (retrieved 2026-09-21)
• https://fivetran.com/docs/developer-resources/rest-api/api-reference/connections/delete-connection (retrieved 2026-09-21)
• https://fivetran.com/docs/rest-api/api-reference/destinations (retrieved 2026-09-21)
• https://fivetran.com/docs/rest-api/api-reference/connector-metadata/metadata-connectors (retrieved 2026-09-21)
• https://fivetran.com/docs/rest-api/api-reference/connections/connection-details (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.