Managing connections
Preview
Connected applications are currently available to selected accounts only.
Every application you connected is listed under Account > Connected applications in the portal, including the ones that have ended. For each one you see:
| Field | What it shows |
|---|---|
| Status | Active, Disconnected with the reason, or Expired |
| Permissions | What you allowed, in the consent screen's words |
| Connected | When you approved it, and from which IP address |
| Last presented | When the application last used its access |
| Valid until | The expiry you chose, or no end date |
| Third-country transfer | Whether you consented on the consent screen |
| Spending | May not spend, since no permission on offer buys anything |
The activity log
Show activity opens two lists for the connection.
What the application did
Every change is recorded before it runs. If the record cannot be written, the change is not made and the application receives:
this change cannot be recorded right now, so it was not made
Reading is not recorded: a tool that only reads leaves no entry. When the application last read anything shows under Last presented. Each entry shows the tool's title and name, the outcome and the date, then any addresses outside your domains it forwards to, the arguments that were kept, the values it replaced, and a note if any were shortened. Pointing at the outcome shows the HTTP status:
| Outcome | Meaning |
|---|---|
| In progress | Still running |
| Done | Carried out |
| Rejected | Refused because of the request, for example an invalid value |
| Failed | Went wrong on our side |
| Not allowed | The connection or your account lacks the permission |
| Result unknown | Cut off before it answered, so whether it changed anything is not known. Check the item it concerns |
An entry still In progress once the longest tool time limit plus 5 minutes has passed is marked Result unknown at the next check. That check runs every 30 minutes.
What is kept of the arguments
Only the arguments each tool names are kept in the clear, such as a record's name, type and content, or a forward's targets. All others are kept only as a keyed checksum, which cannot be turned back into the values. A verification code is not kept at all, not even in the checksum.
| Kept value | Limit | Beyond it |
|---|---|---|
| A text argument | 255 characters | Cut off, with the note "Some values were shortened or left out to fit." |
| A list | 50 entries | Shortened, with the same note |
| All arguments of one call together | 4,096 bytes | Values left out, with the same note |
| A value the change replaced, shown under Before: | 4,096 bytes, kept whole | Kept as its size and SHA-256 checksum, shown as "n bytes, too long to keep" |
A replaced value is kept whole or not at all because half of it cannot put it back. The checksum still tells you whether a value you have is the one that was replaced. Forwards to addresses outside your domains are listed separately, under Asked to forward mail outside your domains to:.
Refused requests
Requests we turned away because the connection lacks the access, each with the request, the reason, the permission it would have needed, the date and the client IP address. A request refused the same way again within an hour is recorded once, and at most 200 refusals per connection and 1,000 per account are recorded per day (UTC).
How long it is kept
| What | Kept for |
|---|---|
| What the application did | 12 months |
| Refused requests | 30 days |
| The connection and your consent | As long as your account exists, also after it ends |
Entries past their time are deleted once a day.
Limits on every connection
| Limit | Value | The application receives |
|---|---|---|
| Tool calls running at once | 3 per connection, 6 per account | calls_in_flight |
| Requests to the endpoint | 120 a minute per connection | HTTP status 429 |
| Recorded changes | 500 per connection per day (UTC) | call_ceiling_reached: "this connection has made as many changes as it may today" |
| Response size | 1 MiB per tool call | response_too_large |
The daily cap stops further changes rather than letting them run unrecorded. Each tool family has limits of its own, listed on its page.
The emails you get
All go to your account's email address.
| When | What the email says |
|---|---|
| You approve a connection | The application's name and every permission it holds |
| A connection you approved again gained permissions | The same, with what it may do now |
| A tool sets up a forward to an address outside your domains | The forwarded address and the new targets outside your domains |
Each email says first whether the application has a verified host. The name comes after that and is the one the application chose for itself, so it never appears in the subject line. If you did not connect the application, disconnect it at once and change your password.
Disconnecting
Disconnect on the connection ends it at once: the application loses all access to your account. It cannot be undone. To use the application again, connect it anew.
A connection also ends when:
- it reaches its Valid until date and shows Expired
- the application disconnects itself with
grant_revoke - you change or reset your account password, which disconnects every application
- ITSH support disconnects it, shown as disconnected by ITSH support
Disconnecting does not undo anything
Changes the application made stay made. Use the activity log to find them and reverse them yourself, in the portal or with another connection.
What's next
- Permissions for what to allow next time
- Email tools for forwards outside your domains