> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an integration

> Connect your cloud, code, and security tools to Tolmo from the web app or the CLI, and inspect existing integrations.

Each integration shows Tolmo a part of your production. Tolmo uses the integration to find changes in that part. You can connect integrations from the web app or from the CLI. The [integrations catalog](https://docs.tolmo.com/integrations/catalog.md) lists what each provider unlocks.

## Connect from the web app

**1. Pick a provider**

Choose the provider. Follow the instructions for that provider. Each provider lists the fields and permissions that it needs.

**2. Wait for the first scan**

A cloud integration starts its first scan immediately. Results usually appear within the hour.

## Connect from the CLI

Use `tolmo integration` to discover providers and to connect your organization's services. `tolmo integrations` is an alias.

## Discover provider requirements

```bash theme={null}
tolmo integration providers
tolmo integration providers --json
tolmo integration list --json
```

The provider catalog lists configuration fields, secret fields, required values, and provider documentation links. The integration list shows integration IDs, aliases, and non-secret configuration.

## Connect an integration

Use the fields from the provider catalog. For an AWS role integration:

```bash theme={null}
tolmo integration connect aws --alias production --config roleArn=arn:aws:iam::123456789012:role/CloudScanner --config externalId=my-external-id
```

| Flag | Behavior |
| - | - |
| `--alias` | Required friendly name |
| `--config key=value` | Configuration field; repeat for multiple values |
| `--secret key=value` | Secret field; repeat for multiple values |
| `--config-json` | Configuration object as a JSON string |
| `--secrets-json` | Secret fields as a JSON string |
| `--id` | Existing integration ID to update; omit to create |
| `--json` | Return the result as JSON |

A `--config` or `--secret` value overrides the matching field in its JSON object. Do not put literal credentials in your shell history.

Most OAuth providers, including GitHub, connect through the web app. For these providers, the CLI prints the page to open. CircleCI also supports a browser flow from the CLI:

```bash theme={null}
tolmo integration connect circleci --alias ci --oauth
tolmo integration connect circleci --alias ci --oauth --no-browser
```

`--no-browser` prints the authorization URL. It requires `--oauth`. You cannot use config or secret fields with the CircleCI OAuth flow.

## Query a connected service

After you connect a service, use [Query](https://docs.tolmo.com/knowledge-graph/connected-services.md) to send supported requests to the provider:

```bash theme={null}
tolmo query list
tolmo query --integration <integration-id> github /repos/acme/payments/pulls
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.