AWS quick documentation change
Summary
Restructured Smartsheet connector documentation with updated authentication methods (Custom OAuth app and API Key), added detailed configuration steps, improved setup instructions for Amazon Quick, and updated troubleshooting guidance.
Security assessment
The changes enhance security documentation by emphasizing authentication method selection based on organizational security requirements, clarifying token storage best practices ('Store your access token securely'), and explaining permission implications for API Key usage. However, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/quick/latest/userguide/smartsheet-integration.md b/quick/latest/userguide/smartsheet-integration.md index 5f7058b96..a7d0f20ba 100644 --- a//quick/latest/userguide/smartsheet-integration.md +++ b//quick/latest/userguide/smartsheet-integration.md @@ -7 +7 @@ -PrerequisitesConfigure Smartsheet Developer ToolsOAuth access scopesSet up the integration in Amazon QuickAvailable actionsManage and troubleshoot +Before you beginConfiguring SmartsheetSetting up the connector in Amazon QuickAvailable actionsManaging and troubleshooting @@ -11 +11 @@ PrerequisitesConfigure Smartsheet Developer ToolsOAuth access scopesSet up the i -Use the Smartsheet action connector to manage sheets, rows, reports, and search across your Smartsheet workspaces directly in Amazon Quick through natural language. This integration uses the Smartsheet API. For more information, see [Smartsheet API introduction](https://developers.smartsheet.com/api/smartsheet/introduction) in the Smartsheet documentation. +With the Smartsheet action connector, you can manage sheets, rows, reports, and search across your Smartsheet workspaces directly in Amazon Quick through natural language. @@ -13 +13 @@ Use the Smartsheet action connector to manage sheets, rows, reports, and search -Setting up this integration involves two steps. First, you configure credentials in Smartsheet for your chosen authentication method. Then, you create the integration in Amazon Quick and connect it to your Smartsheet account. For information about the authentication methods that Amazon Quick supports, see [Authentication methods](./quick-action-auth.html). +Amazon Quick supports two authentication methods for Smartsheet. Choose the method that best fits your organization's security requirements. @@ -15 +15,3 @@ Setting up this integration involves two steps. First, you configure credentials -## Prerequisites + * **Custom OAuth app** – Each user signs in with their own Smartsheet account. Actions run with that user's permissions. This method uses an OAuth app registered in Smartsheet Developer Tools. + + * **API Key** – All actions run using a single Smartsheet API access token. @@ -17 +18,0 @@ Setting up this integration involves two steps. First, you configure credentials -Before you set up the integration, make sure that you meet the following requirements: @@ -19 +19,0 @@ Before you set up the integration, make sure that you meet the following require - * A Smartsheet account with a Business or Enterprise plan. Free accounts cannot generate API access tokens or register OAuth apps. For more information, see [Smartsheet pricing](https://www.smartsheet.com/pricing) on the Smartsheet website. @@ -21 +20,0 @@ Before you set up the integration, make sure that you meet the following require - * Access to [Smartsheet Developer Tools](https://developers.smartsheet.com/) activated for your account. To register, go to the [Developer Tools Registration](https://developers.smartsheet.com/register) page. @@ -23 +22 @@ Before you set up the integration, make sure that you meet the following require - * For subscription requirements, see [Set up integrations in the console](./integration-console-setup-process.html). +For more information about the authentication methods that Amazon Quick supports, see [Authentication methods](./quick-action-auth.html). For more information about Smartsheet OAuth, see [OAuth](https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth) in the Smartsheet API documentation. @@ -24,0 +24 @@ Before you set up the integration, make sure that you meet the following require +## Before you begin @@ -25,0 +26 @@ Before you set up the integration, make sure that you meet the following require +Make sure that you have the following before you set up the integration. @@ -26,0 +28 @@ Before you set up the integration, make sure that you meet the following require + * A Smartsheet account with a Business or Enterprise plan. Free accounts cannot generate API access tokens or register OAuth apps. For more information, see [Smartsheet pricing](https://www.smartsheet.com/pricing) on the Smartsheet website. @@ -28 +30 @@ Before you set up the integration, make sure that you meet the following require -## Configure Smartsheet Developer Tools + * For **Custom OAuth app** : Access to [Smartsheet Developer Tools](https://developers.smartsheet.com/) activated for your account. To register, go to the [Developer Tools Registration](https://developers.smartsheet.com/register) page. @@ -30 +32 @@ Before you set up the integration, make sure that you meet the following require -Before you configure Amazon Quick, set up credentials in Smartsheet. The steps you complete depend on which authentication method you plan to use. Amazon Quick supports two authentication methods for Smartsheet. For more information about these methods, see [Authentication methods](./quick-action-auth.html). + * For **API Key** : A Smartsheet API access token generated from your Smartsheet personal settings. @@ -32 +34 @@ Before you configure Amazon Quick, set up credentials in Smartsheet. The steps y - * **User authentication (OAuth)** – Each user signs in with their own Smartsheet account. Actions run with that user's permissions. This method uses [Custom OAuth app](./quick-action-auth.html#quick-custom-user-auth). Complete the Register for Developer Tools and create a developer profile and Register the OAuth application sections below. + * For Amazon Quick subscription requirements, see [Set up integrations in the console](./integration-console-setup-process.html). @@ -34 +35,0 @@ Before you configure Amazon Quick, set up credentials in Smartsheet. The steps y - * **Service authentication (API key)** – All actions run using a single API token. This method uses [API key authentication](./quick-action-auth.html#quick-actions-api-key-auth). Complete the Generate an API access token (service authentication only) section below. @@ -37,0 +39 @@ Before you configure Amazon Quick, set up credentials in Smartsheet. The steps y +## Configuring Smartsheet @@ -39 +41 @@ Before you configure Amazon Quick, set up credentials in Smartsheet. The steps y -For more information about Smartsheet OAuth, see [OAuth](https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth) in the Smartsheet API documentation. +Before you configure Amazon Quick, set up credentials in Smartsheet. The steps you complete depend on which authentication method you plan to use. @@ -41 +43 @@ For more information about Smartsheet OAuth, see [OAuth](https://developers.smar -### Register for Developer Tools and create a developer profile +### Register for Developer Tools and create a developer profile (Custom OAuth app) @@ -56 +58 @@ Smartsheet recommends using a dedicated service account for OAuth apps rather th -### Register the OAuth application +### Register the OAuth application (Custom OAuth app) @@ -76 +78 @@ Replace `{region}` with your AWS Region (for example, `us-east-1`). - 4. Copy the **Client ID** and **Client Secret** values. You need these when you configure the integration in Amazon Quick. + 4. Copy the **Client ID** and **Client Secret** values. You need them when you configure the connector in Amazon Quick. @@ -83 +85 @@ For more information, see [Register an app](https://developers.smartsheet.com/ap -### Generate an API access token (service authentication only) +### Generate an API access token (API Key) @@ -85 +87 @@ For more information, see [Register an app](https://developers.smartsheet.com/ap -If you plan to use service authentication instead of OAuth, generate an API access token. You must have a Business or Enterprise plan to generate tokens. For more information, see [Generate an API access token](https://help.smartsheet.com/articles/2482389-generate-API-key) in the Smartsheet Help Center. +If you plan to use API Key authentication, generate an API access token. You must have a Business or Enterprise plan to generate tokens. For more information, see [Generate an API access token](https://help.smartsheet.com/articles/2482389-generate-API-key) in the Smartsheet Help Center. @@ -100 +102 @@ Store your access token securely. Anyone with the token can access all Smartshee -## OAuth access scopes +### OAuth access scopes @@ -102 +104 @@ Store your access token securely. Anyone with the token can access all Smartshee -When you configure user authentication (OAuth), the integration requests the following access scopes from Smartsheet. These scopes determine what the integration can do on behalf of the authenticated user. If you use service authentication (API key) instead, the integration uses the full permissions of the token owner and scopes do not apply. For more information, see [Access scopes](https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth#access-scopes) in the Smartsheet API documentation. +When you configure Custom OAuth app, the connector requests the following access scopes from Smartsheet. These scopes determine what the connector can do on behalf of the authenticated user. If you use API Key authentication instead, the connector uses the full permissions of the token owner and scopes do not apply. For more information, see [Access scopes](https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth#access-scopes) in the Smartsheet API documentation. @@ -111 +113 @@ Smartsheet OAuth access scopes Scope | Description -Access scopes don't override existing sharing permissions. For example, having the `WRITE_SHEETS` scope doesn't allow the integration to update a sheet on which the user has only viewer-level access. For more information, see [Resource access levels](https://developers.smartsheet.com/api/smartsheet/guides/basics/resource-access-levels) in the Smartsheet API documentation. +Access scopes don't override existing sharing permissions. For example, having the `WRITE_SHEETS` scope doesn't allow the connector to update a sheet on which the user has only viewer-level access. For more information, see [Resource access levels](https://developers.smartsheet.com/api/smartsheet/guides/basics/resource-access-levels) in the Smartsheet API documentation. @@ -113,3 +115 @@ Access scopes don't override existing sharing permissions. For example, having t -## Set up the integration in Amazon Quick - -After you complete the Smartsheet Developer Tools configuration, create the integration in Amazon Quick. +## Setting up the connector in Amazon Quick @@ -123 +123,3 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 4. Enter the integration details: + 4. Enter a **Name** for your connector. Optionally, choose **\+ Add Description** to add a description. + + 5. For **Connection type** , choose **Public network**. @@ -125 +127 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Name** – Descriptive name for your Smartsheet integration. + 6. For **OAuth Configuration** , choose one of the following authentication methods and configure the required fields. @@ -127 +129 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Description** (Optional) – Purpose of the integration. + 1. For **Custom OAuth app** , configure the following fields: @@ -129 +131 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 5. Choose your connection type and fill in the connection settings. For more information about these authentication methods, see [Authentication methods](./quick-action-auth.html). + * **Base URL** – The Smartsheet MCP base URL. Example: `https://mcp.smartsheet.com` @@ -131 +133 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 1. For **User authentication (OAuth)** , use the Client ID and Client Secret from your Smartsheet Developer Tools app registration. Configure the following fields: + * **Client ID** – The client ID from your Smartsheet Developer Tools app registration. @@ -133 +135 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Base URL** – `https://api.smartsheet.com/2.0` + * **Public OAuth client** (Optional) – Select this option if your Smartsheet OAuth app is configured as a public client (no client secret). @@ -135 +137 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Client ID** – App client ID from your Smartsheet Developer Tools app registration. + * **Client secret** – The client secret from your Smartsheet Developer Tools app registration. @@ -137 +139 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Client Secret** – App secret from your Smartsheet Developer Tools app registration. + * **Token URL** – The Smartsheet OAuth token endpoint. Example: `https://api.smartsheet.com/2.0/token` @@ -139 +141 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Token URL** – `https://api.smartsheet.com/2.0/token` + * **Authorization URL** – The Smartsheet OAuth authorization endpoint. Example: `https://app.smartsheet.com/b/authorize` @@ -141 +143 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Auth URL** – `https://app.smartsheet.com/b/authorize` + * **Redirect URL** – Pre-filled with the Amazon Quick callback URL. @@ -143 +145 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Redirect URL** – `https://`{region}`.quicksight.aws.amazon.com/sn/oauthcallback` + 2. For **API Key** , configure the following fields: @@ -145 +147 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 2. For **Service authentication (API key)** , use the API access token from your Smartsheet Personal Settings. Configure the following fields: + * **Base URL** – The Smartsheet MCP base URL. Example: `https://mcp.smartsheet.com` @@ -147 +149 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **API Key** – Smartsheet API access token generated from your Personal Settings. + * **API Key** – The Smartsheet API access token generated from your personal settings. @@ -149 +151 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Base URL** – `https://api.smartsheet.com/2.0` + * **Email** (Optional) – The email address associated with the Smartsheet account that generated the token. @@ -151 +153 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - * **Email** – Email address associated with the Smartsheet account that generated the token. + 7. Choose **Next**. @@ -153 +155 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 6. Choose **Create and continue**. + 8. If you chose **Custom OAuth app** , a Smartsheet authorization window opens. Review the requested permissions and choose **Allow**. @@ -155 +157 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 7. Choose users to share the integration with. + 9. On the **Review** page, review the available actions for the connector. Choose **Next**. @@ -157 +159 @@ After you complete the Smartsheet Developer Tools configuration, create the inte - 8. Choose **Next**. + 10. On the **Publish** page, choose who can access the connector. You can enable access for everyone in your organization or search for specific teams or groups. @@ -158,0 +161 @@ After you complete the Smartsheet Developer Tools configuration, create the inte + 11. Choose **Publish**. @@ -162 +164,0 @@ After you complete the Smartsheet Developer Tools configuration, create the inte -For user authentication, go to **Connectors** > your Smartsheet connector name, and choose **Sign in** to complete the OAuth authorization flow. In the Smartsheet consent window, choose **Allow** to grant access. @@ -166 +168 @@ For user authentication, go to **Connectors** > your Smartsheet connector name, -With service authentication, all actions run using the API token owner's permissions. Any Amazon Quick user with access to this integration can perform actions on all Smartsheet resources that the token owner can access. Scope the token permissions appropriately for your organization's security requirements. +With API Key authentication, all actions run using the API token owner's permissions. Any Amazon Quick user with access to this connector can perform actions on all Smartsheet resources that the token owner can access. Scope the token permissions appropriately for your organization's security requirements. @@ -170,10 +172 @@ With service authentication, all actions run using the API token owner's permiss -If you use Smartsheet Gov, Smartsheet Regions Europe, or Smartsheet Regions Australia, use the corresponding base URL for your environment: - -Smartsheet regional base URLs Environment | Base URL ----|--- -Smartsheet | `https://api.smartsheet.com/2.0` -Smartsheet Gov | `https://api.smartsheetgov.com/2.0` -Smartsheet Regions Europe | `https://api.smartsheet.eu/2.0` -Smartsheet Regions Australia | `https://api.smartsheet.au/2.0` - -For more information, see [Base URL](https://developers.smartsheet.com/api/smartsheet/guides/basics/base-url) in the Smartsheet API documentation. +If you use Smartsheet Gov, Smartsheet Regions Europe, or Smartsheet Regions Australia, contact Smartsheet for the corresponding MCP base URL for your environment. The values shown in this guide assume the standard Smartsheet environment. @@ -183,9 +176 @@ For more information, see [Base URL](https://developers.smartsheet.com/api/smart -After you set up the integration, the following actions are available. - -Smartsheet available actions Category | Action | Description ----|---|--- -Search | List Search | Searches all sheets that the user can access for specified text. -Sheets | List Sheets | Lists all sheets that are accessible to the authenticated user. -Sheets | Get Sheet | Gets a sheet and its data based on the sheet ID. -Reports | List Reports | Lists all reports that are accessible to the user. -Reports | View Report | Gets report details based on the report ID. +After you set up the connector, the actions exposed by the Smartsheet MCP server are available. To see the current set of actions for your connector, go to the connector's **Available actions** view in the Amazon Quick console. @@ -193 +178 @@ Reports | View Report | Gets report details based on the report ID. -## Manage and troubleshoot +## Managing and troubleshooting @@ -195 +180 @@ Reports | View Report | Gets report details based on the report ID. -To edit, share, or delete your integration, see [Managing existing integrations](./integration-workflows.html#managing-existing-integrations). +To edit, share, or delete your connector, see [Managing existing integrations](./integration-workflows.html#managing-existing-integrations). @@ -203 +188 @@ To edit, share, or delete your integration, see [Managing existing integrations] - * **API key authentication fails** – Verify that the access token has not been revoked. You can manage tokens from **Personal Settings** > **API Access** in the Smartsheet application. For more information, see [Generate an API access token](https://help.smartsheet.com/articles/2482389-generate-API-key) in the Smartsheet Help Center. + * **API Key authentication fails** – Verify that the access token has not been revoked. You can manage tokens from **Personal Settings** > **API Access** in the Smartsheet application. For more information, see [Generate an API access token](https://help.smartsheet.com/articles/2482389-generate-API-key) in the Smartsheet Help Center. @@ -205 +190 @@ To edit, share, or delete your integration, see [Managing existing integrations] - * **Access token expired** – OAuth access tokens expire after approximately 7 days. Amazon Quick handles token refresh automatically. If you encounter persistent token errors, sign out and sign in again from the integration settings. For more information, see [Make API calls](https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth#make-api-calls) in the Smartsheet API documentation. + * **Access token expired** – OAuth access tokens expire after approximately 7 days. Amazon Quick handles token refresh automatically. If you encounter persistent token errors, sign out and sign in again from the connector settings. For more information, see [Make API calls](https://developers.smartsheet.com/api/smartsheet/guides/advanced-topics/oauth#make-api-calls) in the Smartsheet API documentation. @@ -229 +214 @@ Slack integration -Visier integration +Snowflake Cortex Agent