Register Anthropic access-review connector

Add the ANTHROPIC connector_provider enum value, its migration, and the
GraphQL enum binding, then register the provider as an API-key connector
that authenticates via x-api-key.

The probe URL is left empty because the shared connection probe cannot
send the required anthropic-version header and would misreport a valid
key; a dead key surfaces on the first member fetch instead.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/anthropic.go

@@ -0,0 +1,49 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/accessreview/drivers"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func anthropicRegistration() *Registration {
+	return &Registration{
+		Provider:       coredata.ConnectorProviderAnthropic,
+		DisplayName:    "Anthropic",
+		SupportsAPIKey: true,
+		// Anthropic's Admin API authenticates with the admin key in the
+		// x-api-key header; it rejects Authorization: Bearer and returns
+		// 400 when both headers are present. APIKeyHeader makes the
+		// APIKeyConnection send x-api-key instead of Bearer. There is no
+		// third-party OAuth2 flow for the Admin API, so this is API-key
+		// only and takes a single admin key (sk-ant-admin...) per org.
+		APIKeyHeader: "x-api-key",
+		// ProbeURL is intentionally empty: the generic probe issues a
+		// header-less GET that cannot send the required anthropic-version
+		// header, so it would 400 regardless of token validity. A dead
+		// key surfaces on the first ListAccounts instead.
+		NewDriver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) (drivers.Driver, error) {
+			return drivers.NewAnthropicDriver(c), nil
+		},
+		NewNameResolver: func(_ context.Context, c *http.Client, _ *coredata.Connector, _ *log.Logger) drivers.NameResolver {
+			return drivers.NewAnthropicNameResolver(c)
+		},
+	}
+}

pkg/connector/provider/builtin.go

@@ -22,6 +22,7 @@ package provider
 func NewBuiltinRegistry() *Registry {
 	r := NewRegistry()
 	for _, reg := range []*Registration{
+		anthropicRegistration(),
 		asanaRegistration(),
 		bitbucketRegistration(),
 		brexRegistration(),

pkg/coredata/connector_provider.go

@@ -50,6 +50,7 @@ const (
 	ConnectorProviderVercel       ConnectorProvider = "VERCEL"
 	ConnectorProviderMonday       ConnectorProvider = "MONDAY"
 	ConnectorProviderTailscale    ConnectorProvider = "TAILSCALE"
+	ConnectorProviderAnthropic    ConnectorProvider = "ANTHROPIC"
 )
 
 var (
@@ -87,6 +88,7 @@ func ConnectorProviders() []ConnectorProvider {
 		ConnectorProviderVercel,
 		ConnectorProviderMonday,
 		ConnectorProviderTailscale,
+		ConnectorProviderAnthropic,
 	}
 }
 
@@ -119,7 +121,8 @@ func (v ConnectorProvider) IsValid() bool {
 		ConnectorProviderClickUp,
 		ConnectorProviderVercel,
 		ConnectorProviderMonday,
-		ConnectorProviderTailscale:
+		ConnectorProviderTailscale,
+		ConnectorProviderAnthropic:
 		return true
 	}
 

pkg/coredata/migrations/20260528T613927Z.sql

@@ -0,0 +1,15 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TYPE connector_provider ADD VALUE IF NOT EXISTS 'ANTHROPIC';

pkg/server/api/console/v1/graphql/connector.graphql

@@ -46,6 +46,10 @@ enum ConnectorProvider
     MONDAY @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderMonday")
     TAILSCALE
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderTailscale")
+    ANTHROPIC
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderAnthropic"
+        )
 }
 
 type ConnectorProviderInfo {