apiwhere

Connectors & sync

Connecting providers, scopes, sync behavior, and revocation.

Overview

Each connector stores one encrypted credential per provider instance. Sync jobs read billing and usage endpoints — not your application traffic.

Minimum scopes

We request the least privilege needed for each integration. Provider docs links in the Connectors UI show the exact key type required (e.g. admin keys for billing APIs).

Sync behavior

  • Initial sync when you connect a provider
  • Manual sync from the Connectors page
  • Automatic background sync every 30 minutes (syncworker)
  • Decrypt only in memory during each provider API call

Revocation

Disconnect a provider to delete the encrypted credential immediately. Sync stops and the audit log records the removal.

Troubleshooting

  • 401/403 errors — verify key scopes match provider docs
  • Stale sync — run manual sync or check connector status in Security posture
  • Billing unavailable — some keys are usage-only; check provider requirements

AWS — IAM role (enterprise)

AWS uses a cross-account IAM role with External ID — no long-lived access keys. APIWhere assumes the role to read CUR files from your S3 bucket.

  • Trust policy: allow APIWhere account to sts:AssumeRole with your External ID
  • Permissions: s3:ListBucket on CUR bucket, s3:GetObject on CUR prefix
  • Optional: ce:GetCostAndUsage for validation only
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::YOUR-CUR-BUCKET",
      "Condition": { "StringLike": { "s3:prefix": ["cur/apiwhere/*"] } }
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::YOUR-CUR-BUCKET/cur/apiwhere/*"
    }
  ]
}

AWS — Cost & Usage Reports

Enable a CUR report delivering Parquet or CSV.gz to S3. First files typically appear within 24 hours after activation.

  • Report name: e.g. ApiWhereCUR
  • Granularity: hourly or daily
  • Include: resource IDs and tags
  • Delivery: S3 bucket + prefix (match wizard step 2)
  • Sync: automatic every 30 minutes via syncworker

Google Cloud — BigQuery billing export

Export billing data to a BigQuery dataset. APIWhere queries the standard export table with a read-only service account.

  • Enable billing export in GCP Console → Billing → Billing export → BigQuery
  • Note dataset ID and table name (e.g. gcp_billing_export_v1_XXXXXX)
  • Create a service account with roles/bigquery.dataViewer on the export dataset
  • Download JSON key and paste in the Connectors wizard
  • First rows can take up to 24h after enabling export
{
  "role": "roles/bigquery.dataViewer",
  "members": ["serviceAccount:apiwhere-reader@YOUR_PROJECT.iam.gserviceaccount.com"]
}