> ## Documentation Index > Fetch the complete documentation index at: https://docs.usenexio.com/llms.txt > Use this file to discover all available pages before exploring further. # List a connection's tables > List the source tables registered on a connection that the person may read, with their owner, filter, access requirement and columns. ## Behavior The response is the one list envelope, with every registered table of the connection the person may read in a single page, sorted by name. A table whose requirement the person's access policy does not grant is not listed: without the accounting dataset, no accounting table appears, exactly as reading one answers 403 `CAPABILITY_DENIED`. Each entry in `data` names the `table` (the name to read it by), the fully qualified source `object`, the `system` it belongs to (`ams360` for the system of record's replica, `warehouse` for a curated warehouse table), its `owner` (`policy`, `account`, `claim` or `none`), the `requirement` it is read under, its match `filter` and whether that filter is required, and its `columns`. Each column carries its field `class`, its `state` (`served` or `proven` when a collection field serves it, `estate_only` when only this surface reads it) and `feeds`, the collection fields it serves. The listing reads no rows. `{id}` is one of your organization's connection ids, or `sandbox` for the sandbox seat's view of it. Any other id answers 404 `NOT_VISIBLE_OR_ABSENT`. This route is for lineage, operators and proofs. Product code reads collections under `/records`. See [Source tables](/data-services/source-tables). ## OpenAPI ````yaml GET /connections/{id}/tables openapi: 3.1.0 info: title: Nexio API version: '1.0' description: | The Nexio public API. Submit runs to configured engines and read their results, hold conversations with configured assistants, make authorized reads over the planes and families of a connected system of record, and manage webhooks and environments. Six engine types are registered: comparison, matching, entity_analysis, diligence, triage, and opportunity. Every route under /api/v1/ requires `Authorization: Bearer `, except inbound event ingest (`POST /api/v1/events/ingest/{source_key}`), which authenticates each request against its ingest source instead: an HMAC-SHA256 signature for `nexio` and `github` sources, or a shared authentication code for an `ams360_ons` source. Error bodies share the `Error` schema. Call the API from servers only: it sends no CORS headers. contact: email: support@usenexio.com url: https://docs.usenexio.com servers: - url: https://api.usenexio.com description: >- Nexio API. Sandbox or live is chosen by the API key's environment, not by the host. security: - BearerAuth: [] tags: - name: EngineManagement description: >- Create, configure, version and manage engines. An engine is a configuration of one registered engine type. - name: Engines description: Engine-scoped endpoints for submitting runs and retrieving results. - name: Runs description: Retrieve and reconcile submitted runs. - name: Records description: >- Typed, authorized reads of the collections a connected system of record serves, and governed writes to the action ledger. - name: Connections description: >- The source tables registered on a connection, read by their own names: the estate surface, for lineage, operators and proofs. Product code reads collections under Records. - name: Graph description: >- The organization's data graph: a read-only map of connections and the derivations scheduled on them. Node kinds are a closed registry of 16; the API serves 14. - name: Environments description: >- The live environment and up to 5 sandbox environments in your org. Organization keys only. - name: Webhooks description: >- Manage webhook endpoints that receive terminal run events (run.completed, run.failed, run.cancelled) and run corrections (run.superseded). - name: Events description: >- Send inbound events to your organization's event log through an ingest source. Source kinds are nexio, github, ams360_ons and inbound_mail; a nexio source sends event types from your own vocabulary. - name: Converse description: The raw stateless conversational model turn (caller-owned state). - name: Conversations description: >- Conversation instances (orchestrators over engines) and their managed conversations, turns, annotations, evals, and exports. - name: Platform description: Service health. No key needed. paths: /connections/{id}/tables: get: tags: - Connections summary: List a connection's tables description: >- The source tables registered on the connection that the person may read, in one page sorted by name: the system of record's own objects and the curated warehouse tables beside them. A table whose access requirement the person's access policy does not grant, such as an accounting table without the accounting dataset, is not listed, exactly as reading it answers 403. Each entry names the table, the source object, its system, its owner (the record a read is narrowed to, or `none`), the access requirement it is read under, its match filter, and every column a read serves, with the column's field class, its state and the collection fields it feeds. Reads no rows. This is the index of the estate, for lineage, operators and proofs; product code reads collections under `/records`. Credential: the organization's live API key, or a scoped key with `records:read`. A sandbox or test organization key gets 403 `CAPABILITY_DENIED`, reason `SCOPED_KEY_REQUIRED`. operationId: listConnectionTables parameters: - description: >- The person the request is for, as your identity provider's stable user id. Unset keeps the org-wide posture the key alone grants. The retired `X-Nexio-*` identity headers are refused on this route with 400 `INVALID_ARGUMENT`, reason `LEGACY_HEADER`. in: header name: Nexio-Act-As schema: description: >- The person the request is for, as your identity provider's stable user id. Unset keeps the org-wide posture the key alone grants. The retired `X-Nexio-*` identity headers are refused on this route with 400 `INVALID_ARGUMENT`, reason `LEGACY_HEADER`. type: string - description: >- The acting person's verified sign-in email, lowercased. Ignored without Nexio-Act-As. in: header name: Nexio-Act-As-Email schema: description: >- The acting person's verified sign-in email, lowercased. Ignored without Nexio-Act-As. type: string - description: >- The signed assertion over the identity headers (v1..). in: header name: Nexio-Assertion schema: description: >- The signed assertion over the identity headers (v1..). type: string - description: >- A caller-chosen request id, echoed in the Nexio-Request-Id response header. in: header name: Nexio-Request-Id schema: description: >- A caller-chosen request id, echoed in the Nexio-Request-Id response header. type: string - description: >- The caller's remaining budget for this request, in whole milliseconds (1 to 10 digits, greater than zero), relative to receipt. The engine stops work at the shorter of this and the route's own budget, and answers 504 request_timeout when it expires. A value above the route budget is capped to it; a malformed value is ignored. in: header name: Nexio-Timeout schema: description: >- The caller's remaining budget for this request, in whole milliseconds (1 to 10 digits, greater than zero), relative to receipt. The engine stops work at the shorter of this and the route's own budget, and answers 504 request_timeout when it expires. A value above the route budget is capped to it; a malformed value is ignored. type: string - description: >- The connection: one of the organization's connection ids, or `sandbox` for the sandbox seat's view of it. Any other id answers 404 `NOT_VISIBLE_OR_ABSENT`. in: path name: id required: true schema: description: >- The connection: one of the organization's connection ids, or `sandbox` for the sandbox seat's view of it. Any other id answers 404 `NOT_VISIBLE_OR_ABSENT`. type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/ListConnectionTable' description: OK '400': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `INVALID_ARGUMENT`, reason `CONNECTION_MISMATCH`: a `connection_id` query parameter names another connection than the path. '401': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Unauthorized '403': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Forbidden '404': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `NOT_VISIBLE_OR_ABSENT`: the id is not one of the organization's connections. '424': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: >- `SOURCE_UNAVAILABLE`: the warehouse could not answer the read now. `retry_after_ms`, when present, is the wait before a retry. '429': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Service Unavailable '504': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Gateway Timeout security: - BearerAuth: [] components: schemas: ListConnectionTable: additionalProperties: false properties: data: description: Every registered table, sorted by name. items: $ref: '#/components/schemas/ConnectionTable' type: - array - 'null' facets: additionalProperties: items: $ref: '#/components/schemas/FacetValue' type: - array - 'null' description: Present only for the facets the request named in facets=. type: object page: $ref: '#/components/schemas/Page' request_id: description: The request id, as echoed in the Nexio-Request-Id response header. type: string source: $ref: '#/components/schemas/Source' total: $ref: '#/components/schemas/Total' description: Present only when the request sent include_total=true. unreachable: description: >- Parts of the answer no source could fill, each with its reason. Empty when every part was filled. items: $ref: '#/components/schemas/Unreachable' type: - array - 'null' warnings: description: >- Adjustments the platform made to the request (a coerced limit, a dropped facet). items: $ref: '#/components/schemas/Warning' type: - array - 'null' required: - data - page - source - unreachable - warnings - request_id type: object Problem: additionalProperties: false properties: code: description: >- The stable machine-readable error code, UPPER_SNAKE_CASE, one meaning forever. enum: - INVALID_ARGUMENT - UNAUTHENTICATED - CAPABILITY_DENIED - NOT_VISIBLE_OR_ABSENT - IDEMPOTENT_REQUEST_IN_FLIGHT - ETAG_MISMATCH - VALIDATION_FAILED - IDEMPOTENCY_KEY_PAYLOAD_MISMATCH - SOURCE_UNAVAILABLE - RATE_LIMITED - INTERNAL - DEADLINE_EXCEEDED - UNAVAILABLE - CLIENT_CLOSED_REQUEST type: string detail: description: A human-readable sentence about this occurrence. type: string details: description: >- Structured detail for the reason (for example which owner selection rule failed). errors: description: Each invalid parameter, for INVALID_ARGUMENT. items: $ref: '#/components/schemas/ProblemError' type: - array - 'null' instance: description: The request path this occurrence answered. type: string reason: description: >- The finer cause within the code, UPPER_SNAKE_CASE (for example SCOPE_UNAVAILABLE under CAPABILITY_DENIED). type: string request_id: description: The request id, as echoed in the Nexio-Request-Id response header. type: string retry_after_ms: description: When a retry may succeed, the wait before it. format: int64 type: integer status: description: The HTTP status code. format: int64 type: integer title: description: The HTTP status phrase. type: string type: description: A URI naming the problem type, derived from the code. type: string required: - type - title - status - code - request_id type: object ConnectionTable: additionalProperties: false properties: columns: description: Every column a read serves, with its field class. items: $ref: '#/components/schemas/ConnectionTableColumn' type: - array - 'null' filter: description: >- The match filter the table takes, named after its column (`cocode`, `brokercode`); absent when it takes none. type: string filter_required: description: True when the table is read one filter value at a time. type: boolean object: description: The source object the rows are read from, fully qualified. type: string owner: description: >- The record a read is narrowed to; its id is the required filter (`policy_id`, `account_id`, `claim_id`). `none`: the table is read whole. enum: - none - policy - account - claim type: string requirement: description: >- The access row the table is read under: `reference` (the vocabulary dataset), `accounting`, `policy`, `account`, `claim` or `org`. type: string system: description: >- The system the object belongs to: the system of record's replica, or a curated warehouse table. enum: - ams360 - warehouse type: string table: description: The table's name on `GET /connections/{id}/tables/{table}`. type: string required: - table - object - system - owner - requirement - columns type: object FacetValue: additionalProperties: false properties: count: type: integer format: int64 label: type: string parent: type: string value: type: string required: - value - count type: object Page: additionalProperties: false properties: cursor: description: The cursor that produced this page; null for the first page. type: - string - 'null' limit: description: >- The page size the platform applied, after any coercion (see warnings). format: int64 type: integer next: description: The cursor of the following page; null at the end of the collection. type: - string - 'null' offset: description: >- The rows skipped before this page, echoed only when the request sent offset (a register's page jump). format: int64 type: integer prev: description: The cursor of the preceding page; null on the first page. type: - string - 'null' required: - cursor - next - prev - limit type: object Source: additionalProperties: false properties: actor: $ref: '#/components/schemas/Actor' connection: description: >- The id of the connection that answered; empty when the read had no connection. type: string elapsed_ms: description: A live source's call time for this read. format: int64 type: integer family: description: The registry family that answered. type: string freshness: description: fresh, cached, stale, live or stale_after_write. type: string id: description: >- The registry source id (warehouse, ams360_ems, ...), empty when absent. type: string kind: description: >- The kind of source that answered: the warehouse, the customer's system of record (whichever vendor; the vendor is in id), the platform's own store, or absent when no source serves the family. enum: - warehouse - system - store - absent type: string origin: description: Which input decided the source. enum: - default - connection - seat type: string reason: $ref: '#/components/schemas/SourceReason' description: Why the family is absent, when kind is absent. snapshot_at: description: >- The instant the rows were read at: the warehouse pin, or the live call's time. format: date-time type: - string - 'null' snapshot_id: description: The warehouse snapshot the rows came from, when one names them. type: string stale_since: description: When the snapshot stopped being current, for a stale read. format: date-time type: string subject: $ref: '#/components/schemas/Subject' system: deprecated: true description: 'Deprecated: read kind instead. The system behind the source.' enum: - warehouse - ams360 - store - absent type: string required: - family - kind - connection - system - id - origin - freshness - snapshot_at - subject - actor type: object Total: additionalProperties: false properties: exact: type: boolean value: type: integer format: int64 required: - value - exact type: object Unreachable: additionalProperties: false properties: detail: type: string part: description: The envelope part (a field path or a child family). type: string reason: description: 'Why: no_adapter, not_documented, absent, source_unavailable, ...' type: string ref: description: The vendor reference id of the call that failed, when one did. type: string required: - part - reason type: object Warning: additionalProperties: false properties: code: description: >- UPPER_SNAKE_CASE, one meaning forever (LIMIT_COERCED, FACET_DROPPED, ...). type: string detail: type: string required: - code type: object ProblemError: additionalProperties: false properties: location: description: Where the input was, for example query.limit. type: string message: type: string value: {} required: - message type: object ConnectionTableColumn: additionalProperties: false properties: class: description: >- The column's field class: `business`, `identity`, `direct_identifier`, and so on. type: string column: description: The source column, as the system of record spells it. type: string feeds: description: >- The collection fields that serve the column, as `.`; empty when no collection serves it yet. items: type: string type: - array - 'null' state: description: >- `served` or `proven` when a collection field serves the column, `estate_only` when only this surface reads it. Absent for a curated warehouse table. enum: - served - proven - estate_only type: string required: - column - class - feeds type: object Actor: additionalProperties: false properties: impersonation_kind: enum: - act_as - workos type: string impersonator: description: The operator behind an impersonated session. type: string member: description: The acting member (Nexio-Act-As); empty for a key acting as itself. type: string type: object SourceReason: additionalProperties: false properties: kind: type: string note: type: string ref: type: string required: - kind type: object Subject: additionalProperties: false properties: member: $ref: '#/components/schemas/SubjectMember' description: >- The member whose book was read, when the request read as another member. scope: description: The scope kind the acting seat resolved to (self, office, all, ...). type: string selection: description: >- The subject selection served, as subject= tokens (own, book:, producer:, client_manager:, member:). Empty when none was sent. items: type: string type: - array - 'null' selection_kind: description: >- own, code, client_manager, account, boundary or whole: what the served relation is. type: string selection_source: description: >- request when the caller chose the selection; none when it chose nothing. type: string required: - scope - selection - selection_kind - selection_source type: object SubjectMember: additionalProperties: false properties: display_name: type: string id: type: string scope: type: string required: - id - display_name - scope type: object securitySchemes: BearerAuth: type: http scheme: bearer description: > Send the key as `Authorization: Bearer `. Two kinds of key exist. Organization keys are issued in the portal (Settings, then API keys), each bound to one environment, shaped `nx__<64 hex>`. They carry no capabilities and pass every capability check, with one exception: routes under /records, /actions, /operations, /api/v1/engines/{id}/opportunities, /api/v1/graph and /api/v1/catalog/documents accept an organization key only when its environment is `live`, and refuse any other with 403 `scoped_key_required`. Revocation takes effect within 60 seconds. Scoped keys are issued by Nexio on request, shaped `nxsk_v1_<24 hex key id>_<43 character secret>`. Each is bound to one org, one environment, a set of engines and a set of capabilities. A malformed, unknown or revoked `nxsk_` key fails with 401 and is never retried as an organization key. Revocation takes effect on the next request. A scoped key without a route's capability gets 403 `insufficient_capability`; a scoped key not bound to the engine gets 403 `engine_binding_forbidden`. Key-grantable capabilities: `engines:read`, `runs:write`, `runs:read`, `runs:defensibility:read`, `runs:test`, `catalog:read`, `catalog:documents:read`, `webhooks:manage`, `conversations:use`, `conversations:export`, `records:read`, `records:opportunities:run`, `actions:write`, `actions:read`, `graph:read`, `records:analyze`. Routes that accept organization keys only (every scoped key gets 403 `insufficient_capability`): environment management, engine create, update, configuration and publish, and conversation instance authoring. Each operation description names the capability a scoped key needs. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.