Align example API calls with source allow-lists

[eschultink]

Audit of connector example API calls against each source's sanitizer rules, plus docs so path params are consistently named and explained.

Fixes

• Dropbox: examples were GET and used /2/team/groups/list (not allow-listed). They are now POST, including /2/team/groups/members/list, list_folder, and list_revisions.
• Zoom: dropped GET /v2/report/meetings/{MEETING_ID} (only /participants is allowed).
• GitLab Cloud: replaced list /api/v4/namespaces with GET /api/v4/namespaces/{NAMESPACE_ID}.
• Teams docs: attendanceReport → attendanceReports (matches the rule).
• Outlook Calendar/Mail docs: /v1.0/me/... is not allow-listed under application auth; examples now use /v1.0/users/{EXAMPLE_MSFT_USER_GUID}/....
• Slack Discovery: discovery.conversations.info does not allow limit; examples no longer pass it. Added discovery.user.conversations.
• Slack Analytics: added the missing example-api-calls.md (README already linked it).

Features

• Every allow-listed REST endpoint now has at least one Terraform example call (nested GitHub REST + GraphQL POST, Asana subtasks/search, ChatGPT users/logs/messages, Claude chats/org users/local+remote sessions, Claude Analytics spend-limit by id, Copilot teams/members + installation audit-log, Jira group/member + search/jql, Confluence custom-content versions, GitLab notes/commits/discussions/global issue+MR, Salesforce describe/composite POST, Outlook Mail message-by-id, etc.).
• Path-param placeholders in generated example calls keep the existing uppercase convention so they are easy to spot ({EXAMPLE_MSFT_USER_GUID}, {USER_ID}, {MEETING_ID}, {CHANNEL_ID}, {ANY_WORKSPACE_GID}, {CHAT_ID}, {LOCAL_SESSION_ID}, …). YAML pathTemplate names stay camelCase; comments note the YAML name when it differs.
• README / connector-spec comments explain how to fill each path param from a prior list call or connector_settings. Pagination continuations (Dropbox /continue, Salesforce query locator) are covered by the parent endpoint examples.

Logistics

• Targeting latest rc-v0.6.10 (merged Claude sessions support and error-message PII redaction from that branch).

Change implications

• dependencies added/changed? no
• something important to note in future release notes?
  • Terraform-generated example/TODO test URLs will change (placeholder names and newly added example calls). That is expected in terraform plan for connector specs; it does not change runtime proxy behavior or sanitizer YAML.

  

[Copilot]

🟡 Changes recommended

Several newly added/modified connector example-call docs under docs/sources/ are missing the required “Connector ID” line immediately under the H1 header.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Aligns Terraform-generated connector example API calls and connector documentation with each source’s sanitizer allow-lists, standardizing placeholder naming and adding missing/adjusted example endpoints so users can validate proxy behavior with allow-listed requests.

Changes:

• Expanded and corrected Terraform example_api_calls / example_api_requests across multiple connectors to use allow-listed endpoints (and added missing coverage for several allow-listed routes).
• Standardized and clarified path-parameter placeholders and “how to obtain” guidance in connector docs (notably for Microsoft 365, Slack, Zoom, GitHub, GitLab, Atlassian, Salesforce, Asana, OpenAI/Anthropic).
• Added/updated dedicated “example API calls” documentation where needed (e.g., Slack Analytics) and improved testing guides around Zoom meeting summaries.

File summaries

File	Description
infra/modules/worklytics-connector-specs/msft-365.tf	Updates Microsoft 365 example API calls (Outlook Mail message-by-id; Teams attendanceReports examples; adds /users list call).
infra/modules/worklytics-connector-specs/main.tf	Broad audit/expansion of example calls/requests across many connectors (GitHub GraphQL POST, Asana subtasks/search, ChatGPT users/logs/messages, Anthropic chats/sessions/users, Claude analytics lookups, Salesforce composite, Slack discovery/analytics, Zoom report adjustments, Dropbox POST requests, GitLab namespace-by-id and more).
infra/modules/worklytics-connector-specs/google-workspace.tf	Adds clarifying comments and expands Google Workspace example calls (Directory orgunit lookup, Drive file-by-id, Gmail message-by-id notes).
docs/sources/zoom/example-api-calls.md	Updates Zoom example call docs (adds parameter explanations; removes non-allow-listed report call; clarifies meeting summary requirements).
docs/sources/slack/slack-discovery-api/README.md	Links Slack Discovery connector README to example API calls doc.
docs/sources/slack/slack-discovery-api/example-api-calls.md	Updates Slack Discovery example calls (adds parameter explanations; removes unsupported limit on discovery.conversations.info; adds discovery.user.conversations).
docs/sources/slack/slack-analytics/example-api-calls.md	Adds Slack Analytics example API calls doc for validating allow-listed endpoints.
docs/sources/salesforce/README.md	Clarifies Salesforce example account-id usage and references composite examples.
docs/sources/microsoft-365/README.md	Clarifies placeholder convention for Terraform-generated Microsoft 365 example calls.
docs/sources/microsoft-365/outlook-mail/README.md	Replaces /me examples with /users/{EXAMPLE_MSFT_USER_GUID} and documents {MESSAGE_ID} derivation.
docs/sources/microsoft-365/outlook-cal/README.md	Replaces /me examples with /users/{EXAMPLE_MSFT_USER_GUID} and documents {EVENT_ID} derivation.
docs/sources/microsoft-365/msft-teams/README.md	Documents placeholder meanings and aligns attendanceReports naming.
docs/sources/microsoft-365/msft-onedrive/README.md	Aligns placeholder names with uppercase convention and documents how to populate IDs.
docs/sources/microsoft-365/msft-copilot/README.md	Aligns placeholder names with uppercase convention and documents {EXAMPLE_MSFT_USER_GUID} source.
docs/sources/microsoft-365/entra-id/README.md	Aligns placeholder naming and replaces /users/me with /users/{EXAMPLE_MSFT_USER_GUID} for app-only auth.
docs/sources/google-workspace/gmail/README.md	Documents Gmail example path params ({MESSAGE_ID}; YAML {mailboxId} behavior).
docs/sources/google-workspace/gdrive/README.md	Documents Drive {FILE_ID} example param source.
docs/sources/google-workspace/directory/README.md	Documents Directory example path params ({USER_ID}, {GROUP_ID}, {ORG_UNIT_PATH}).
docs/sources/google-workspace/calendar/README.md	Documents Calendar {EVENT_ID} and {accountId} conventions used in examples.
docs/sources/gitlab/gitlab-managed/README.md	Aligns GitLab Managed placeholders and documents the meaning of global IDs vs IIDs and SHAs.
docs/sources/gitlab/gitlab-cloud/README.md	Aligns GitLab Cloud placeholders and documents namespace/group/project/id semantics.
docs/sources/github/github/README.md	Adds Connector ID and documents placeholder semantics including GraphQL usage and pseudonymized usernames.
docs/sources/github/github-non-enterprise/README.md	Adds Connector ID, fixes example rules link, and documents placeholder semantics including GraphQL usage.
docs/sources/github/enterprise-server/README.md	Adds Connector ID and documents placeholder semantics including Enterprise Server API version and GraphQL path.
docs/sources/github/copilot/README.md	Adds Connector ID and documents placeholder semantics for Copilot connector examples.
docs/sources/dropbox-business/README.md	Documents that allow-listed Dropbox Business endpoints are POST and lists the supported example calls.
docs/sources/codex-enterprise-analytics/README.md	Standardizes {WORKSPACE_ID} placeholder and explains parameter meaning.
docs/sources/chatgpt-enterprise/README.md	Standardizes placeholder naming for legacy conversations endpoint note and documents example placeholders.
docs/sources/atlassian/organization/README.md	Standardizes {ORG_ID} / {DIRECTORY_ID} placeholders and explains their meaning.
docs/sources/atlassian/jira/README.md	Adds “example path parameters” section for Jira Cloud placeholders and how to obtain them.
docs/sources/atlassian/jira/jira-server.md	Adds short note documenting {ISSUE_ID} / {API_VERSION} example param meaning.
docs/sources/atlassian/confluence/README.md	Adds “example path parameters” section for Confluence placeholders and notes attachment-version param naming mismatch.
docs/sources/asana/README.md	Adds “example path parameters” section documenting how to source Asana GIDs used in examples.
docs/sources/anthropic/claude/README.md	Standardizes placeholder naming and documents how to source organization/chat/session IDs.
docs/sources/anthropic/claude-enterprise-analytics/README.md	Standardizes placeholder naming for spend-limit endpoints and documents ID sourcing.
docs/guides/testing.md	Updates Zoom meeting-summary guidance to use standardized {MEETING_ID} / {USER_ID} placeholders.
docs/guides/psoxy-test-tool.md	Updates Zoom meeting-summary section to use standardized {MEETING_ID} / {USER_ID} placeholders.

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

One newly added Salesforce example call interpolates an ID into a query string without URL-encoding, producing an invalid URL with the current default placeholder value.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

infra/modules/worklytics-connector-specs/main.tf:895

• The ids= query parameter is interpolated without URL-encoding. With the current default placeholder value for salesforce_example_account_id containing spaces, this will produce an invalid URL (and can break generated shell commands). URL-encode the value when used in a query string.

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Several newly edited docs/example sections contain correctness/clarity issues (notably stale deprecation-date phrasing and confusing placeholder/link labeling) that should be fixed before merge.

Review details

Suppressed comments (6)

Previously missed (5) — in code that hasn't changed since the last review.

docs/sources/chatgpt-enterprise/README.md:20

• This note refers to a deprecation date (June 6, 2026) that is now in the past, which makes the guidance potentially stale/ambiguous. Update the wording to reflect that the date has passed and readers should verify the current status.
  docs/sources/microsoft-365/msft-copilot/README.md:32
• The link text in the "Sanitized Example Response" column says response.json, but the linked files are response_beta.json and response_with_team_meeting_beta.json (and the second row's original link text has an extra underscore). Updating the link labels will avoid confusion when browsing the examples.
  docs/sources/salesforce/README.md:21
• The placeholder token {ANY ACCOUNT ID} contains spaces, which makes it look like it should be URL-encoded when used in example URLs. Prefer a URL-safe placeholder like {ANY_ACCOUNT_ID}.
  docs/sources/zoom/example-api-calls.md:12
• The sentence reads awkwardly ("change the role to assume with one..."). Reword to clarify that the assumed role should be changed to one with sufficient permissions.
  infra/modules/worklytics-connector-specs/main.tf:889
• This placeholder includes spaces ({ANY ACCOUNT ID}), which is not URL-safe and is inconsistent with other path/query placeholders. Use a no-space placeholder like {ANY_ACCOUNT_ID}.

This issue also appears on line 920 of the same file.

infra/modules/worklytics-connector-specs/main.tf:920

• This placeholder includes spaces ({ANY ACCOUNT ID}), which is not URL-safe when embedded in example URLs. Use {ANY_ACCOUNT_ID} to avoid spaces.

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 37 out of 37 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

infra/modules/worklytics-connector-specs/main.tf:1

• /2/files/list_revisions expects a file path/revisionable item, but the example body uses path = \"/\", which is typically a folder/root and is likely to fail when users run the generated test calls. Consider switching this to a clearly-labeled placeholder (e.g., a specific file path) and/or add a short comment indicating it must be a real file path from a prior listing call.
  infra/modules/worklytics-connector-specs/main.tf:1
• The {NAMESPACE_ID} guidance is circular: it says to get the namespace id from GET /api/v4/namespaces/{NAMESPACE_ID} itself. Since the namespace list endpoint was removed as not allow-listed, consider rewording to an actionable source (e.g., 'often the same as {GROUP_ID}' / 'can be taken from the group record' / 'use {GROUP_ID} as {NAMESPACE_ID} when applicable').

[eschultink]

doesn't appear correct to me, but double-check

[cursor]

Double-checked: Copilot’s “lone |” note is a false positive.

Line 74 is a full 3-column table row for /v1.0/users/{userId}/onlineMeetings/{meetingId}/attendanceReports/{reportId} (4 | characters, same as every other row). The next line is a blank line, then the placeholder paragraph. The trailing | is normal markdown table syntax.

That endpoint is allow-listed in msft-teams.yaml, Terraform has a matching example (.../attendanceReports/{REPORT_ID}), and both original/sanitized JSON files exist. No change needed.

[Copilot]

🔵 Needs a closer look

The Google Workspace Directory README still links readers to the Drive examples directory; the link should point to the Directory examples folder.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

docs/sources/google-workspace/directory/README.md:42

• The “See more examples” link points to the Google Drive (gdrive) examples directory, but this README has its own examples under docs/sources/google-workspace/directory/example-api-responses. This currently sends readers to the wrong location.

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

A documentation link in the Google Workspace Directory README points to the Drive example-api-responses folder instead of the Directory one.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

docs/sources/google-workspace/directory/README.md:41

• The “See more examples…” link points to the Google Drive example-api-responses folder, but this is the Directory connector doc; the Directory examples live under docs/sources/google-workspace/directory/example-api-responses.

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

Changes are confined to example-call definitions and documentation, and the updated examples are consistent with the repository’s allow-list rules and parameter schema constraints.

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

🟢 Approval recommended

The updates consistently align example calls/docs with the stated allow-lists and placeholder conventions without introducing functional/runtime behavior changes.

Review details

• Files reviewed: 38/38 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

A couple of the newly added/updated example-call annotations are internally inconsistent (notably around GitHub comment placement and legacy ChatGPT /conversations test calls), which can mislead users and cause avoidable “example” test failures.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

infra/modules/worklytics-connector-specs/main.tf:176

• These ChatGPT Enterprise example calls still include the legacy /conversations endpoints. In the same PR, docs state OpenAI reports these routes were removed (June 2026) and that new integrations should prefer /logs, so having them in the default test-call list may cause generated scripts to fail unexpectedly. Consider annotating these as legacy/optional (or removing them from the default example list) so the examples better reflect current behavior.
  infra/modules/worklytics-connector-specs/main.tf:74
• The comment block mentions a {USERNAME} placeholder "below" and says {ORG} is github_organization, but this local uses github_first_organization and the {USERNAME} placeholder is defined much later in the file. This makes the guidance easy to misread when someone edits the GraphQL example. Tighten the comment to state it uses the first org when comma-separated and explicitly point to where the REST {USERNAME} placeholder is defined.

• Files reviewed: 38/38 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

There is at least one broken doc link and several newly added GitHub example-call placeholders are inconsistent with the documented {USERNAME} placeholder convention.

Review details

Suppressed comments (5)

Previously missed (2) — in code that hasn't changed since the last review.

docs/guides/psoxy-test-tool.md:145

• The relative link to the Zoom example API calls is incorrect: ../../docs/sources/... resolves to docs/docs/... from this file’s location and will 404. Use a path relative to docs/guides/ (same as docs/guides/testing.md).
  infra/modules/worklytics-connector-specs/main.tf:527
• This example call uses an inline p~REPLACE_... token, but the surrounding docs refer to a {USERNAME} placeholder and the PR’s placeholder convention is {UPPERCASE_NAME}. Using {USERNAME} here makes it consistent and clearer that it must be substituted.

This issue also appears in the following locations of the same file:

• line 611
• line 681
• line 761

infra/modules/worklytics-connector-specs/main.tf:611

• This example call uses an inline p~REPLACE_... token, but the connector docs and the comment above describe a {USERNAME} placeholder. Prefer {USERNAME} so the placeholder format is consistent across the generated example calls.
  infra/modules/worklytics-connector-specs/main.tf:681
• This example call hardcodes p~REPLACE_... instead of using the {USERNAME} placeholder described in the preceding comment. Using {USERNAME} keeps placeholder syntax consistent across connectors and matches the docs.
  infra/modules/worklytics-connector-specs/main.tf:761
• This example call uses an inline p~REPLACE_... token rather than a {USERNAME} placeholder (as referenced in the comment above and the GitHub connector docs). Switching to {USERNAME} makes the generated example calls easier to scan and substitute.

• Files reviewed: 38/38 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The GitHub audit-log example endpoints and related placeholder documentation introduce likely-nonfunctional /organizations/.../audit-log calls and misleading {INSTALLATION_ID} guidance that should be corrected before merge.

Review details

Suppressed comments (6)

Previously missed (4) — in code that hasn't changed since the last review.

infra/modules/worklytics-connector-specs/main.tf:527

• /organizations/${local.github_installation_id}/audit-log uses the GitHub App installation id, but GitHub’s audit log API is /orgs/{org}/audit-log (already listed just above). Keeping this extra example call is misleading and will likely 404 upstream; it also makes the path-param comment incorrectly list {INSTALLATION_ID} as a path param.

This issue also appears in the following locations of the same file:

• line 610
• line 680
  docs/sources/github/copilot/README.md:23

• {INSTALLATION_ID} is listed as an "Example API call path parameter", but the example calls don’t use it as a path segment. This is likely to confuse readers; github_copilot_installation_id is a connector setting for app-token refresh, not a placeholder in the example API call URLs.
  docs/sources/github/enterprise-server/README.md:24
• This connector’s example API calls don’t use {INSTALLATION_ID} as a path segment (and GitHub Enterprise Server auth flow here is user-token based). Listing {INSTALLATION_ID} as an "Example API call path parameter" is misleading.
  docs/sources/github/github/README.md:23
• {INSTALLATION_ID} is listed as an "Example API call path parameter", but none of the example calls use it as a path segment (audit log uses /orgs/{ORG}/audit-log). Keeping it here is confusing; github_installation_id is a connector setting used for app-token refresh, not a placeholder in the example API call URLs.

infra/modules/worklytics-connector-specs/main.tf:610

• /organizations/${local.github_copilot_installation_id}/audit-log is not a valid GitHub REST audit-log route (the audit log is under /orgs/{org}/audit-log, which is already in the list). Including this example call will likely fail and makes the {INSTALLATION_ID} path-param comment inaccurate.
  infra/modules/worklytics-connector-specs/main.tf:680
• /api/.../organizations/${local.github_installation_id}/audit-log uses the GitHub App installation id, but the audit log API is under /api/.../orgs/{org}/audit-log (already listed). This example call will likely fail against GitHub Enterprise Server and also incorrectly documents {INSTALLATION_ID} as a path param.

• Files reviewed: 38/38 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The changes are documentation and example-call/spec alignment updates with no detected inconsistencies in the updated references or allow-list-related guidance.

Review details

• Files reviewed: 38/38 changed files
• Comments generated: 0 new
• Review effort level: Lite