Connectors block 15: 19 media, forms, no-code, HR, storage, CMS and Russian marketplace adapters

[helpcodeai]

Block 15, the last of the Composio gap list: media, forms and no-code, HR and invoicing, storage, CMS and the two Russian services people asked for. Nineteen are listed, which brings the catalog to 474 adapters and 7,157 tools. ADP is not built: it requires a client certificate on every call (mutual TLS), which the engine cannot present yet.

Connector	Tools	Notes
Spotify	27	OAuth with PKCE. Since February 2026 the app owner needs Premium and an app allows 5 users; none of the endpoints Spotify removed for development-mode apps is used, and the new playlist and library paths are. Playback control asks first.
Twitch	15	OAuth; the Client ID goes on every call. Channel, streams, videos, clips, schedule, search; clip and channel update ask first; chat announcement off.
Vimeo	14	Personal access token. Videos, folders, showcases, comments, transcripts; pull upload and edits ask first; delete off.
Snapchat Ads	16	OAuth (open to every advertiser). Organizations, ad accounts, campaigns, ad squads, ads, creatives, stats, audiences; campaign status asks first (JSON Patch); budget change off.
Jotform	19	API key, US/EU/HIPAA or Enterprise host. Forms, questions, submissions, reports, labels; submissions and clone ask first; delete off; submitter IP stripped.
Make	18	Token per zone. Scenarios, blueprints, logs, executions, connections, data stores, hooks; run, activate and data store writes ask first; webhook URLs and connection metadata stripped.
Bubble	8	App URL and admin token. App metadata, data types, things, backend workflows; create, update and workflow runs ask first; delete off.
Glide	6	Big Tables API. Tables and rows; add and update ask first; delete off. Plan availability is unclear on Glide's side and the setup says so.
Softr	13	Database API plus app users (Studio API, with the app domain). Records search and writes; magic links ask first; deletes off.
Workday	16	Read-only REST: workers, direct reports, organizations, job profiles and jobs, time off balances and entries, leaves, job postings. A tenant admin registers an API client for integrations and issues a non-expiring refresh token (refresh_token grant, no browser sign-in). Compensation is left out.
Everhour	24	Projects, tasks, time records, timers, clients, invoices, expenses, schedule, reports; time and timer writes ask first; delete off.
Quaderno	22	Contacts, invoices, credit notes, quotes, expenses, products, tax calculation and validation, reports; create and deliver ask first; delete off; customer IP and location evidence stripped.
Egnyte	14	Internal API key with the password grant (keys are approved by Egnyte). Folders, items, versions, search, small text files, links, permissions, events; share links ask first; delete off.
pCloud	16	OAuth, US or EU host. Folders, files, text files, links, revisions; folder and file writes ask first; deletes off.
Gumroad	15	Products, sales, subscribers, offer codes, license verification (does not count a use), custom fields; enable/disable and offer codes ask first; refund off. errorWhen turns success:false into errors.
Sanity	11	GROQ queries, documents, revisions, transactions, datasets, projects; drafts created, patched and published through the Actions API after confirmation; delete off.
Shortcut	20	Members, workflows, teams, projects, epics, iterations, objectives, labels, story search and history; story create, update and comments ask first; delete off.
Ozon Seller	27	Client-Id and Api-Key. Products, stocks, prices, FBS/FBO postings, returns, finance balance and accruals, analytics, warehouses, reviews and questions (subscription-gated); price and stock updates and replies ask first; ship and cancel off. Retired v3/finance/transaction/list replaced by the balance and accrual methods.
VK (VKontakte)	14	Community token for the community, messages and comments; an optional user or service token for wall, stats, market and albums (VK refuses those to community tokens). VK errors inside HTTP 200 surface through errorWhen. Posts publish publicly and ask first; deletes off.

Live check with a customer's key (Ozon). One Cloud workspace has a hand-built Ozon connector. The adapter's read tools were run read-only against it through the production RestEngine with schema defaults and response mapping: 18 of 21 return real data with shaped answers under 9 KB; the other three are refused by Ozon for the account's subscription (reviews, questions) or the key's role (cancel reasons). Two tools were fixed on the way (FBO list needs a period; FBS warehouse stocks needs an article or SKU) and the list mappings were tightened.

Verification for the rest. No other Cloud workspace has a hand-built connector for these services. Every tool was diffed against the vendor's official OpenAPI spec, schema, SDK or reference, and every route probed with a fake key; public reads ran for real where possible (Bubble metadata on bubble.io, a public Sanity dataset). Live specs gate reads behind RUN_<SLUG>_LIVE=1 and writes behind a second flag.

Checks (backend in packages/backend)

• node scripts/validate-adapters.mjs --warn (root): passed, no warnings from these adapters.
• node scripts/adapter-count.mjs --check (root): OK, 474 adapters, 20 keyless, 7,157 tools.
• npx tsc --noEmit -p tsconfig.json: clean.
• npx jest: 19,713 passed, 1,449 skipped, 0 failed. A first run had one failure in curl.parser.spec.ts (the 100 ms ReDoS timing test under full-suite load); it passes alone and on the rerun.
• eslint on the new specs: clean.