# CLI: Integrations

Connect your tools and the sources Bumpkit reads.

## bumpkit integrations

Connect Slack, Discord, Linear, PostHog and webhooks. Alias: `apps`. See [Integrations](/docs/integrations).

| Subcommand | Usage | Description |
|------------|-------|-------------|
| `connect` | `bumpkit integrations connect NAME [flags]` | Connect an available integration (owners and admins). Feature access and provider permissions apply. |
| `list` (alias `ls`) | `bumpkit integrations list` | Show which integrations are connected |
| `test` | `bumpkit integrations test NAME` | Send a test message or check the connection |
| `disconnect` | `bumpkit integrations disconnect NAME` | Disconnect an integration; `-y`, `--yes` skips the confirmation |
| `authorize` | `bumpkit integrations authorize PROVIDER [--set key=value] [--no-browser] [--timeout 3m] [--flow FLOW]` | Authorize the Slack App, Jira, Notion or Confluence in your browser |
| `oauth-status` | `bumpkit integrations oauth-status PROVIDER [--flow FLOW]` | Show a provider's authorization status, or one authorization flow |
| `slack-app` | `bumpkit integrations slack-app channel CHANNEL_ID`, `posting every\|approval`, `disconnect` | Manage the Slack App apart from the Slack incoming webhook |
| `linear teams` | `bumpkit integrations linear teams (--token-stdin \| --token-file PATH \| --token-env NAME)` | List the Linear teams a key can read, without saving the key |
| `request` | `bumpkit integrations request NAME` | Ask for access to an integration that's coming soon |
| `deliveries` | `bumpkit integrations deliveries list NAME`, `retry NAME DELIVERY_ID` | Find and retry failed change-management deliveries |

### Linear teams

`integrations linear teams` shows the ID, key and name of each Linear team your key can read, so you can pick one for `connect linear --team`. It doesn't save the key or connect anything. You need to be an owner or admin, and the Linear key needs Read permission. Pass the key one way only: `--token-stdin`, `--token-file PATH` or `--token-env NAME`. With `--token-env`, pass the variable's name, not its value. A token file must be a regular file that only you can read (`chmod 600`). Listing teams doesn't prove the key can create or update issues.

```text
echo "$LINEAR_KEY" | bumpkit integrations linear teams --token-stdin
```

### Access requests

`integrations request NAME` asks for access to an integration that's coming soon: `origin` (Cursor Origin), `gitlab`, `bitbucket` or `azure-devops`. Any role that can make changes can ask; viewers and auditors can't. Once an integration is on for your workspace, you connect it instead.

```text
bumpkit integrations request gitlab
```

### Browser authorization

Use a personal CLI key for the same workspace and owner or org-admin account you use in the browser. The provider must be enabled for your workspace.

```bash
bumpkit integrations authorize slack-app --no-browser
bumpkit integrations authorize jira --set project=OPS --no-browser
bumpkit integrations authorize notion --set parent=NOTION_PAGE_ID --no-browser
bumpkit integrations authorize confluence --set base_url=https://acme.atlassian.net --set parent=ENG --no-browser
```

`--no-browser` prints the approval URL. Open it, review the workspace and settings, and grant access at the provider. Without this flag, the CLI opens the same approval page. Bumpkit does not replace OAuth consent with an API token or incoming webhook.

The CLI waits up to `--timeout` (default `3m`) and verifies the actual OAuth callback and current workspace connection. An older connection does not complete a new authorization. Pending authorization returns exit code `3` and its resumable flow; flows expire after ten minutes.

```bash
bumpkit integrations oauth-status slack-app
bumpkit integrations oauth-status slack-app --flow FLOW
bumpkit integrations authorize slack-app --flow FLOW --no-browser
```

Use the flow printed by your terminal. Resume with the same personal account and workspace. Provider settings cannot be changed while resuming; start a new authorization for different settings.

After installing the Slack App, choose its channel:

```bash
bumpkit integrations slack-app channel CHANNEL_ID
bumpkit integrations slack-app posting every
bumpkit integrations slack-app reauthorize
bumpkit integrations slack-app disconnect --yes
```

Selecting the channel verifies posting access and sends a confirmation message. Invite Bumpkit to that channel first. `posting every` posts each pull request to the channel as one message kept current as checks run; `posting approval` posts a pull request only once a check needs approval. Drafts are posted when marked ready for review. `oauth-status slack-app` shows the channel as `#name` and lists any Slack permissions the app is missing. `reauthorize` opens the Slack approval page to update those permissions (pass `--no-browser` to just print the link); the channel, posting mode and settings stay as they are. Then resume the original flow to verify completion. These commands manage the Slack App; `integrations connect slack` and `integrations disconnect slack` separately manage an incoming webhook.

Jira accepts `--set site=…`, `project`, `issue_type`, `approve`, `ship`, and `rollback`. Notion requires `parent`. Confluence requires `base_url` and its space key as `parent`, with an optional numeric `parent_page`. Only nonsecret settings are accepted by the browser authorization command.

Keep secrets out of your shell history: leave a secret flag out to be prompted, or pass `-` to read it from stdin. A value typed after the flag works too, but your shell keeps it.

| Integration | Flags |
|-------------|-------|
| `slack` | `--url` (incoming webhook URL) |
| `discord` | `--url` (channel webhook URL) |
| `webhook` | `--url` (https, public host) |
| `linear` | `--api-key` and `--team` (ID, key or name) |
| `posthog` | `--api-key` (`phx_…`), `--project` and `--host` (`us`, `eu` or your https host) |

`integrations connect` flags:

| Flag | Default | Description |
|------|---------|-------------|
| `--api-key` | Prompt | API key, or `-` for stdin |
| `--host` | | PostHog region (`us`, `eu`) or your PostHog instance's https address |
| `--project` | | PostHog project ID |
| `--team` | | Linear team ID, key or name |
| `--url` | Prompt | Webhook URL, or `-` for stdin |

```bash
echo "$LINEAR_KEY" | bumpkit integrations connect linear --api-key - --team ENG
```

### Beta: change management

> **Beta, early access.** Flags: `jira`, `servicenow`, `teams`, `vanta`, `drata`.

Change-management integrations are for owners and admins, and each needs its feature on for the workspace. They are available on every workspace: Bumpkit charges only for release checks, in prepaid credits, and connecting an integration costs nothing. Pass each setting with `--set key=value` (repeatable) and the secret with `--api-key` or `--url`.

| Integration | Settings and secret |
|-------------|---------------------|
| `jira` | `--set site=acme --set email=… --set project=OPS`, optionally `--set issue_type=Task --set approve=Approved --set ship=Done --set rollback="Rolled back"`; `--api-key` (API token) |
| `servicenow` | `--set instance=acme --set username=…`, optionally `--set auth=oauth --set client_id=…`; `--api-key` (password or client secret) |
| `teams` | `--url` (Workflows webhook URL) |
| `vanta` | `--set client_id=… --set document_id=…`; `--api-key` (client secret) |
| `drata` | `--set workspace_id=1 --set evidence_id=7`, optionally `--set region=eu`; `--api-key` (API key) |

```bash
echo "$JIRA_TOKEN" | bumpkit integrations connect jira --set site=acme --set email=bot@acme.com --set project=OPS --api-key -
```

When a change ticket or evidence upload can't be delivered after its retries, it waits as a failed delivery. `NAME` is `jira`, `servicenow`, `teams`, `vanta` or `drata`, and its feature must be on for your workspace.

| Subcommand | Usage | Description |
|------------|-------|-------------|
| `deliveries list` | `bumpkit integrations deliveries list NAME` | Show each failed delivery's ID, provider and kind |
| `deliveries retry` | `bumpkit integrations deliveries retry NAME DELIVERY_ID` | Queue one failed delivery to send again (owners and admins) |

A retry is written to the audit log as `integration.retry`. Retrying a delivery that isn't failed returns `404 NOT_FOUND`.

```text
bumpkit integrations deliveries list jira
bumpkit integrations deliveries retry jira DELIVERY_ID
```

## bumpkit sources

> **Beta, early access.** Flags: `forensics` or `release_health` for incident sources; `pagerduty`, `datadog`, `vercel_deploys`, `argocd_deploys` and `railway_deploys` for those providers.

Set up the webhooks that send incidents and deploys to Bumpkit. See [Integrations](/docs/built-in#configure-incident-and-deploy-sources-in-the-cli).

| Subcommand | Usage | Description |
|------------|-------|-------------|
| `list` | `bumpkit sources list PROVIDER` | Show each source's ID, repository, status, webhook URL and signing header, never its secret |
| `add` | `bumpkit sources add PROVIDER --repository owner/name` | Add a source for a repository and print its webhook URL |
| `set-secret` | `bumpkit sources set-secret PROVIDER SOURCE_ID (--secret-stdin \| --secret-env NAME \| --secret-file PATH)` | Save the signing secret Sentry, PagerDuty or Vercel gave you |
| `remove` (alias `rm`) | `bumpkit sources remove PROVIDER SOURCE_ID --yes` | Remove a source and stop accepting its deliveries |

`PROVIDER` is `sentry`, `pagerduty`, `datadog`, `webhook` (the generic alert webhook), `vercel`, `argocd` or `railway`. Owners and admins add sources, set secrets and remove them. Pass `--repository` exactly as your release checks record it; the CLI doesn't read it from the current directory.

Sentry, PagerDuty and Vercel sources stay `pending_secret` until you save the secret the provider issues. Pass it one way only, and never as an argument: `--secret-stdin`, `--secret-env NAME` (the variable's name, not its value) or `--secret-file PATH`. It must be 1 to 512 bytes, and the CLI never prints it. Datadog, the generic webhook, Argo CD and Railway get a secret from Bumpkit instead. `add` prints it once with the header to send it in, so store it right away. To replace one, remove the source and add it again.

A saved source isn't proof that deliveries work, so send a test event from the provider. Removing a source keeps the incidents and deploys it already recorded.

```bash
bumpkit sources list sentry
```