A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.
The Fivetran API is how an app or AI agent manages a data pipeline: creating and listing connections, triggering syncs and historical re-syncs, editing destinations, and adjusting which schemas, tables, and columns are synced. Access is granted through an API key and secret sent in the request, and a scoped key is limited to what its owner's role can reach while a system key reaches the whole account. Fivetran can also push an event to a webhook URL when a sync starts or finishes.
How an app or AI agent connects to Fivetran determines what it can reach. There is one main route, the REST API, plus a first-party MCP server, and both are governed by the API key and secret behind them.
The REST API answers at https://api.fivetran.com under the v1 path. Calls authenticate with an API key and secret over HTTP Basic auth, and successful responses wrap the result in a data object.
Fivetran's first-party MCP server lets an agent call the Fivetran API through the Model Context Protocol. It is run locally, fetched and started with uvx from github.com/fivetran/fivetran-mcp, and exposes around 150 tools across connections, destinations, groups, webhooks, and more. Writes are off unless FIVETRAN_ALLOW_WRITES is set to true, and it confirms before each write.
Webhooks deliver the chosen events, such as sync_start and sync_end, to a receiver URL registered at the account or group level, so an app learns when a sync starts or finishes without polling.
A scoped API key is generated by a user in the dashboard and inherits that user's role-based access, so it reaches only the connections, destinations, and groups that role allows. It is the least-privilege choice for connecting to Fivetran.
A system API key is managed at the organization level, with permissions set on the key itself rather than inherited from a user. A system key set as Account Administrator reaches the whole account.
The Fivetran API is split into areas an agent can act on, such as connections, destinations, groups, users, and schemas. Each area has its own methods, and the same API key reaches every area its account-level access allows.
List, read, create, update, and delete connections, trigger an incremental sync or a historical re-sync, run setup tests, and generate a Connect Card.
Read a connection's schema config, reload it from the source, and change which schemas, tables, and columns are synced.
List, read, create, update, and delete destinations, and run their setup tests.
List, read, create, update, and delete groups, and list the connections and users inside a group.
List users, invite a new user, read a user, update a user, and delete a user.
List teams, read a team, and list the users in a team.
List the predefined and custom roles in the account.
List webhooks, create an account or group webhook, read, update, delete, and test a webhook.
List a connection's approved certificates, read one by hash, and approve a certificate so Fivetran trusts it.
List log services, create one, read it, update it, and delete it to stream Fivetran logs to an external service.
Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.
| Method | Endpoint | What it does | Access | Permission | Version | |
|---|---|---|---|---|---|---|
ConnectionsList, read, create, update, and delete connections, trigger an incremental sync or a historical re-sync, run setup tests, and generate a Connect Card.9 | ||||||
| GET | /v1/connections | List all connections in the account. | read | — | Current | |
Returns the connections the key's role can reach. Fivetran has no per-endpoint scopes; access follows the role behind the key. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/connections/{connectionId} | Retrieve the details of a single connection. | read | — | Current | |
Access follows the role behind the key. The older /v1/connectors/{connectorId} path still works. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections | Create a connection, naming the service, the group, and the connection config. | write | — | Current | |
Subject to a separate hourly cap on connection creation. Access follows the role behind the key. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitMax 100 connections created hourly SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/connections/{connectionId} | Update a connection, including pausing or resuming it through the paused field, and changing its schedule or config. | write | — | Current | |
Pausing and resuming a connection is done by setting paused here; there is no separate pause endpoint. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /v1/connections/{connectionId} | Delete a connection permanently. | write | — | Current | |
Permanent. Access follows the role behind the key. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections/{connectionId}/sync | Trigger an incremental sync of a connection. | write | — | Current | |
Starting a sync fires the sync_start event to any webhook subscribed to it. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook event sync_startRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections/{connectionId}/resync | Trigger a historical re-sync of a connection, optionally for selected tables. | write | — | Current | |
A historical re-sync reloads data from the source and can run far longer than an incremental sync. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook event sync_startRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections/{connectionId}/test | Run a connection's setup tests. | write | — | Current | |
Setup-test calls fall under the separate, lower per-minute rate limit for setup tests. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitSetup-test limit: 250/min (25/min on trial) SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections/{connectionId}/connect-card | Generate a Connect Card URL so a user can finish authorizing a connection. | write | — | Current | |
The Connect Card hands the credential-entry step to an end user in a hosted page. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Connection schemasRead a connection's schema config, reload it from the source, and change which schemas, tables, and columns are synced.5 | ||||||
| GET | /v1/connections/{connectionId}/schemas | Retrieve a connection's schema config, listing its schemas, tables, and columns and whether each is synced. | read | — | Current | |
The schema config exists only after the first sync or after a reload. Acts onschema Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections/{connectionId}/schemas/reload | Reload a connection's schema config from the source to pick up new schemas, tables, and columns. | write | — | Current | |
An exclude_mode value controls how newly found objects are treated, such as EXCLUDE. Acts onschema Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/connections/{connectionId}/schemas | Update a connection's schema config, setting the default behavior for new schemas and tables. | write | — | Current | |
Changes what gets synced into the destination, so it changes the data downstream tools see. Acts onschema Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/connections/{connectionId}/schemas/{schemaName}/tables/{tableName} | Update a single table's config, enabling or disabling it and setting its sync mode. | write | — | Current | |
Schema and table names are case-sensitive; the wrong case returns 404. Acts ontable Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/connections/{connectionId}/schemas/{schemaName}/tables/{tableName}/columns/{columnName} | Update a single column's config, enabling or disabling it or hashing it. | write | — | Current | |
Column names are case-sensitive; the wrong case returns 404. Acts oncolumn Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
DestinationsList, read, create, update, and delete destinations, and run their setup tests.5 | ||||||
| GET | /v1/destinations | List all destinations in the account. | read | — | Current | |
Access follows the role behind the key. Acts ondestination Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/destinations/{destinationId} | Retrieve the details of a single destination. | read | — | Current | |
Access follows the role behind the key. Acts ondestination Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/destinations | Create a destination in a group, naming the warehouse service and its config. | write | — | Current | |
Access follows the role behind the key. Acts ondestination Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/destinations/{destinationId} | Update an existing destination's config. | write | — | Current | |
Access follows the role behind the key. Acts ondestination Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /v1/destinations/{destinationId} | Delete a destination permanently. | write | — | Current | |
Permanent. Access follows the role behind the key. Acts ondestination Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
GroupsList, read, create, update, and delete groups, and list the connections and users inside a group.6 | ||||||
| GET | /v1/groups | List all groups in the account. | read | — | Current | |
A group holds one destination and the connections that load into it. Acts ongroup Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/groups | Create a group. | write | — | Current | |
Access follows the role behind the key. Acts ongroup Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/groups/{groupId} | Update a group's settings, such as its name. | write | — | Current | |
Access follows the role behind the key. Acts ongroup Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /v1/groups/{groupId} | Delete a group permanently. | write | — | Current | |
Permanent. Access follows the role behind the key. Acts ongroup Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/groups/{groupId}/connections | List the connections within a group. | read | — | Current | |
Access follows the role behind the key. Acts onconnection Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/groups/{groupId}/users | List the users with access to a group. | read | — | Current | |
Access follows the role behind the key. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
UsersList users, invite a new user, read a user, update a user, and delete a user.5 | ||||||
| GET | /v1/users | List the users in the account. | read | — | Current | |
Returns people, including their account-level role. Access follows the role behind the key. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/users | Invite a new user to the account. | write | — | Current | |
Adds a person who can reach the account; an account-administrator key is needed. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/users/{userId} | Retrieve the details of a single user. | read | — | Current | |
Access follows the role behind the key. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/users/{userId} | Update a user's profile or account role. | write | — | Current | |
Can change what a person is allowed to do; an account-administrator key is needed. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /v1/users/{userId} | Remove a user from the account permanently. | write | — | Current | |
Permanent. An account-administrator key is needed. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
TeamsList teams, read a team, and list the users in a team.3 | ||||||
| GET | /v1/teams | List the teams in the account. | read | — | Current | |
A team groups users and the permissions they share. Acts onteam Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/teams/{teamId} | Retrieve the details of a single team. | read | — | Current | |
Access follows the role behind the key. Acts onteam Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| GET | /v1/teams/{teamId}/users | List the users in a team. | read | — | Current | |
Access follows the role behind the key. Acts onuser Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
RolesList the predefined and custom roles in the account.1 | ||||||
| GET | /v1/roles | List the predefined and custom roles in the account. | read | — | Current | |
Roles are the access levels assigned to users and teams; this lists them, it does not change them. Acts onrole Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
WebhooksList webhooks, create an account or group webhook, read, update, delete, and test a webhook.6 | ||||||
| GET | /v1/webhooks | List all webhooks in the account. | read | — | Current | |
Access follows the role behind the key. Acts onwebhook Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/webhooks/account | Create an account-level webhook that fires for the chosen events across the account. | write | — | Current | |
The events array names which events fire, such as sync_start and sync_end. Acts onwebhook Permission (capability)None required VersionAvailable since the API’s base version Webhook event sync_endRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/webhooks/group/{groupId} | Create a group-level webhook that fires for the chosen events within one group. | write | — | Current | |
Scoped to one group, otherwise the same as an account webhook. Acts onwebhook Permission (capability)None required VersionAvailable since the API’s base version Webhook event sync_endRate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/webhooks/{webhookId} | Update a webhook, such as its URL or its event list. | write | — | Current | |
Access follows the role behind the key. Acts onwebhook Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| DELETE | /v1/webhooks/{webhookId} | Delete a webhook. | write | — | Current | |
Access follows the role behind the key. Acts onwebhook Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/webhooks/{webhookId}/test | Send a test event to a webhook to confirm its receiver works. | write | — | Current | |
Posts a sample payload of the chosen event to the receiver URL. Acts onwebhook Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
CertificatesList a connection's approved certificates, read one by hash, and approve a certificate so Fivetran trusts it.2 | ||||||
| GET | /v1/connections/{connectionId}/certificates | List the approved certificates for a connection. | read | — | Current | |
Certificates are the TLS certificates a connection is set to trust. Acts oncertificate Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/connections/{connectionId}/certificates | Approve a certificate so Fivetran trusts it for a connection. | write | — | Current | |
Setup tests fail until a self-signed or private-CA certificate is approved here, by hash and base64-encoded cert. Acts oncertificate Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Log servicesList log services, create one, read it, update it, and delete it to stream Fivetran logs to an external service.3 | ||||||
| GET | /v1/external-logging | List the log services configured in the account. | read | — | Current | |
A log service streams Fivetran activity logs to an external destination, such as Datadog or CloudWatch. Acts onlog service Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| POST | /v1/external-logging | Create a log service to stream Fivetran logs to an external service. | write | — | Current | |
Supported services include Datadog, CloudWatch, Azure Monitor, Google Cloud Logging, Splunk, Grafana Loki, and New Relic. Acts onlog service Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
| PATCH | /v1/external-logging/{logId} | Update a log service's config. | write | — | Current | |
Access follows the role behind the key. Acts onlog service Permission (capability)None required VersionAvailable since the API’s base version Webhook eventNone Rate limitStandard limits apply SourceOfficial documentation ↗ | ||||||
Fivetran can notify an app or AI agent when a sync starts or finishes, instead of the app repeatedly asking. Fivetran posts the event payload to a webhook URL that has been registered at the account or group level.
| Event | What it signals | Triggered by |
|---|---|---|
sync_start | Fires when a sync begins for a connection, whether it was triggered manually, on schedule, or by the API. | /v1/connections/{connectionId}/sync/v1/connections/{connectionId}/resync |
sync_end | Fires when a sync finishes for a connection, carrying the outcome of the sync. | /v1/webhooks/account/v1/webhooks/group/{groupId} |
Fivetran limits how fast an app or AI agent can call, splitting requests into setup-test calls and source-interaction calls, each with its own per-minute ceiling, plus separate hourly caps on actions like creating connections.
Fivetran splits requests into two pools with separate per-minute ceilings. Setup-test calls, the ones that contact a source to validate a connection, are capped at 250 per minute on paid plans and 25 per minute on a trial. Source-interaction calls are capped at 500 per minute on paid plans and 25 per minute on a trial. Some actions also carry their own hourly cap, such as no more than 100 connections created per hour. The response headers X-Rate-Limit and X-Rate-Limit-Remaining report the request quota for the current rolling one-hour window. Exceeding a limit returns HTTP 429 with a Retry-After header giving the number of seconds to wait before retrying.
List endpoints use cursor-based pagination. A response includes a next_cursor when more records remain, which is passed back as the cursor query parameter to fetch the next page. The limit parameter sets the page size, accepting 1 to 1000 with a default of 100.
Requests and responses are JSON. Successful responses wrap the result in a data object, while error responses return only a code and a message. There is no single documented payload size limit across the whole API.
The status codes an agent should handle, and what to do about each.
| Status | Code | Meaning | What to do |
|---|---|---|---|
| 400 | BadRequest | The request was malformed, or a required field is missing or invalid. The body returns a code and a message naming the problem. | Read the message, correct the request body or parameters, and resend. |
| 401 | Unauthorized | The API key or secret is missing, malformed, or invalid. | Check the Base64-encoded api_key:api_secret in the Authorization header and send valid credentials. |
| 403 | Forbidden | The credentials are valid but the role behind the key does not have access to the resource or action. | Use a key whose role covers the resource, or grant that role the access in Fivetran. |
| 404 | NotFound | The resource does not exist, or a path part is in the wrong case. Schema, table, and column names are case-sensitive. | Confirm the id and the exact case of any schema, table, or column name, then retry. |
| 429 | TooManyRequests | A rate limit was exceeded, either the per-minute setup-test or source-interaction limit, or an hourly cap such as no more than 100 connections created hourly. | Honor the Retry-After header, which gives the seconds to wait, before retrying. |
Fivetran serves a single REST API under one path version, v1, and ships changes continuously rather than minting new dated versions. Notable changes appear in the dated release notes.
The Fivetran REST API serves one path version, v1, at api.fivetran.com. Fivetran does not mint new dated API versions; it ships changes continuously and records them in monthly dated release notes. The timeline below tracks notable platform-level changes, not the steady stream of per-connector additions.
Modifying a user's account_role through the API and the dashboard was deprecated, tightening how account-level access is changed programmatically.
The Connector Management API was renamed to the Connection Management API, the rename behind connector paths becoming connection paths. Response timestamps also moved to microsecond precision.
The Log Service Management API was implemented, letting an account stream Fivetran logs to an external service through the API. Connector SDK connections also became manageable via REST.
The System Keys REST API resource was implemented, giving accounts an API key not tied to a single user, with permissions managed on the key itself.
The Webhook Management API reached general availability, making account and group webhooks a supported way to receive sync events.
Scoped API keys were launched, letting a user generate a key that inherits their role-based access rather than full account access.
There is one current path version; the timeline below tracks notable dated changes to it.
Fivetran REST API changelog ↗Bollard AI sits between a team's AI agents and Fivetran. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.