canonical: https://jentic.com/apis/amazonaws.com/codestar-connections

# AWS CodeStar Connections

Jentic publishes the only available OpenAPI specification for AWS CodeStar Connections, keeping it validated and agent-ready. CodeStar Connections (now branded AWS Developer Tools Connections) brokers OAuth-based connections between AWS services and external Git providers including GitHub, GitHub Enterprise Server, Bitbucket, and GitLab. The API covers connections, hosts (for self-managed providers), and tags, so agents can list which providers are wired up, create new connections, and remove unused ones.

## For AI agents

Manage AWS CodeStar Connections that link CodePipeline, CodeBuild, and CodeDeploy to GitHub, GitHub Enterprise, Bitbucket, and GitLab. Backed by 12 endpoints across connections, hosts, and tags.

## Scope

Does not handle source code operations, pipeline execution, or webhooks - use for managing OAuth connections and self-managed hosts that link AWS to external Git providers only.

## Capabilities

- Create connections to GitHub, Bitbucket, GitHub Enterprise Server, or GitLab
- List existing connections and filter by provider type
- Create and manage Hosts for self-managed Git providers (GitHub Enterprise Server)
- Update host VPC configuration for hosts that need private connectivity
- Tag connections and hosts for cost allocation and ownership
- Delete unused connections and hosts to reduce cross-service permissions

## Use cases

### Wire AWS Pipelines to GitHub or Bitbucket

When a CodePipeline pipeline needs to source code from GitHub or Bitbucket, an admin first creates a connection through this API and then completes the OAuth handshake in the AWS console. CreateConnection returns a ConnectionArn that pipelines, build projects, and deployment groups reference as their source provider. ListConnections shows status (PENDING, AVAILABLE, ERROR) so an agent knows which need manual completion.

Example prompt: Create a connection named github-org-main with ProviderType=GitHub and tag it with Team=platform

### Self-Managed GitHub Enterprise Server Onboarding

Organisations running GitHub Enterprise Server inside a VPC use CreateHost to register the endpoint URL and VPC configuration, then CreateConnection with HostArn to broker access. UpdateHost lets the agent rotate the VPC subnet IDs or security groups, and DeleteHost cleans up when the GHES instance is decommissioned. This is the path for fully private source-control to AWS pipeline traffic.

Example prompt: Create a host for a GitHub Enterprise Server at https://ghe.internal with the supplied VPC subnets and security groups

### Connection Inventory and Hygiene

Security teams audit which third-party providers have OAuth grants into the AWS account by listing connections and hosts. ListConnections filters by ProviderTypeFilter, while ListTagsForResource exposes ownership labels. Stale connections in PENDING state for too long, or AVAILABLE connections owned by departed teams, can be removed with DeleteConnection to tighten the trust surface.

Example prompt: List all CodeStar connections and delete any that have been in PENDING state for more than 7 days

### AI Agent Integration via Jentic

Through Jentic, an AI agent uses CodeStar Connections by searching for an intent like 'create a CodeStar connection to GitHub', loading the CreateConnection schema, and executing it with a connection name and provider type. Jentic signs the SigV4 request server-side using IAM credentials in your Jentic One instance.

Example prompt: Search Jentic for 'create a CodeStar connection to GitHub', load the CreateConnection schema, and execute it with ProviderType=GitHub

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.CreateConnection | Create a connection to a Git provider |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.GetConnection | Get a connection by ARN |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.ListConnections | List connections in the account |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.DeleteConnection | Delete a connection |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.CreateHost | Create a host for a self-managed Git provider |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.ListHosts | List hosts for self-managed Git providers |
| POST | /#X-Amz-Target=com.amazonaws.codestar.connections.CodeStar_connections_20191201.UpdateHost | Update host VPC configuration |

## Key resources

- **Connection** — Create, get, list, and delete OAuth-based connections to Git providers
- **Host** — Create, get, list, update, and delete hosts for self-managed Git providers
- **Tag** — Tag connections and hosts and list tags by resource ARN

## Why Jentic

- **Setup:** Wiring AWS CodeStar Connections by hand means signing every request with AWS Signature v4 HMAC, targeting the right regional host like codestar-connections.{region}.amazonaws.com, and routing each call through a long X-Amz-Target namespace instead of a REST path. Through Jentic you install once, import AWS CodeStar Connections from the API Directory, store the AWS access key and secret once, and your agent calls it.
- **Permission scoping:** CodeStar Connections dispatches operations through the X-Amz-Target header and names the connection and host in the request body, not the URL path, so scoping is by operation. You limit the agent to the operations it needs, such as CreateConnection or ListConnections, so DeleteConnection or DeleteHost are not included unless you add them.
- **Credential handling:** Your AWS access key and secret are stored once, encrypted, by your own Jentic One instance and injected at execution time when the request is signed. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a CodeStar connection to GitHub' or 'list CodeStar connections', and Jentic returns the matching operation with its input schema, so the agent calls CreateConnection or ListConnections without browsing AWS docs.

## Related APIs

- **AWS CodePipeline** — CodePipeline source actions reference CodeStar Connections to pull from GitHub, Bitbucket, and GitLab
- **GitHub** — GitHub is the most common provider behind a CodeStar connection
- **AWS CodeStar** — CodeStar projects can reference connections for non-CodeCommit source providers

## FAQ

### Why is there no official OpenAPI spec for AWS CodeStar Connections?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS CodeStar Connections via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the AWS CodeStar Connections API use?

CodeStar Connections uses AWS Signature Version 4 (HMAC) signed requests with an IAM access key and secret. The OAuth handshake to the third-party provider (GitHub, Bitbucket) is completed in the AWS console after CreateConnection. Through Jentic, IAM credentials live encrypted in your Jentic One instance.

### Can I create a connection programmatically and use it immediately?

CreateConnection returns a ConnectionArn in PENDING state. The OAuth handshake to GitHub or Bitbucket must currently be completed in the AWS console - only after the handshake does GetConnection return ConnectionStatus=AVAILABLE and the ARN becomes usable in CodePipeline source actions.

### How do I link AWS to a self-hosted GitHub Enterprise Server?

Call CreateHost with ProviderType=GitHubEnterpriseServer, the ProviderEndpoint URL, and a VpcConfiguration. After the host is AVAILABLE, call CreateConnection passing the HostArn. ListHosts surfaces existing hosts and their statuses for inventory.

### What are the rate limits for the AWS CodeStar Connections API?

AWS enforces per-account, per-region throttling on CodeStar Connections; throttled requests return ThrottlingException. The AWS SDKs that Jentic wraps implement exponential backoff automatically.

### How do I create a CodeStar connection through Jentic with an AI agent?

Run pip install jentic, then have the agent search for 'create a CodeStar connection to GitHub', load the CreateConnection schema, and execute it with a name and ProviderType. The agent then notifies a human to complete the OAuth handshake in the console before the connection becomes AVAILABLE.

### Can I limit what my agent is allowed to do with the AWS CodeStar Connections API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and AWS credentials the agent may use. CodeStar Connections routes each call through the X-Amz-Target header and names the connection or host in the request body, so scoping is done per operation: you can allow read and create calls like ListConnections and CreateConnection while withholding destructive ones such as DeleteConnection and DeleteHost. Only the operations you grant, signed with the AWS key you store, are ever available to the agent.