API reference

Connector updates

Update a connector now, pause or resume its automatic updates, and the workspace update policy.

POSTTurn on automatic updates
POSTUpdate a connector now
GETGet a connector's update mode
PUTSet or clear a connector's update mode
POSTPause automatic updates
POSTResume automatic updates
GETCheck a Cloudraw Connect app update
GETGet the update policy
PUTChange the update policy

Turn on automatic updates

POST/v0/tenants/{tenant_id}/connectors/{connector_id}/enable-updates

full-access tokenidempotentrate limited

For a connector installed without the updater (its "Update now" never arrives): issues a new update token and returns a command to run once on the connector host. The command adds the updater, which checks in at once; the running connector is not touched. The previous update token stops working, so only run the newest command. Refused while an updater is already checking in. Audited.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key. The answer carries a secret shown once: a retry with the same key answers 409 already-issued instead of the secret.

Rate limit: At most 10 connector commands (Update now, Turn on automatic updates, Pause, Resume) per 10 minutes per workspace, counted across every admin, integration and API token. A refused or failed command does not use up the budget.

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connector_idstringrequired
Connector id (from GET …/connectors).
Example: cn0r4w8t2kq

Headers

Idempotency-Keystring
A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.
Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Responses

201 The command. Shown once (it carries the update token; not cached, not replayed).

application/json

connector_idstringrequired
osstring | null
OS the connector reports.
commandstringrequired
The command for this connector's OS (Windows when the OS says so, else Linux). Shown once.
windowsstring
Run in an Administrator PowerShell on the connector host.
linuxstring
Run on the connector host (needs sudo).
notestring

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connector-not-found tenant-not-found

connector-not-found: No connector with this id in the workspace.

tenant-not-found: No workspace with this id.

409 updates-paused updater-already-active idempotency-key-reuse already-issued

updates-paused: Automatic updates of this connector are paused. Resume them first.

updater-already-active: The connector's updater checked in within the last 2 hours; "Update now" works without this.

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

already-issued: This Idempotency-Key already created a secret; it is shown only once. Retry with a new key.

429 too-many-connector-commands

too-many-connector-commands: More than 10 connector commands in 10 minutes in this workspace. Wait Retry-After seconds.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/enable-updates" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/enable-updates" -Headers $headers

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/enable-updates",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/enable-updates", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 201 · application/json

{
  "connector_id": "cn0r4w8t2kq",
  "os": "Linux",
  "command": "curl -fsSL 'https://cdapi.cloudraw.com/connector/install.sh' | sudo bash -s -- --updater-only 'tq7x2m9k4ab' 'cn0r4w8t2kq' 'cut_…'",
  "windows": "powershell … -Tenant '…' -Connector '…' -UpdateToken 'cut_…'",
  "linux": "curl -fsSL 'https://cdapi.cloudraw.com/connector/install.sh' | sudo bash -s -- --updater-only 'tq7x2m9k4ab' 'cn0r4w8t2kq' 'cut_…'",
  "note": "Shown once. Run it on the connector host (Windows: an Administrator PowerShell). It adds the updater and runs a check at once; a pending \"Update now\" is applied within a few minutes. The connector itself keeps running."
}

Update a connector now

POST/v0/tenants/{tenant_id}/connectors/{connector_id}/update

full-access tokenidempotentrate limited

Asks the connector to update now, regardless of the maintenance window. The connector applies it on its next check (every 15 minutes); follow update.requested_at / applied_at in GET …/connectors. A connector without an updater (update.updater_state never_checked or none) never picks it up: run enable-updates first. Audited.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key to retry safely — the same key and body within 24 h returns the first answer.

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connector_idstringrequired
Connector id (from GET …/connectors).
Example: cn0r4w8t2kq

Headers

Idempotency-Keystring
A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.
Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Request body application/json

versionstring
Target version (up to 20 characters). Default: the current release.

Responses

202 Requested.

application/json

connector_idstringrequired
requested_atstring (date-time)required
target_versionstring | null
Version it will update to.
notestring

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connector-not-found tenant-not-found

connector-not-found: No connector with this id in the workspace.

tenant-not-found: No workspace with this id.

409 updates-paused version-frozen idempotency-key-reuse

updates-paused: Automatic updates of this connector are paused. Resume them first.

version-frozen: This release is on hold after a failed update elsewhere; the connector keeps its current version.

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

429 too-many-connector-commands

too-many-connector-commands: More than 10 connector commands in 10 minutes in this workspace. Wait Retry-After seconds.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

PowerShell

$body = @'
{}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    json={},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({}),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 202 · application/json

{
  "connector_id": "cn0r4w8t2kq",
  "requested_at": "2026-10-13T09:24:11.000Z",
  "target_version": "1.18.7-b11c",
  "note": "the connector applies it on its next check (every 15 minutes)"
}

Get a connector's update mode

GET/v0/tenants/{tenant_id}/connectors/{connector_id}/update-mode

read-only token

The mode this connector follows, where it comes from, and the workspace connector default it would inherit.

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connector_idstringrequired
Connector id (from GET …/connectors).
Example: cn0r4w8t2kq

Responses

200 The mode.

application/json

connector_idstringrequired
modestring | nullrequired
mode_sourcestringrequired
One of: connector, workspace, paused.
mode_overridestring | null
mode_override_bystring | null
mode_override_atstring | null (date-time)
workspace_modestring
One of: auto_window, manual, immediate.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connector-not-found tenant-not-found

connector-not-found: No connector with this id in the workspace.

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "connector_id": "cn0r4w8t2kq",
  "mode": "manual",
  "mode_source": "connector",
  "mode_override": "manual",
  "mode_override_by": "dana.levi@example.com",
  "mode_override_at": "2026-10-13T09:24:11.000Z",
  "workspace_mode": "auto_window"
}

Set or clear a connector's update mode

PUT/v0/tenants/{tenant_id}/connectors/{connector_id}/update-mode

full-access token

Overrides the workspace connector default for this connector, or inherit (or null) to follow it again. A pause (…/updates/pause) still wins; this does not resume a paused connector. Repeating the current value changes nothing. Audited (connector.update_mode.set).

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connector_idstringrequired
Connector id (from GET …/connectors).
Example: cn0r4w8t2kq

Request body application/json

modestring | nullrequired
One of: inherit, immediate, auto_window, manual, .

Responses

200 The connector's update state.

application/json

connector_idstringrequired
updateConnectorUpdateStatusrequired
Automatic-update state of one connector.
update fields
- modestring | null
  The mode this connector follows now: its own override, else the workspace connector default; paused wins over both.
  One of: immediate, auto_window, manual, paused, .
- mode_sourcestring
  connector = set on this connector; workspace = inherited from the update policy; paused = updates paused on purpose.
  One of: connector, workspace, paused.
- mode_overridestring | null
  This connector's own mode; null = follows the workspace.
  One of: immediate, auto_window, manual, .
- mode_override_bystring | null
  Who set the override.
- mode_override_atstring | null (date-time)
  When the override was set.
- rolloutone of
  Staged rollout of the newest connector version as it applies to this connector. null = nothing to show (the connector already runs it, or staged rollout is off).
- current_versionstring | null
  Version the connector runs, Cloudraw build included (e.g. 1.18.7-b11c); null until it reported one.
- build_knownboolean
  True when current_version carries the Cloudraw build suffix (-b<n>).
- available_versionstring | null
  Newer version the connector can update to; null when it is up to date.
- previous_versionstring | null
  Version before the last update.
- requested_atstring | null (date-time)
  When an "Update now" was requested and not yet applied.
- applied_atstring | null (date-time)
  When the last update was applied.
- last_check_atstring | null (date-time)
  Last time the connector's updater checked in (every 15 minutes when healthy).
- lastobject
  Result of the last update attempt (empty object when there was none).
  last fields
  - okboolean
  - fromstring
  - tostring
  - messagestring
  - atstring (date-time)
- updaterboolean
  True when an update token was issued for this connector (an updater can be installed).
- token_rotated_atstring | null (date-time)
  When the updater last replaced the token from its install command by its own.
- pausedone of
  Set while automatic updates are paused on purpose.
- last_pausedone of
  The previous pause, after a resume.
- updater_statestringrequired
  ok = checked in within 2 h; stale = no check for over 2 h; never_checked = no check ever arrived (installed before automatic updates: use enable-updates); token_rejected = an updater calls in with an outdated token (run the newest enable-updates command once); paused = paused on purpose; none = no updater.
  One of: ok, stale, never_checked, token_rejected, paused, none.
- last_reject_atstring | null (date-time)
  Last time an updater called in with an outdated token.

400 invalid-request

invalid-request: mode is not inherit, immediate, auto_window or manual (paused has its own route).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connector-not-found tenant-not-found

connector-not-found: No connector with this id in the workspace.

tenant-not-found: No workspace with this id.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X PUT "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "mode": "manual"
}'

PowerShell

$body = @'
{
  "mode": "manual"
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Put -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.put(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "mode": "manual"
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/update-mode", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "mode": "manual"
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "connector_id": "cn0r4w8t2kq",
  "update": {
    "mode": "manual",
    "mode_source": "connector",
    "mode_override": "manual",
    "mode_override_by": "dana.levi@example.com",
    "mode_override_at": "2026-10-13T09:24:11.000Z",
    "rollout": null,
    "current_version": "1.18.7-b11c",
    "build_known": true,
    "available_version": null,
    "previous_version": "1.18.7-b9c",
    "requested_at": null,
    "applied_at": "2026-10-11T02:14:09.000Z",
    "last_check_at": "2026-10-13T09:15:02.000Z",
    "last": {
      "ok": true,
      "from": "1.18.7-b9c",
      "to": "1.18.7-b11c",
      "message": "updated",
      "at": "2026-10-11T02:14:09.000Z"
    },
    "updater": true,
    "token_rotated_at": "2026-10-02T11:40:00.000Z",
    "paused": null,
    "last_paused": null,
    "updater_state": "ok",
    "last_reject_at": null
  }
}

Pause automatic updates

POST/v0/tenants/{tenant_id}/connectors/{connector_id}/updates/pause

full-access tokenrate limited

Stops all updates of this connector on purpose, with a reason every admin sees. A pending "Update now" is dropped, not applied later. The connector keeps running its current version until you resume. Audited.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connector_idstringrequired
Connector id (from GET …/connectors).
Example: cn0r4w8t2kq

Request body application/json

reasonstringrequired
Why, 3-300 characters. Shown to every admin.
Max length 300.

Responses

200 Paused.

application/json

connector_idstringrequired
updateConnectorUpdateStatusrequired
Automatic-update state of one connector.
update fields
- modestring | null
  The mode this connector follows now: its own override, else the workspace connector default; paused wins over both.
  One of: immediate, auto_window, manual, paused, .
- mode_sourcestring
  connector = set on this connector; workspace = inherited from the update policy; paused = updates paused on purpose.
  One of: connector, workspace, paused.
- mode_overridestring | null
  This connector's own mode; null = follows the workspace.
  One of: immediate, auto_window, manual, .
- mode_override_bystring | null
  Who set the override.
- mode_override_atstring | null (date-time)
  When the override was set.
- rolloutone of
  Staged rollout of the newest connector version as it applies to this connector. null = nothing to show (the connector already runs it, or staged rollout is off).
- current_versionstring | null
  Version the connector runs, Cloudraw build included (e.g. 1.18.7-b11c); null until it reported one.
- build_knownboolean
  True when current_version carries the Cloudraw build suffix (-b<n>).
- available_versionstring | null
  Newer version the connector can update to; null when it is up to date.
- previous_versionstring | null
  Version before the last update.
- requested_atstring | null (date-time)
  When an "Update now" was requested and not yet applied.
- applied_atstring | null (date-time)
  When the last update was applied.
- last_check_atstring | null (date-time)
  Last time the connector's updater checked in (every 15 minutes when healthy).
- lastobject
  Result of the last update attempt (empty object when there was none).
  last fields
  - okboolean
  - fromstring
  - tostring
  - messagestring
  - atstring (date-time)
- updaterboolean
  True when an update token was issued for this connector (an updater can be installed).
- token_rotated_atstring | null (date-time)
  When the updater last replaced the token from its install command by its own.
- pausedone of
  Set while automatic updates are paused on purpose.
- last_pausedone of
  The previous pause, after a resume.
- updater_statestringrequired
  ok = checked in within 2 h; stale = no check for over 2 h; never_checked = no check ever arrived (installed before automatic updates: use enable-updates); token_rejected = an updater calls in with an outdated token (run the newest enable-updates command once); paused = paused on purpose; none = no updater.
  One of: ok, stale, never_checked, token_rejected, paused, none.
- last_reject_atstring | null (date-time)
  Last time an updater called in with an outdated token.

400 invalid-request

invalid-request: reason is missing or not 3-300 characters.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connector-not-found tenant-not-found

connector-not-found: No connector with this id in the workspace.

tenant-not-found: No workspace with this id.

429 too-many-connector-commands

too-many-connector-commands: More than 10 connector commands in 10 minutes in this workspace. Wait Retry-After seconds.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/pause" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "Hold until the ERP upgrade on Friday is done"
}'

PowerShell

$body = @'
{
  "reason": "Hold until the ERP upgrade on Friday is done"
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/pause" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/pause",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "reason": "Hold until the ERP upgrade on Friday is done"
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/pause", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "reason": "Hold until the ERP upgrade on Friday is done"
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "connector_id": "cn0r4w8t2kq",
  "update": {
    "mode": "auto_window",
    "mode_source": "workspace",
    "mode_override": null,
    "mode_override_by": null,
    "mode_override_at": null,
    "rollout": null,
    "current_version": "1.18.7-b11c",
    "build_known": true,
    "available_version": null,
    "previous_version": "1.18.7-b9c",
    "requested_at": null,
    "applied_at": "2026-10-11T02:14:09.000Z",
    "last_check_at": "2026-10-13T09:15:02.000Z",
    "last": {
      "ok": true,
      "from": "1.18.7-b9c",
      "to": "1.18.7-b11c",
      "message": "updated",
      "at": "2026-10-11T02:14:09.000Z"
    },
    "updater": true,
    "token_rotated_at": "2026-10-02T11:40:00.000Z",
    "paused": {
      "at": "2026-10-13T09:24:11.000Z",
      "by": "dana.levi@example.com",
      "reason": "Hold until the ERP upgrade on Friday is done"
    },
    "last_paused": null,
    "updater_state": "paused",
    "last_reject_at": null
  }
}

Resume automatic updates

POST/v0/tenants/{tenant_id}/connectors/{connector_id}/updates/resume

full-access tokenrate limited

Ends a pause: the connector follows the workspace update policy again. The pause is kept in update.last_paused for the record. Audited.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connector_idstringrequired
Connector id (from GET …/connectors).
Example: cn0r4w8t2kq

Responses

200 Resumed.

application/json

connector_idstringrequired
updateConnectorUpdateStatusrequired
Automatic-update state of one connector.
update fields
- modestring | null
  The mode this connector follows now: its own override, else the workspace connector default; paused wins over both.
  One of: immediate, auto_window, manual, paused, .
- mode_sourcestring
  connector = set on this connector; workspace = inherited from the update policy; paused = updates paused on purpose.
  One of: connector, workspace, paused.
- mode_overridestring | null
  This connector's own mode; null = follows the workspace.
  One of: immediate, auto_window, manual, .
- mode_override_bystring | null
  Who set the override.
- mode_override_atstring | null (date-time)
  When the override was set.
- rolloutone of
  Staged rollout of the newest connector version as it applies to this connector. null = nothing to show (the connector already runs it, or staged rollout is off).
- current_versionstring | null
  Version the connector runs, Cloudraw build included (e.g. 1.18.7-b11c); null until it reported one.
- build_knownboolean
  True when current_version carries the Cloudraw build suffix (-b<n>).
- available_versionstring | null
  Newer version the connector can update to; null when it is up to date.
- previous_versionstring | null
  Version before the last update.
- requested_atstring | null (date-time)
  When an "Update now" was requested and not yet applied.
- applied_atstring | null (date-time)
  When the last update was applied.
- last_check_atstring | null (date-time)
  Last time the connector's updater checked in (every 15 minutes when healthy).
- lastobject
  Result of the last update attempt (empty object when there was none).
  last fields
  - okboolean
  - fromstring
  - tostring
  - messagestring
  - atstring (date-time)
- updaterboolean
  True when an update token was issued for this connector (an updater can be installed).
- token_rotated_atstring | null (date-time)
  When the updater last replaced the token from its install command by its own.
- pausedone of
  Set while automatic updates are paused on purpose.
- last_pausedone of
  The previous pause, after a resume.
- updater_statestringrequired
  ok = checked in within 2 h; stale = no check for over 2 h; never_checked = no check ever arrived (installed before automatic updates: use enable-updates); token_rejected = an updater calls in with an outdated token (run the newest enable-updates command once); paused = paused on purpose; none = no updater.
  One of: ok, stale, never_checked, token_rejected, paused, none.
- last_reject_atstring | null (date-time)
  Last time an updater called in with an outdated token.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connector-not-found tenant-not-found

connector-not-found: No connector with this id in the workspace.

tenant-not-found: No workspace with this id.

409 not-paused

not-paused: Automatic updates of this connector are not paused.

429 too-many-connector-commands

too-many-connector-commands: More than 10 connector commands in 10 minutes in this workspace. Wait Retry-After seconds.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/resume" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/resume" -Headers $headers

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/resume",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connectors/cn0r4w8t2kq/updates/resume", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "connector_id": "cn0r4w8t2kq",
  "update": {
    "mode": "auto_window",
    "mode_source": "workspace",
    "mode_override": null,
    "mode_override_by": null,
    "mode_override_at": null,
    "rollout": null,
    "current_version": "1.18.7-b11c",
    "build_known": true,
    "available_version": null,
    "previous_version": "1.18.7-b9c",
    "requested_at": null,
    "applied_at": "2026-10-11T02:14:09.000Z",
    "last_check_at": "2026-10-13T09:15:02.000Z",
    "last": {
      "ok": true,
      "from": "1.18.7-b9c",
      "to": "1.18.7-b11c",
      "message": "updated",
      "at": "2026-10-11T02:14:09.000Z"
    },
    "updater": true,
    "token_rotated_at": "2026-10-02T11:40:00.000Z",
    "paused": null,
    "last_paused": {
      "at": "2026-10-09T08:00:00.000Z",
      "by": "dana.levi@example.com",
      "reason": "Hold until the ERP upgrade on Friday is done",
      "resumed_at": "2026-10-13T09:24:11.000Z",
      "resumed_by": "dana.levi@example.com"
    },
    "updater_state": "ok",
    "last_reject_at": null
  }
}

Check a Cloudraw Connect app update

GET/v0/tenants/{tenant_id}/update-check

read-only token

Answers, for a Cloudraw Connect app at current_version, whether it should update, to which version and when, under the workspace policy and the security floor. Handy to see what your users' apps will do. Changes nothing.

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Query parameters

current_versionstring
App version to check (default 0.0.0).
Example: 0.4.6

Responses

200 The decision.

application/json

current_versionstringrequired
available_versionstringrequired
update_availableboolean
should_updatebooleanrequired
whenstringrequired
One of: none, now, window, manual, forced.
deadlinestring | null (date-time)
Set when forced: the latest time to install.
forcedboolean
Below the security floor.
reasonstring | null
modestring
channelstring
maintenance_windowMaintenanceWindow
maintenance_window fields
- daysarray of integerrequired
  Week days, 0 = Sunday … 6 = Saturday. Non-empty.
- startstringrequired
  HH:MM, 24 h.
  Pattern ^([01]\d|2[0-3]):[0-5]\d$.
- endstringrequired
  HH:MM, 24 h. An end before the start wraps past midnight.
  Pattern ^([01]\d|2[0-3]):[0-5]\d$.
- timezonestringrequired
  IANA time zone, e.g. Asia/Jerusalem.
allow_user_deferboolean
max_defersinteger

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-check" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-check" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-check",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-check", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "current_version": "0.4.6",
  "available_version": "0.4.9",
  "update_available": true,
  "should_update": true,
  "when": "window",
  "deadline": null,
  "forced": false,
  "reason": null,
  "mode": "auto_window",
  "channel": "stable",
  "maintenance_window": {
    "days": [
      0,
      1,
      2,
      3,
      4
    ],
    "start": "02:00",
    "end": "05:00",
    "timezone": "Asia/Jerusalem"
  },
  "allow_user_defer": true,
  "max_defers": 3
}

Get the update policy

GET/v0/tenants/{tenant_id}/update-policy

read-only token

Returns the workspace update policy. mode and maintenance_window decide when connectors (and the Cloudraw Connect app) update; channel, target_version and the defer settings apply to the Cloudraw Connect app. security_floor is set by Cloudraw for critical fixes.

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Responses

200 The policy.

application/json

modestringrequired
auto_window = install in the maintenance window; manual = only when an admin asks; immediate = as soon as a version is out. Applies to connectors and to the Cloudraw Connect app.
One of: auto_window, manual, immediate.
channelstringrequired
Release channel of the Cloudraw Connect app.
One of: stable, beta.
maintenance_windowMaintenanceWindowrequired
maintenance_window fields
- daysarray of integerrequired
  Week days, 0 = Sunday … 6 = Saturday. Non-empty.
- startstringrequired
  HH:MM, 24 h.
  Pattern ^([01]\d|2[0-3]):[0-5]\d$.
- endstringrequired
  HH:MM, 24 h. An end before the start wraps past midnight.
  Pattern ^([01]\d|2[0-3]):[0-5]\d$.
- timezonestringrequired
  IANA time zone, e.g. Asia/Jerusalem.
allow_user_deferboolean
Users may postpone an app update.
max_defersinteger
How many times (0-20).
Range: 0–20.
target_versionstring | null
Pin the Cloudraw Connect app to this version; null = latest on the channel.
connector_modestring | null
Workspace default for CONNECTORS only; null = connectors follow mode too. A connector's own override (PUT …/connectors/{connector_id}/update-mode) wins over it.
One of: auto_window, manual, immediate, .
security_floorobject
Minimum app version set by Cloudraw for a critical fix: older apps must update within grace_hours, whatever the policy. Not changeable by the workspace.
security_floor fields
- min_versionstring | null
- grace_hoursinteger
- reasonstring | null
- set_atstring (date-time)
updated_atstring | null (date-time)
updated_bystring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "mode": "auto_window",
  "channel": "stable",
  "maintenance_window": {
    "days": [
      0,
      1,
      2,
      3,
      4
    ],
    "start": "02:00",
    "end": "05:00",
    "timezone": "Asia/Jerusalem"
  },
  "allow_user_defer": true,
  "max_defers": 3,
  "target_version": null,
  "connector_mode": null,
  "security_floor": {
    "min_version": null,
    "grace_hours": 72,
    "reason": null
  },
  "updated_at": "2026-10-13T09:24:11.000Z",
  "updated_by": "dana.levi@example.com"
}

Change the update policy

PUT/v0/tenants/{tenant_id}/update-policy

full-access token

Changes the update policy. Send only the fields you want to change; the others keep their value (inside maintenance_window too). Invalid values are refused, never silently dropped. The security floor cannot be changed here. Audited.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Request body application/json

modestring
One of: auto_window, manual, immediate.
channelstring
One of: stable, beta.
maintenance_windowobject
Any of its fields.
maintenance_window fields
- daysarray of integer
  Non-empty; 0 = Sunday.
- startstring
  HH:MM
- endstring
  HH:MM
- timezonestring
  IANA time zone.
allow_user_deferboolean
max_defersinteger
Range: 0–20.
target_versionstring | null
Pin the app version (up to 20 characters); null or empty = latest on the channel.
connector_modestring | null
Connectors only; null = same as mode.
One of: auto_window, manual, immediate, .

Responses

200 The updated policy.

application/json

modestringrequired
auto_window = install in the maintenance window; manual = only when an admin asks; immediate = as soon as a version is out. Applies to connectors and to the Cloudraw Connect app.
One of: auto_window, manual, immediate.
channelstringrequired
Release channel of the Cloudraw Connect app.
One of: stable, beta.
maintenance_windowMaintenanceWindowrequired
maintenance_window fields
- daysarray of integerrequired
  Week days, 0 = Sunday … 6 = Saturday. Non-empty.
- startstringrequired
  HH:MM, 24 h.
  Pattern ^([01]\d|2[0-3]):[0-5]\d$.
- endstringrequired
  HH:MM, 24 h. An end before the start wraps past midnight.
  Pattern ^([01]\d|2[0-3]):[0-5]\d$.
- timezonestringrequired
  IANA time zone, e.g. Asia/Jerusalem.
allow_user_deferboolean
Users may postpone an app update.
max_defersinteger
How many times (0-20).
Range: 0–20.
target_versionstring | null
Pin the Cloudraw Connect app to this version; null = latest on the channel.
connector_modestring | null
Workspace default for CONNECTORS only; null = connectors follow mode too. A connector's own override (PUT …/connectors/{connector_id}/update-mode) wins over it.
One of: auto_window, manual, immediate, .
security_floorobject
Minimum app version set by Cloudraw for a critical fix: older apps must update within grace_hours, whatever the policy. Not changeable by the workspace.
security_floor fields
- min_versionstring | null
- grace_hoursinteger
- reasonstring | null
- set_atstring (date-time)
updated_atstring | null (date-time)
updated_bystring | null

400 invalid-mode invalid-connector-mode invalid-channel invalid-max-defers invalid-window-days invalid-window-start invalid-window-end invalid-window-timezone

invalid-mode: mode is not auto_window, manual or immediate.

invalid-connector-mode: connector_mode is not null, auto_window, manual or immediate.

invalid-channel: channel is not stable or beta.

invalid-max-defers: max_defers is not an integer 0-20.

invalid-window-days: maintenance_window.days is empty or holds something other than integers 0-6.

invalid-window-start: maintenance_window.start is not HH:MM (24 h).

invalid-window-end: maintenance_window.end is not HH:MM (24 h).

invalid-window-timezone: maintenance_window.timezone is not an IANA time zone name.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X PUT "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "mode": "auto_window",
  "maintenance_window": {
    "days": [
      5,
      6
    ],
    "start": "22:00",
    "end": "04:00",
    "timezone": "Asia/Jerusalem"
  }
}'

PowerShell

$body = @'
{
  "mode": "auto_window",
  "maintenance_window": {
    "days": [
      5,
      6
    ],
    "start": "22:00",
    "end": "04:00",
    "timezone": "Asia/Jerusalem"
  }
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Put -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.put(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "mode": "auto_window",
        "maintenance_window": {
            "days": [
                5,
                6
            ],
            "start": "22:00",
            "end": "04:00",
            "timezone": "Asia/Jerusalem"
        }
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/update-policy", {
  method: "PUT",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "mode": "auto_window",
    "maintenance_window": {
      "days": [
        5,
        6
      ],
      "start": "22:00",
      "end": "04:00",
      "timezone": "Asia/Jerusalem"
    }
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "mode": "auto_window",
  "channel": "stable",
  "maintenance_window": {
    "days": [
      5,
      6
    ],
    "start": "22:00",
    "end": "04:00",
    "timezone": "Asia/Jerusalem"
  },
  "allow_user_defer": true,
  "max_defers": 3,
  "target_version": null,
  "connector_mode": null,
  "security_floor": {
    "min_version": null,
    "grace_hours": 72,
    "reason": null
  },
  "updated_at": "2026-10-13T09:24:11.000Z",
  "updated_by": "dana.levi@example.com"
}