create-cloudflow-connection
dci create-cloudflow-connection
Creates a new cloud provider connection. Exactly one of gcpConfig or awsConfig must be supplied.
Returns 400 invalid_connection_config when both or neither are present.
Request
Content-Type: application/json
Schema
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable connection name."
},
"description": {
"type": "string",
"description": "Optional description."
},
"gcpConfig": {
"type": "object",
"description": "GCP connection configuration. Server-owned fields (status, deploymentCommand) are excluded.",
"properties": {
"organizationId": {
"type": "string"
},
"folderId": {
"type": "string"
},
"projectId": {
"type": "string"
},
"level": {
"type": "string",
"enum": [
"organization",
"folder",
"project"
]
},
"serviceAccountName": {
"type": "string"
},
"predefinedRoles": {
"type": "array",
"items": {
"type": "string"
}
},
"customRole": {
"type": "object",
"properties": {
"roleId": {
"type": "string"
},
"permissions": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"infraManagerProject": {
"type": "string"
},
"infraManagerLocation": {
"type": "string"
},
"infraManagerServiceAccount": {
"type": "string"
}
}
},
"awsConfig": {
"type": "object",
"description": "AWS connection configuration. Server-owned fields (context[].status, context[].nextStackOperation, stackSet) are excluded.",
"properties": {
"context": {
"type": "array",
"items": {
"type": "object",
"properties": {
"accountId": {
"type": "string"
},
"regions": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"roleName": {
"type": "string"
},
"permissions": {
"type": "object"
},
"managementAccount": {
"type": "string"
},
"organizationRootId": {
"type": "string"
},
"scopeTargetedOrganizationalUnitIds": {
"type": "array",
"items": {
"type": "string"
}
},
"scopeExplicitAccountIds": {
"type": "array",
"items": {
"type": "string"
}
},
"scopeExcludedAccountIds": {
"type": "array",
"items": {
"type": "string"
}
},
"scopeManagementAccountExplicitInScope": {
"type": "boolean"
}
}
},
"collaborators": {
"type": "array",
"items": {
"type": "object",
"properties": {
"email": {
"type": "string",
"format": "email"
},
"role": {
"type": "string",
"enum": [
"owner",
"editor",
"user"
]
}
}
}
},
"enabled": {
"type": "boolean",
"description": "When false, the connection is created in a disabled state.",
"default": true
}
}
}
Output
Created
By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.
| Field | Type | Description |
|---|---|---|
connectionId | string | Unique identifier for the connection. |
name | string | |
description | string | |
gcpConfig | object | GCP connection configuration. Server-owned fields (status, deploymentCommand) are excluded. |
gcpConfig.status | string | Server-managed GCP config status. |
gcpConfig.deploymentCommand | string | Generated deployment command. |
gcpConfig.organizationId | string | |
gcpConfig.folderId | string | |
gcpConfig.projectId | string | |
gcpConfig.level | string | One of: "organization", "folder", "project". |
gcpConfig.serviceAccountName | string | |
gcpConfig.predefinedRoles | array of string | |
gcpConfig.customRole | object | |
gcpConfig.customRole.roleId | string | |
gcpConfig.customRole.permissions | array of string | |
gcpConfig.infraManagerProject | string | |
gcpConfig.infraManagerLocation | string | |
gcpConfig.infraManagerServiceAccount | string | |
awsConfig | object | AWS connection configuration. Server-owned fields (context[].status, context[].nextStackOperation, stackSet) are excluded. |
awsConfig.context | array of object | |
awsConfig.context[].accountId | string | |
awsConfig.context[].regions | array of string | |
awsConfig.roleName | string | |
awsConfig.permissions | object | |
awsConfig.managementAccount | string | |
awsConfig.organizationRootId | string | |
awsConfig.scopeTargetedOrganizationalUnitIds | array of string | |
awsConfig.scopeExplicitAccountIds | array of string | |
awsConfig.scopeExcludedAccountIds | array of string | |
awsConfig.scopeManagementAccountExplicitInScope | boolean | |
collaborators | array of object | |
collaborators[].email | string (email) | |
collaborators[].role | string | One of: "owner", "editor", "user". |
enabled | boolean | false when the connection is disabled. |
status | string | Overall connection status. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Raw JSON schema
{
"type": "object",
"description": "A cloud provider connection used in CloudFlow workflows.",
"properties": {
"connectionId": {
"type": "string",
"description": "Unique identifier for the connection."
},
"name": {
"type": "string"
},
"description": {
"type": "string"
},
"gcpConfig": {
"allOf": [
{
"type": "object",
"description": "GCP connection configuration. Server-owned fields (status, deploymentCommand) are excluded.",
"properties": {
"organizationId": {
"type": "string"
},
"folderId": {
"type": "string"
},
"projectId": {
"type": "string"
},
"level": {
"type": "string",
"enum": [
"organization",
"folder",
"project"
]
},
"serviceAccountName": {
"type": "string"
},
"predefinedRoles": {
"type": "array",
"items": {
"type": "string"
}
},
"customRole": {
"type": "object",
"properties": {
"roleId": {
"type": "string"
},
"permissions": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"infraManagerProject": {
"type": "string"
},
"infraManagerLocation": {
"type": "string"
},
"infraManagerServiceAccount": {
"type": "string"
}
}
},
{
"type": "object",
"description": "Response extends request schema with server-owned read-only fields.",
"properties": {
"status": {
"type": "string",
"description": "Server-managed GCP config status."
},
"deploymentCommand": {
"type": "string",
"description": "Generated deployment command."
}
}
}
]
},
"awsConfig": {
"allOf": [
{
"type": "object",
"description": "AWS connection configuration. Server-owned fields (context[].status, context[].nextStackOperation, stackSet) are excluded.",
"properties": {
"context": {
"type": "array",
"items": {
"type": "object",
"properties": {
"accountId": {
"type": "string"
},
"regions": {
"type": "array",
"items": {
"type": "string"
}
}
}
}
},
"roleName": {
"type": "string"
},
"permissions": {
"type": "object"
},
"managementAccount": {
"type": "string"
},
"organizationRootId": {
"type": "string"
},
"scopeTargetedOrganizationalUnitIds": {
"type": "array",
"items": {
"type": "string"
}
},
"scopeExplicitAccountIds": {
"type": "array",
"items": {
"type": "string"
}
},
"scopeExcludedAccountIds": {
"type": "array",
"items": {
"type": "string"
}
},
"scopeManagementAccountExplicitInScope": {
"type": "boolean"
}
}
},
{
"type": "object",
"description": "Response extends request schema with server-owned read-only fields.",
"properties": {
"context": {
"type": "array",
"items": {
"type": "object",
"properties": {
"accountId": {
"type": "string"
},
"regions": {
"type": "array",
"items": {
"type": "string"
}
},
"status": {
"type": "string",
"description": "Server-managed per-account deployment status."
}
}
}
}
}
}
]
},
"collaborators": {
"type": "array",
"items": {
"type": "object",
"properties": {
"email": {
"type": "string",
"format": "email"
},
"role": {
"type": "string",
"enum": [
"owner",
"editor",
"user"
]
}
}
}
},
"enabled": {
"type": "boolean",
"description": "false when the connection is disabled."
},
"status": {
"type": "string",
"description": "Overall connection status."
},
"createdAt": {
"type": "string",
"format": "date-time"
},
"updatedAt": {
"type": "string",
"format": "date-time"
}
}
}
Errors
On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.
| HTTP status | Exit code | Error code | Meaning |
|---|---|---|---|
| 400 | 30 | VALIDATION_ERROR | The arguments or request body were rejected. Review the command's flags and payload. |
| 401 | 10 | AUTHENTICATION_FAILED | Not signed in, or the API token is invalid. Run dci login or check DCI_API_KEY. |
| 403 | 11 | PERMISSION_DENIED | The DoiT user or the active customer context does not have access. |
| 500 | 40 | API_SERVER_ERROR | The API failed to process the request. Retryable; contact DoiT support if it persists. |
Aliases: createcloudflowconnection