Capability library / Application package

Fivetran package v1.0.0

Read Fivetran destinations, connector types, and connections; update connection settings, start syncs or historical re-syncs, and delete connections. Updates can resume scheduled data movement or carry source credentials.

Review state: Reviewed · Distributable: yes, digest matches the release manifest

This page describes AAES Govern’s controls. AAES Operate has private-work permissions, operational reviews and recorded-spend limits; it does not include Govern. About AAES Govern

Before you enable this package

The endpoint host 'fivetran-api.invalid' is a reserved .invalid placeholder that fails closed until you substitute the real host in both the endpoint URLs and the egress allowlist.

Read each action's effects and exclusions below. Before installation, also read the complete package requirements, including credential issuance, scope, expiry, and provider permissions. These are deployment prerequisites, not capabilities this package supplies.

Capabilities (7)

Each capability below is one registered operation. The complete package JSON includes its exact network destination allowlist. The repository stores it at packs/fivetran.json and embeds a copy in the release binary.

Risk tiers. R0 is the minimum for reads. R2 is the minimum for write, create, update, execute, and invoke. R3 is the minimum for delete, send, pay, deploy, approve, share, and transfer. Operators can raise these levels. A minimum tier does not measure the operation's business or confidentiality risk.

On supported execution paths routed through AAES Govern, the R3 actions listed below require approval by an authorized person. Bypass paths and observation-only registrations are outside that guarantee. A provider's restoration feature does not remove this approval requirement. A provider-side approval, such as approving a GitLab merge request, is also separate from AAES Govern human approval. The capability matrix shows which execution paths are implemented, restricted to lab use, or refused at startup. Live compatibility must be tested in your environment.

Field guide. Endpoint is the service address and request method. Connector is the adapter that makes the call. Custody describes how the credential is held; the credential reference identifies the value to resolve. Data class sets handling requirements: pii means personal data, financial means financial records, and internal means internal organizational data.

fivetran.destinations.read v1.0.0R0

Kind
tool
Action
read
Endpoint
GET https://fivetran-api.invalid/v1/destinations
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Read destinations.

List the account's destinations; this pack registers the collection read only — single-destination reads are not registered. Destination records reveal where the organization lands its replicated data (service, region, group ids), which is internal infrastructure information.

The host is a reserved placeholder: substitute api.fivetran.com before enabling.

fivetran.metadata.connectors.read v1.0.0R0

Kind
tool
Action
read
Endpoint
GET https://fivetran-api.invalid/v1/metadata/connector-types
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Read connector metadata.

List the available connector types and their internal service identifiers and configuration schemas — vendor catalog information used to build connection requests, classified as internal data because the response drives downstream provisioning decisions. The registered path is the current '/v1/metadata/connector-types' shown on the fetched metadata-connectors reference page (the legacy '/v1/metadata/connectors' path was sunset in 2022).

The host is a reserved placeholder: substitute api.fivetran.com before enabling.

fivetran.connections.read v1.0.0R0

Kind
tool
Action
read
Endpoint
GET https://fivetran-api.invalid/v1/connections
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Read connections.

List the account's connections (List All Connections); this pack registers the collection read only — Retrieve Connection Details (GET /v1/connections/{connectionId}) is deliberately not registered because the fetched connection-details page's response example echoes a credential-valued config field — the example does not prove live responses return unmasked secrets, but the detail response must be treated as credential-bearing until proven otherwise, and a read that may return live secrets needs a response-handling review this pack has not done.

Connection records reveal which systems replicate into which destination, their schedules and their sync state — internal pipeline information.

The host is a reserved placeholder: substitute api.fivetran.com before enabling.

fivetran.connection.update v1.0.0R3

Kind
tool
Actions
update, deploy
Endpoint
PATCH https://fivetran-api.invalid/v1/connections/CONNECTION_ID
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Update connection.

Update one connection's mutable fields — pausing and resuming (paused), the scheduling method (schedule_type auto or manual; setting manual makes every subsequent sync occur only through an explicit trigger call), the sync frequency and the networking settings. Resuming a paused connection or setting schedule_type to auto re-enables provider-side execution: Fivetran's scheduler then moves customer data on its own without traversing fivetran.connection.sync.trigger, so the update carries the deploy-class effect and the capability declares update and deploy at the minimum R3 tier.

This registration does not restrict which fields the request body may carry: the body can also carry config values, which for many services are source credentials, so a request body can itself contain live secrets and must be handled like one. A reviewer who intends pause-only must impose that in policy, because intended limits need a separate enforceable control. CONNECTION_ID is a placeholder the deployment binds before enabling.

fivetran.connection.sync.trigger v1.0.0R3

Kind
tool
Actions
deploy, delete
Endpoint
POST https://fivetran-api.invalid/v1/connections/CONNECTION_ID/sync
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Trigger connection sync.

Trigger a data sync for one connection without waiting for its schedule. Registered with the deploy action at the minimum R3 tier rather than as an ordinary execution: the sync moves customer data from the source system into the destination, overwriting destination state, and that data movement is not reversed by a later call. Deploy is one of the designated actions requiring human approval.

On supported execution paths mediated by AAES Govern, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths.

Request body: the documented body is {"force": true|false}; the fetched sync-connection page confirms force=true 'will stop the sync and re-run it' — terminating an in-flight sync is a terminate-class, irreversible interruption (the interrupted sync's partial work is not rolled back), so the delete action is declared alongside deploy; an empty body syncs only if the connection is idle. The registration does not restrict the body, so the interrupt-in-flight behavior is in scope. CONNECTION_ID is a placeholder the deployment binds before enabling.

fivetran.connection.resync v1.0.0R3

Kind
tool
Action
deploy
Endpoint
POST https://fivetran-api.invalid/v1/connections/CONNECTION_ID/resync
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Resync connection.

Trigger a full historical re-sync of a connection. Registered with the deploy action at the minimum R3 tier: a re-sync re-reads the source from the beginning and rewrites the destination tables — heavier than a sync on both the source system (full re-extract) and the destination (rewritten tables), and it is not reversed by a later call. Deploy is one of the designated actions requiring human approval.

Request body: the documented body is an optional scope object mapping schema names to non-empty arrays of table names; omitting it re-syncs every schema and table of the connection, which is the default a caller gets with an empty body. The API declines with 409 while another sync is in progress and re-syncs a paused connection when it is re-enabled — documented timing behaviors, not restrictions this pack imposes. CONNECTION_ID is a placeholder the deployment binds before enabling.

fivetran.connection.delete v1.0.0R3

Kind
tool
Action
delete
Endpoint
DELETE https://fivetran-api.invalid/v1/connections/CONNECTION_ID
Connector
http
Custody
customer_vault
Credential ref
secret-ref-fivetran-api-key
Data class
internal

Delete connection.

Delete a connection from the Fivetran account. The pipeline definition — source configuration, sync cursor, schedule — is removed; recreating the connection later starts as a new pipeline (a new initial sync), not an undo of this call, and any downstream models or dashboards fed by the connection stop updating. Registered as delete at the minimum R3 tier; delete is one of the designated actions requiring human approval. CONNECTION_ID is a placeholder the deployment binds before enabling.

Credential reference

The credential field names a reference rather than containing credential material. Packs are designed not to contain secrets; the format checks cover only known credential formats and cannot prove that arbitrary text contains no secrets. Installing a package registers its capabilities. Configure the provider credentials, endpoints, and network access, then test the integration in your environment before enabling it.

Reference
secret-ref-fivetran-api-key
Custody
customer_vault
Injection
header (Authorization)

Configure the value and injection format specified in the package. Assign responsibility for credential rotation and revocation, restrict provider permissions, and keep credential material out of logs and responses.

Complete credential requirements

A Fivetran API key-secret pair, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Basic', one separating space, then the base64 of 'api_key:api_secret' — 'Basic <base64(api_key:api_secret)>'.

Token issuance is external and manual: a key is generated in the Fivetran dashboard (username > API Key), and Fivetran shows the secret only once at generation; the deployment stores the encoded header value under this reference and the executor injects it verbatim — the injector performs no key lifecycle itself.

A scoped API key is tied to the Fivetran user who generated it and inherits that user's RBAC permissions, tracking any later permission changes: generate the key from a dedicated least-privilege service user whose role covers only the groups and operations this pack registers (Fivetran also documents organization-managed System keys and, in private preview, service-account keys — either is preferable to a personal user's key where the plan supports it).

Expiry and revocation: the pair does not expire on its own; regenerating the API secret instantly invalidates the old key-secret pair, and deleting the owning user deletes and revokes the key — because every request is authenticated against the key, revocation takes effect on the next call and there is no already-issued token that outlives it. An invalid pair fails closed with a 401.

Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

Resources

  • fivetran-account (api, internal): https://fivetran-api.invalid/v1

Technical package and review record

Complete provider requirements and exclusions

The endpoint host 'fivetran-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute Fivetran's real API host api.fivetran.com before enabling, in every endpoint, in the resource locator and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. The placeholder stands in for a single global API host that serves every Fivetran account (there is no per-tenant hostname); the account scoping comes from the API key, not the host.

CONNECTION_ID in the paths is a placeholder the deployment binds to a concrete connection before enabling.

Naming and versioning: Fivetran renamed 'connectors' to 'connections' in the current REST API; this pack registers the current /v1/connections/... paths (the legacy /v1/connectors/... aliases still serve the same operations but are not registered). The current API negotiates version 2 through the Accept header (application/json;version=2); the documented examples set it, and how the HTTP connector pins that header is a deployment binding decision — the registration records the endpoint, and a response rendered under a different negotiated version is a compatibility review, not a different capability.

Approval classification: sync and re-sync are registered with the deploy action at the minimum R3 tier rather than as ordinary executions — a sync moves customer data from source systems into the destination, and a historical re-sync re-reads the source and rewrites destination tables, so both are data-movement operations whose scope of impact is the connected systems; deploy is one of the designated actions requiring human approval.

Documented exclusions — this pack does not register: connection creation (POST /v1/connections), because its config/auth payload embeds the source system's credentials and writing third-party secrets through a governed capability needs its own credential-handling review; Retrieve Connection Details (GET /v1/connections/{connectionId}), because the fetched connection-details page's response EXAMPLE echoes a credential-valued config field (api_key) — the example does not prove live responses return unmasked secrets, but the response must be treated as credential-bearing until proven otherwise, and a read that may return live secrets is excluded until the deployment demonstrates log and trace hygiene for response bodies (the collection read is registered instead); Move a Connection (POST /v1/connections/{connectionId}/move), whose BACKFILL and CONTINUE_WITH_DATA behaviors copy or rewrite data between destinations — transfer-class semantics requiring a separate review; the connection schema configuration endpoints (including PATCH schema/table/column config and drop-columns, which deletes columns from the destination); Run Connection Setup Tests; and the rest of the account-administration surface — users, teams, roles, system keys, certificates, external secrets managers, hybrid deployment agents, private links and webhooks (destination WRITES stay excluded; destination listing is registered above) — none of which the integration this pack models requires.

Download the complete package JSON for exact network allowlists, credential requirements, exclusions, and setup notes. Read these requirements before installation.

The full documentation review record is supplied in the evaluation package. The evaluation package runs in your environment and comes only with the paid design partnership. This page reproduces the source links and review block; the full record is available for evaluation. Discuss a design partnership to inspect it before installation.

Review block

This section reproduces the review block recorded in the pack file. The evidence and approval record is separate: for a reviewed pack, it is in the evaluation materials and in the release binary's embedded assets.

Review completed: 2026-09-22

10 sources, retrieved 2026-09-21

Current documentation links are navigation aids. They do not change the package, its historical sources or its review date. Review dates describe a documentation review, not a live integration test. No package is provider-endorsed or yet tested against a live provider tenant.

Release identity

SHA-256 of the pack file bytes: c80c67b15eadb7289a330a4b6c1f730725a352c5439ccf6b13a566de156cf9cb

Distributable: yes, digest matches the release manifest. Editing a package changes its release identity. A deployment plan checks its own file digests; it does not restore reviewed status or authenticate approval.