ApiKeyWorkspaceConnectorLink

ApiKeyWorkspaceConnectorLink is a junction table that binds a Well API key to exactly one workspace connector per direction (INPUT or OUTPUT), enforcing the rule that each API key governs at most two connectors: one data-source connector and one data-distribution connector. It is written exclusively by the api-key.service.ts system path during API-key onboarding (find-or-create a WorkspaceConnector, then persist this link) and is never edited after creation. The two CASCADE constraints mean the link is automatically removed when either the parent API key or the parent workspace connector is deleted, keeping the junction self-cleaning with no soft-delete column.

Naming	Value
Object	ApiKeyWorkspaceConnectorLink
Resource type (JSON:API `type`)	`api_key_workspace_connector_link`
Collection / records root	— _{(not a records root)}
REST base	`/v1/api-key-workspace-connector-links`
Entity class	`Migration20260109123000`

Internal object. Not currently exposed on the public REST API. The operations below describe the intended contract.

API operations

Operation	Method & path	Status
List	`GET /v1/api-key-workspace-connector-links`	🟡 Planned
Retrieve	`GET /v1/api-key-workspace-connector-links/{id}`	🟡 Planned
Create	`POST /v1/api-key-workspace-connector-links`	🟡 Planned
Update	`PATCH /v1/api-key-workspace-connector-links/{id}`	🟡 Planned
Delete	`DELETE /v1/api-key-workspace-connector-links/{id}`	🟡 Planned

Data model

Attributes

Field	Type	Required	Constraints	Allowed values	Description
api_key_id	uuid	✅ Yes	NOT NULL; FK → core_api.api_keys(api_key_id) ON DELETE CASCADE ON UPDATE CASCADE; composite UNIQUE (api_key_id, direction); indexed	Any valid UUID referencing an existing ApiKey	Public UUID of the parent API key that owns this connector link. Together with `direction` forms a unique pair, guaranteeing at most one connector per direction per key.
workspace_connector_pk	integer	✅ Yes	NOT NULL; FK → core_api.workspace_connectors(pk) ON DELETE CASCADE ON UPDATE CASCADE; UNIQUE (workspace_connector_pk); indexed	Any integer referencing an existing WorkspaceConnector	Internal PK of the workspace connector that this link points to. The unique constraint enforces that a given workspace connector belongs to at most one API key.
direction	🔒 system enum — direction_enum (native Postgres enum)	✅ Yes	NOT NULL; part of composite UNIQUE (api_key_id, direction)	input \| output	Semantic role of the linked connector for this API key. `input` = data-source / ingestion connector; `output` = data-distribution / routing connector. At most one link per direction per API key.
created_at	🔒 system timestamptz	✅ Yes	NOT NULL; DEFAULT now(); set once on INSERT via MikroORM onCreate hook	—	UTC timestamp at which the link was created. Set automatically on first persist; never updated (no updated_at column on this entity).

System-computed

api_key_id is written by api-key.service.ts during API-key onboarding — never by the user directly
workspace_connector_pk resolved via find-or-create logic in api-key.service.ts before persist
direction copied from the parent Connector.direction at link-creation time
created_at set once via MikroORM @Property({ onCreate: () => new Date() })
No updated_at column — the record is immutable after creation
No deleted_at column — hard-deleted via CASCADE when the parent ApiKey or WorkspaceConnector is removed
Idempotency guard: service checks for an existing link with the same (api_key_id, direction) pair before inserting; duplicate creation is silently skipped

Example

{
  "data": {
    "type": "api_key_workspace_connector_link",
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "attributes": {
      "api_key_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "workspace_connector_pk": 1042,
      "direction": "input",
      "created_at": "2026-01-09T12:30:00.000Z"
    }
  }
}

_{Source: apps/api/src/database/entities/ApiKeyWorkspaceConnectorLink.ts + apps/api/src/database/migrations/Migration20260109123000.ts · domain: ingestion · tier: Infrastructure}