# Reauthorize a connection

> Replace the credentials of a connection after testing them on the app of a sync that uses it. The test covers that sync only, not the other syncs or API proxies of the connection. Answers the connection without its secrets.

Source: https://docs.stacksync.com/api-reference/connections/reauthorize_connection

`POST https://api.stacksync.com/v1/workspaces/{workspace_id}/connections/{connection_id}/reauthorize`

- Operation: `reauthorize_connection`
- Resource: Connections
- Access: writes data

## Authentication

- `Authorization: Bearer <key>`: A workspace API key (workspace_…, created by a workspace owner under Workspace settings > Stacksync API) acts with editor rights on that workspace only; a user API key (user_…, created under Profile > Stacksync API) acts as that user in every workspace they belong to. POST, PUT and PATCH requests must send Content-Type: application/json. Every authentication failure answers 403.
- `Content-Type: application/json` on every request with a body.

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | integer | Yes | The workspace the resources belong to |
| `connection_id` | string (uuid) | Yes | The connection to reauthorize |

## Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `region` | string (besg \| usnv) | Yes | Data region of the resources |

## Request body

`application/json`. The new credentials and the sync app to test them on

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `base_id` | string (uuid) | Yes | The sync whose app uses the connection |
| `app_id` | string | Yes | The app of the sync that uses the connection (its `app_id` in the sync) |
| `credentials` | object | Yes | The new credentials, in the shape the connection's app type takes (see the create connection body). `connection_id`, when sent, must be the connection of the path. |

## Returns

### 200 The reauthorized connection

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `data` | object (ConnectionDetails) | Yes | A connection as the connection routes answer it |
| `data.connection_id` | string (uuid) | Yes | The connection |
| `data.connection_name` | string | Yes | The name of the connection, unique in the workspace |
| `data.app_type` | string | Yes | The app the connection is for, as shown in Stacksync (for example `postgres`, `salesforce`, `supabase`) |
| `data.is_shared_with_workspace` | boolean | Yes | Whether every editor of the workspace can use the connection, or only the user who created it |
| `data.created_time` | string | Yes | When the connection was created. Local server time as `YYYY-MM-DD HH:MM:SS` (UTC) |
| `data.last_modified_time` | string | Yes | When the connection was last changed. Local server time as `YYYY-MM-DD HH:MM:SS` (UTC) |
| `data.credentials_options` | object | Yes | The non-secret settings of the connection. A database connection carries `uses_ssh_tunnel` (boolean) and `connection_mode` (`direct` or `ssh_tunnel`); a Salesforce connection carries `organization_id` and `instance_url`; a HubSpot connection carries its portal settings. Secrets are never answered. |

## Example request

```bash
curl -X POST "https://api.stacksync.com/v1/workspaces/{workspace_id}/connections/{connection_id}/reauthorize?region=besg" \
  -H "Authorization: Bearer $STACKSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "base_id": "3f6c1d2e-8a4b-4c7d-9e21-5b6f7a8c9d01",
  "app_id": "3f9a1c2e",
  "credentials": {
    "code": "aPrxk9...",
    "account_type": "standard"
  }
}'
```

## Example response (200)

```json
{
  "data": {
    "connection_id": "c7d8e9f0-2a3b-4c5d-9e6f-7a8b9c0d1e2f",
    "connection_name": "Salesforce production",
    "app_type": "salesforce",
    "is_shared_with_workspace": true,
    "created_time": "2026-10-01 09:12:44",
    "last_modified_time": "2026-10-01 09:12:44",
    "credentials_options": {
      "instance_url": "https://acme.my.salesforce.com",
      "organization_id": "00D5g000004abcdEAA"
    }
  }
}
```

## Errors

| Status | Meaning | Body |
| --- | --- | --- |
| 400 | The `region` is missing or not one of besg, usnv; `connection_id` is not a UUID; a body field is missing or of the wrong type; `base_id` and `app_id` name no app of a sync of the workspace (`Error reauthorizing connection`); the credentials miss a field the app type needs (`Invalid Credentials`); `credentials.connection_id` differs from the path; the app refused the credentials (`Error Authenticating`) | `{ "error": string }` |
| 403 | Forbidden: invalid API key, API key of another workspace, insufficient scope, workspace unavailable, or a non-GET request without `Content-Type: application/json` | `{ "error": string }` |

## Related

- [API Reference overview](https://docs.stacksync.com/api-reference): base URLs, regions, pagination, idempotency and errors
- [Authentication](https://docs.stacksync.com/api-reference/authentication): API keys and the 403 answers
- OpenAPI document: https://docs.stacksync.com/openapi.json
- [List connections](https://docs.stacksync.com/api-reference/connections/list_connections)
- [Get a connection](https://docs.stacksync.com/api-reference/connections/get_connection)
- [Create a connection](https://docs.stacksync.com/api-reference/connections/create_connection)
- [Update a connection](https://docs.stacksync.com/api-reference/connections/update_connection)
- [Delete a connection](https://docs.stacksync.com/api-reference/connections/delete_connection)