From dab93bb40b968c6a7bf270ba191cbcf32d311689 Mon Sep 17 00:00:00 2001
From: RajatPawar <18614743+RajatPawar@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:54:48 -0700
Subject: [PATCH] [ENG-4086] feat(provider-apps): providerInputs on
 create/update + customInputs metadata
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add providerInputs (name→value map) to the createProviderApp and updateProviderApp
requests for builder-supplied custom-auth inputs beyond clientId/clientSecret,
routed server-side by fieldType. Add customInputs to ProviderAppMetadata so
non-sensitive (text/select) inputs are readable for edit-mode hydration.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 api/api.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/api/api.yaml b/api/api.yaml
index b1ad750..92ca3b2 100644
--- a/api/api.yaml
+++ b/api/api.yaml
@@ -489,6 +489,13 @@ paths:
                       - write
                 metadata:
                   $ref: "#/components/schemas/ProviderAppMetadata"
+                providerInputs:
+                  type: object
+                  description: Builder-supplied custom-auth input values keyed by CustomAuthInput.name (excluding the reserved clientId/clientSecret). Routed by fieldType — sensitive (password) values are stored encrypted, non-sensitive (text/select) values are stored in metadata.
+                  additionalProperties:
+                    type: string
+                  example:
+                    subscriptionKey: my-subscription-key
         required: true
       responses:
         200:
@@ -591,6 +598,7 @@ paths:
                     - provider
                     - scopes
                     - metadata
+                    - providerInputs
                   example: ["externalRef", "clientId"]
                 providerApp:
                   type: object
@@ -623,6 +631,13 @@ paths:
                           - write
                     metadata:
                       $ref: "#/components/schemas/ProviderAppMetadata"
+                    providerInputs:
+                      type: object
+                      description: Builder-supplied custom-auth input values keyed by CustomAuthInput.name (excluding the reserved clientId/clientSecret). A providerInputs update replaces the full set. Routed by fieldType — sensitive (password) values are stored encrypted, non-sensitive (text/select) values are stored in metadata.
+                      additionalProperties:
+                        type: string
+                      example:
+                        subscriptionKey: my-subscription-key
                   description:
                     The provider app fields to update. (Only include the
                     fields you'd like to update.)
@@ -5247,6 +5262,10 @@ components:
             packageInstallURL: https://login.salesforce.com/packaging/installPackage.apexp?p0=04t123456789
             gcpProjectId: my-gcp-project
             gcpPubSubTopicName: my-topic
+        customInputs:
+          description: Non-sensitive builder ProviderInput values (fieldType text/select), keyed by input name. Read-only in responses; set via the request's providerInputs field.
+          allOf:
+            - $ref: "#/components/schemas/ProviderMetadata"
     Integration:
       title: Integration
       required: