Non-secret configuration as a JSON object — e.g. host, port, region, or tenant / instance URL. Carries the per-deployment tuning an integration needs that isn't a credential; the accepted keys vary by integration and some integrations need none. Integrations whose tenant is set manually take it here as app_instance_identifier (e.g. an Okta domain); others derive it from the credentials during connect. Discover the accepted keys via GET /v1/integrations/{app_class_id}/connection-schema. Optional — defaults to an empty object.

Credentials as a JSON object. All secrets go here — there are no top-level credential fields. The accepted keys depend on the integration and are validated server-side; see the per-integration request examples. Discover the accepted keys for a given app via GET /v1/integrations/{app_class_id}/connection-schema. Some integrations connect in-band from these credentials (e.g. an api_key, or an OAuth client_id/client_secret). Others require browser consent and are finished in the Lumos UI — for those, auth may be empty ({}). Missing or wrong-shaped credentials are rejected with 400; credentials the third party rejects return 502.