diff --git a/.gon-amd64.json b/.gon-amd64.json
index e9cb875..bd56e16 100644
--- a/.gon-amd64.json
+++ b/.gon-amd64.json
@@ -1,6 +1,6 @@
 {
-  "source": ["./dist/macos-amd64_darwin_amd64_v1/baton-example"],
-  "bundle_id": "com.conductorone.baton-example",
+  "source": ["./dist/macos-amd64_darwin_amd64_v1/baton-broadcom-sac"],
+  "bundle_id": "com.conductorone.baton-broadcom-sac",
   "apple_id": {
     "username" : "justin.gallardo@conductorone.com",
     "password":  "@env:AC_PASSWORD"
@@ -9,6 +9,6 @@
     "application_identity": "Developer ID Application: Justin Gallardo (858DKH55XL)"
   },
   "zip" :{
-    "output_path":  "./dist/baton-example-darwin-amd64.signed.zip"
+    "output_path":  "./dist/baton-broadcom-sac-darwin-amd64.signed.zip"
   }
 }
\ No newline at end of file
diff --git a/.gon-arm64.json b/.gon-arm64.json
index 3793d85..08b8446 100644
--- a/.gon-arm64.json
+++ b/.gon-arm64.json
@@ -1,6 +1,6 @@
 {
-  "source": ["./dist/macos-arm64_darwin_arm64/baton-example"],
-  "bundle_id": "com.conductorone.baton-example",
+  "source": ["./dist/macos-arm64_darwin_arm64/baton-broadcom-sac"],
+  "bundle_id": "com.conductorone.baton-broadcom-sac",
   "apple_id": {
     "username" : "justin.gallardo@conductorone.com",
     "password":  "@env:AC_PASSWORD"
@@ -9,6 +9,6 @@
     "application_identity": "Developer ID Application: Justin Gallardo (858DKH55XL)"
   },
   "zip" :{
-    "output_path":  "./dist/baton-example-darwin-arm64.signed.zip"
+    "output_path":  "./dist/baton-broadcom-sac-darwin-arm64.signed.zip"
   }
 }
\ No newline at end of file
diff --git a/.goreleaser.docker.yaml b/.goreleaser.docker.yaml
index 252da1e..90c0b71 100644
--- a/.goreleaser.docker.yaml
+++ b/.goreleaser.docker.yaml
@@ -1,10 +1,10 @@
-project_name: baton-example
+project_name: baton-broadcom-sac
 builds:
-  - binary: baton-example
+  - binary: baton-broadcom-sac
     env:
       - CGO_ENABLED=0
     id: linux
-    main: ./cmd/baton-example
+    main: ./cmd/baton-broadcom-sac
     goos:
       - linux
     goarch:
@@ -15,37 +15,37 @@ dockers:
     goos: linux
     goarch: amd64
     image_templates:
-      - "ghcr.io/conductorone/baton-example:{{ .Version }}-amd64"
-      - "ghcr.io/conductorone/baton-example:latest-amd64"
+      - "ghcr.io/conductorone/baton-broadcom-sac:{{ .Version }}-amd64"
+      - "ghcr.io/conductorone/baton-broadcom-sac:latest-amd64"
     build_flag_templates:
       - "--platform=linux/amd64"
       - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title=baton-example"
+      - "--label=org.opencontainers.image.title=baton-broadcom-sac"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.source=https://github.com/conductorone/baton-example"
+      - "--label=org.opencontainers.image.source=https://github.com/conductorone/baton-broadcom-sac"
   - use: buildx
     goos: linux
     goarch: arm64
     image_templates:
-      - "ghcr.io/conductorone/baton-example:{{ .Version }}-arm64"
-      - "ghcr.io/conductorone/baton-example:latest-arm64"
+      - "ghcr.io/conductorone/baton-broadcom-sac:{{ .Version }}-arm64"
+      - "ghcr.io/conductorone/baton-broadcom-sac:latest-arm64"
     build_flag_templates:
       - "--platform=linux/arm64/v8"
       - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title=baton-example"
+      - "--label=org.opencontainers.image.title=baton-broadcom-sac"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.source=https://github.com/conductorone/baton-example"
+      - "--label=org.opencontainers.image.source=https://github.com/conductorone/baton-broadcom-sac"
 docker_manifests:
-  - name_template: ghcr.io/conductorone/baton-example:{{ .Version }}
+  - name_template: ghcr.io/conductorone/baton-broadcom-sac:{{ .Version }}
     image_templates:
-      - ghcr.io/conductorone/baton-example:{{ .Version }}-amd64
-      - ghcr.io/conductorone/baton-example:{{ .Version }}-arm64
-  - name_template: ghcr.io/conductorone/baton-example:latest
+      - ghcr.io/conductorone/baton-broadcom-sac:{{ .Version }}-amd64
+      - ghcr.io/conductorone/baton-broadcom-sac:{{ .Version }}-arm64
+  - name_template: ghcr.io/conductorone/baton-broadcom-sac:latest
     image_templates:
-      - ghcr.io/conductorone/baton-example:latest-amd64
-      - ghcr.io/conductorone/baton-example:latest-arm64
+      - ghcr.io/conductorone/baton-broadcom-sac:latest-amd64
+      - ghcr.io/conductorone/baton-broadcom-sac:latest-arm64
 checksum:
   disable: true
 release:
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 25a26f4..2d4a51f 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -1,20 +1,20 @@
-project_name: baton-example
+project_name: baton-broadcom-sac
 builds:
-  - binary: baton-example
+  - binary: baton-broadcom-sac
     env:
       - CGO_ENABLED=0
     id: linux
-    main: ./cmd/baton-example
+    main: ./cmd/baton-broadcom-sac
     goos:
       - linux
     goarch:
       - amd64
       - arm64
-  - binary: baton-example
+  - binary: baton-broadcom-sac
     env:
       - CGO_ENABLED=0
     id: macos-amd64
-    main: ./cmd/baton-example
+    main: ./cmd/baton-broadcom-sac
     goos:
       - darwin
     goarch:
@@ -22,12 +22,12 @@ builds:
     hooks:
       post:
         - gon .gon-amd64.json
-        - mv dist/baton-example-darwin-amd64.signed.zip dist/macos-amd64_darwin_amd64_v1/baton-example
-  - binary: baton-example
+        - mv dist/baton-broadcom-sac-darwin-amd64.signed.zip dist/macos-amd64_darwin_amd64_v1/baton-broadcom-sac
+  - binary: baton-broadcom-sac
     env:
       - CGO_ENABLED=0
     id: macos-arm64
-    main: ./cmd/baton-example
+    main: ./cmd/baton-broadcom-sac
     goos:
       - darwin
     goarch:
@@ -35,7 +35,7 @@ builds:
     hooks:
       post:
         - gon .gon-arm64.json
-        - mv dist/baton-example-darwin-arm64.signed.zip dist/macos-arm64_darwin_arm64/baton-example
+        - mv dist/baton-broadcom-sac-darwin-arm64.signed.zip dist/macos-arm64_darwin_arm64/baton-broadcom-sac
 archives:
   - id: linux-archive
     builds:
@@ -71,9 +71,9 @@ brews:
     folder: Formula
     homepage: https://conductorone.com
     test: |
-      system "#{bin}/baton-example -v"
+      system "#{bin}/baton-broadcom-sac -v"
     install: |-
-      bin.install "baton-example"
+      bin.install "baton-broadcom-sac"
 changelog:
   filters:
     exclude:
diff --git a/Makefile b/Makefile
index f861468..c260755 100644
--- a/Makefile
+++ b/Makefile
@@ -1,13 +1,16 @@
 GOOS = $(shell go env GOOS)
 GOARCH = $(shell go env GOARCH)
 BUILD_DIR = dist/${GOOS}_${GOARCH}
-OUTPUT_PATH = ${BUILD_DIR}/baton-example
+
+ifeq ($(GOOS),windows)
+OUTPUT_PATH = ${BUILD_DIR}/baton-broadcom-sac.exe
+else
+OUTPUT_PATH = ${BUILD_DIR}/baton-broadcom-sac
+endif
 
 .PHONY: build
 build:
-	rm -f ${OUTPUT_PATH}
-	mkdir -p ${BUILD_DIR}
-	go build -o ${OUTPUT_PATH} cmd/baton-example/*.go
+	go build -o ${OUTPUT_PATH} ./cmd/baton-broadcom-sac
 
 .PHONY: update-deps
 update-deps:
diff --git a/README.md b/README.md
index 74de758..6bb0384 100644
--- a/README.md
+++ b/README.md
@@ -60,20 +60,16 @@ Available Commands:
   help               Help about any command
 
 Flags:
-      --client-id string              The client ID used to authenticate with ConductorOne ($BATON_CLIENT_ID)
-      --client-secret string          The client secret used to authenticate with ConductorOne ($BATON_CLIENT_SECRET)
-  -f, --file string                   The path to the c1z file to sync with ($BATON_FILE) (default "sync.c1z")
-      --grant-entitlement string      The entitlement to grant to the supplied principal ($BATON_GRANT_ENTITLEMENT)
-      --grant-principal string        The resource to grant the entitlement to ($BATON_GRANT_PRINCIPAL)
-      --grant-principal-type string   The resource type of the principal to grant the entitlement to ($BATON_GRANT_PRINCIPAL_TYPE)
-  -h, --help                          help for baton-example
-      --log-format string             The output format for logs: json, console ($BATON_LOG_FORMAT) (default "json")
-      --log-level string              The log level: debug, info, warn, error ($BATON_LOG_LEVEL) (default "info")
-      --password string               Password for your Broadcom SAC instance. ($BATON_PASSWORD)
-      --revoke-grant string           The grant to revoke ($BATON_REVOKE_GRANT)
-      --tenant string                 Name of your Broadcom SAC tenant. ($BATON_TENANT)
-      --username string               Username for your Broadcom SAC instance. ($BATON_USERNAME)
-  -v, --version                       version for baton-example
+      --client-id string       The client ID used to authenticate with ConductorOne ($BATON_CLIENT_ID)
+      --client-secret string   The client secret used to authenticate with ConductorOne ($BATON_CLIENT_SECRET)
+  -f, --file string            The path to the c1z file to sync with ($BATON_FILE) (default "sync.c1z")
+  -h, --help                   help for baton-broadcom-sac
+      --log-format string      The output format for logs: json, console ($BATON_LOG_FORMAT) (default "json")
+      --log-level string       The log level: debug, info, warn, error ($BATON_LOG_LEVEL) (default "info")
+      --password string        Password for your Broadcom SAC instance. ($BATON_PASSWORD)
+      --tenant string          Name of your Broadcom SAC tenant. ($BATON_TENANT)
+      --username string        Username for your Broadcom SAC instance. ($BATON_USERNAME)
+  -v, --version                version for baton-broadcom-sac
 
 Use "baton-broadcom-sac [command] --help" for more information about a command.
 
diff --git a/cmd/baton-broadcom-sac/main.go b/cmd/baton-broadcom-sac/main.go
index 857bd00..6865c94 100644
--- a/cmd/baton-broadcom-sac/main.go
+++ b/cmd/baton-broadcom-sac/main.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/ConductorOne/baton-broadcom-sac/pkg/connector"
+	"github.com/conductorone/baton-broadcom-sac/pkg/connector"
 	"github.com/conductorone/baton-sdk/pkg/cli"
 	"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
 	"github.com/conductorone/baton-sdk/pkg/types"
diff --git a/go.mod b/go.mod
index 8558afd..8bb32b8 100644
--- a/go.mod
+++ b/go.mod
@@ -1,9 +1,9 @@
-module github.com/ConductorOne/baton-broadcom-sac
+module github.com/conductorone/baton-broadcom-sac
 
-go 1.19
+go 1.20
 
 require (
-	github.com/conductorone/baton-sdk v0.1.0
+	github.com/conductorone/baton-sdk v0.1.4
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/spf13/cobra v1.7.0
 	go.uber.org/zap v1.24.0
@@ -69,6 +69,7 @@ require (
 	golang.org/x/crypto v0.11.0 // indirect
 	golang.org/x/net v0.12.0 // indirect
 	golang.org/x/oauth2 v0.10.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
 	golang.org/x/sys v0.10.0 // indirect
 	golang.org/x/term v0.10.0 // indirect
 	golang.org/x/text v0.11.0 // indirect
diff --git a/go.sum b/go.sum
index 18988ec..ca5e5ce 100644
--- a/go.sum
+++ b/go.sum
@@ -89,8 +89,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/conductorone/baton-sdk v0.1.0 h1:L/M6aQKvMIKK9Z+G9N7qCGSkbnuWI7D78JS08nHSn1E=
-github.com/conductorone/baton-sdk v0.1.0/go.mod h1:/R7oz1BwrppCqxKKJrx8WH1CyIbEXiDo85QNzatYOvk=
+github.com/conductorone/baton-sdk v0.1.4 h1:WP9NrwIh8TQQ2A5RBkosuObNOnhpJDJsU1oyFz7b/GE=
+github.com/conductorone/baton-sdk v0.1.4/go.mod h1:lU1sLusR2oqts/k5BvYhoNKQ4Nl9qG8slJD/YEcKt9E=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -418,6 +418,8 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/pkg/connector/account.go b/pkg/connector/account.go
index a775e69..2de29af 100644
--- a/pkg/connector/account.go
+++ b/pkg/connector/account.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	sac "github.com/ConductorOne/baton-broadcom-sac/pkg/sac"
+	sac "github.com/conductorone/baton-broadcom-sac/pkg/sac"
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/annotations"
 	"github.com/conductorone/baton-sdk/pkg/pagination"
diff --git a/pkg/connector/connector.go b/pkg/connector/connector.go
index 5d63aed..c58bad2 100644
--- a/pkg/connector/connector.go
+++ b/pkg/connector/connector.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"io"
 
-	sac "github.com/ConductorOne/baton-broadcom-sac/pkg/sac"
+	sac "github.com/conductorone/baton-broadcom-sac/pkg/sac"
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/annotations"
 	"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
diff --git a/pkg/connector/groups.go b/pkg/connector/groups.go
index 9507184..ebe8a76 100644
--- a/pkg/connector/groups.go
+++ b/pkg/connector/groups.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/ConductorOne/baton-broadcom-sac/pkg/sac"
+	"github.com/conductorone/baton-broadcom-sac/pkg/sac"
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/annotations"
 	"github.com/conductorone/baton-sdk/pkg/pagination"
diff --git a/pkg/connector/users.go b/pkg/connector/users.go
index ddf03da..f03518f 100644
--- a/pkg/connector/users.go
+++ b/pkg/connector/users.go
@@ -3,7 +3,7 @@ package connector
 import (
 	"context"
 
-	sac "github.com/ConductorOne/baton-broadcom-sac/pkg/sac"
+	sac "github.com/conductorone/baton-broadcom-sac/pkg/sac"
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/annotations"
 	"github.com/conductorone/baton-sdk/pkg/pagination"
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/annotation_sync_details.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/annotation_sync_details.pb.go
index c2ff0f3..aa8cf7b 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/annotation_sync_details.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/annotation_sync_details.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/c1z/v1/annotation_sync_details.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/diff.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/diff.pb.go
index 7410b0f..be4d971 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/diff.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/c1z/v1/diff.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/c1z/v1/diff.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.go
index 7fd1e06..909ee0a 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_etag.proto
 
@@ -26,7 +26,8 @@ type ETag struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Value string `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+	Value         string `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+	EntitlementId string `protobuf:"bytes,2,opt,name=entitlement_id,json=entitlementId,proto3" json:"entitlement_id,omitempty"`
 }
 
 func (x *ETag) Reset() {
@@ -68,6 +69,13 @@ func (x *ETag) GetValue() string {
 	return ""
 }
 
+func (x *ETag) GetEntitlementId() string {
+	if x != nil {
+		return x.EntitlementId
+	}
+	return ""
+}
+
 type ETagMetadata struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -119,6 +127,8 @@ type ETagMatch struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	EntitlementId string `protobuf:"bytes,1,opt,name=entitlement_id,json=entitlementId,proto3" json:"entitlement_id,omitempty"`
 }
 
 func (x *ETagMatch) Reset() {
@@ -153,6 +163,13 @@ func (*ETagMatch) Descriptor() ([]byte, []int) {
 	return file_c1_connector_v2_annotation_etag_proto_rawDescGZIP(), []int{2}
 }
 
+func (x *ETagMatch) GetEntitlementId() string {
+	if x != nil {
+		return x.EntitlementId
+	}
+	return ""
+}
+
 var File_c1_connector_v2_annotation_etag_proto protoreflect.FileDescriptor
 
 var file_c1_connector_v2_annotation_etag_proto_rawDesc = []byte{
@@ -161,18 +178,23 @@ var file_c1_connector_v2_annotation_etag_proto_rawDesc = []byte{
 	0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0f, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e,
 	0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x1c, 0x0a, 0x04, 0x45, 0x54, 0x61, 0x67, 0x12, 0x14,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x43, 0x0a, 0x04, 0x45, 0x54, 0x61, 0x67, 0x12, 0x14,
 	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x22, 0x43, 0x0a, 0x0c, 0x45, 0x54, 0x61, 0x67, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x0b, 0x0a, 0x09, 0x45, 0x54, 0x61,
-	0x67, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x64, 0x75, 0x63, 0x74, 0x6f, 0x72, 0x6f, 0x6e,
-	0x65, 0x2f, 0x62, 0x61, 0x74, 0x6f, 0x6e, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x2f, 0x63,
-	0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76, 0x32, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e,
+	0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x22, 0x43, 0x0a, 0x0c, 0x45,
+	0x54, 0x61, 0x67, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x33, 0x0a, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x22, 0x32, 0x0a, 0x09, 0x45, 0x54, 0x61, 0x67, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x25, 0x0a,
+	0x0e, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x49, 0x64, 0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x64, 0x75, 0x63, 0x74, 0x6f, 0x72, 0x6f, 0x6e, 0x65, 0x2f,
+	0x62, 0x61, 0x74, 0x6f, 0x6e, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x31, 0x2f,
+	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.validate.go
index bf3f182..e11de42 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_etag.pb.validate.go
@@ -58,6 +58,8 @@ func (m *ETag) validate(all bool) error {
 
 	// no validation rules for Value
 
+	// no validation rules for EntitlementId
+
 	if len(errors) > 0 {
 		return ETagMultiError(errors)
 	}
@@ -285,6 +287,8 @@ func (m *ETagMatch) validate(all bool) error {
 
 	var errors []error
 
+	// no validation rules for EntitlementId
+
 	if len(errors) > 0 {
 		return ETagMatchMultiError(errors)
 	}
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_external_link.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_external_link.pb.go
index 32e6692..12f31b3 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_external_link.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_external_link.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_external_link.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.go
new file mode 100644
index 0000000..58e8387
--- /dev/null
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.go
@@ -0,0 +1,153 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: c1/connector/v2/annotation_grant.proto
+
+package v2
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GrantMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Metadata *structpb.Struct `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *GrantMetadata) Reset() {
+	*x = GrantMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_c1_connector_v2_annotation_grant_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GrantMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GrantMetadata) ProtoMessage() {}
+
+func (x *GrantMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_c1_connector_v2_annotation_grant_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GrantMetadata.ProtoReflect.Descriptor instead.
+func (*GrantMetadata) Descriptor() ([]byte, []int) {
+	return file_c1_connector_v2_annotation_grant_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GrantMetadata) GetMetadata() *structpb.Struct {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+var File_c1_connector_v2_annotation_grant_proto protoreflect.FileDescriptor
+
+var file_c1_connector_v2_annotation_grant_proto_rawDesc = []byte{
+	0x0a, 0x26, 0x63, 0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76,
+	0x32, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x61,
+	0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0f, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63,
+	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x44, 0x0a, 0x0d, 0x47, 0x72, 0x61, 0x6e, 0x74,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
+	0x75, 0x63, 0x74, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x42, 0x36, 0x5a,
+	0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x64,
+	0x75, 0x63, 0x74, 0x6f, 0x72, 0x6f, 0x6e, 0x65, 0x2f, 0x62, 0x61, 0x74, 0x6f, 0x6e, 0x2d, 0x73,
+	0x64, 0x6b, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x2f, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_c1_connector_v2_annotation_grant_proto_rawDescOnce sync.Once
+	file_c1_connector_v2_annotation_grant_proto_rawDescData = file_c1_connector_v2_annotation_grant_proto_rawDesc
+)
+
+func file_c1_connector_v2_annotation_grant_proto_rawDescGZIP() []byte {
+	file_c1_connector_v2_annotation_grant_proto_rawDescOnce.Do(func() {
+		file_c1_connector_v2_annotation_grant_proto_rawDescData = protoimpl.X.CompressGZIP(file_c1_connector_v2_annotation_grant_proto_rawDescData)
+	})
+	return file_c1_connector_v2_annotation_grant_proto_rawDescData
+}
+
+var file_c1_connector_v2_annotation_grant_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_c1_connector_v2_annotation_grant_proto_goTypes = []interface{}{
+	(*GrantMetadata)(nil),   // 0: c1.connector.v2.GrantMetadata
+	(*structpb.Struct)(nil), // 1: google.protobuf.Struct
+}
+var file_c1_connector_v2_annotation_grant_proto_depIdxs = []int32{
+	1, // 0: c1.connector.v2.GrantMetadata.metadata:type_name -> google.protobuf.Struct
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_c1_connector_v2_annotation_grant_proto_init() }
+func file_c1_connector_v2_annotation_grant_proto_init() {
+	if File_c1_connector_v2_annotation_grant_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_c1_connector_v2_annotation_grant_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GrantMetadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_c1_connector_v2_annotation_grant_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_c1_connector_v2_annotation_grant_proto_goTypes,
+		DependencyIndexes: file_c1_connector_v2_annotation_grant_proto_depIdxs,
+		MessageInfos:      file_c1_connector_v2_annotation_grant_proto_msgTypes,
+	}.Build()
+	File_c1_connector_v2_annotation_grant_proto = out.File
+	file_c1_connector_v2_annotation_grant_proto_rawDesc = nil
+	file_c1_connector_v2_annotation_grant_proto_goTypes = nil
+	file_c1_connector_v2_annotation_grant_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.validate.go
new file mode 100644
index 0000000..d296634
--- /dev/null
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.validate.go
@@ -0,0 +1,165 @@
+// Code generated by protoc-gen-validate. DO NOT EDIT.
+// source: c1/connector/v2/annotation_grant.proto
+
+package v2
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
+	"net/mail"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+// ensure the imports are used
+var (
+	_ = bytes.MinRead
+	_ = errors.New("")
+	_ = fmt.Print
+	_ = utf8.UTFMax
+	_ = (*regexp.Regexp)(nil)
+	_ = (*strings.Reader)(nil)
+	_ = net.IPv4len
+	_ = time.Duration(0)
+	_ = (*url.URL)(nil)
+	_ = (*mail.Address)(nil)
+	_ = anypb.Any{}
+	_ = sort.Sort
+)
+
+// Validate checks the field values on GrantMetadata with the rules defined in
+// the proto definition for this message. If any rules are violated, the first
+// error encountered is returned, or nil if there are no violations.
+func (m *GrantMetadata) Validate() error {
+	return m.validate(false)
+}
+
+// ValidateAll checks the field values on GrantMetadata with the rules defined
+// in the proto definition for this message. If any rules are violated, the
+// result is a list of violation errors wrapped in GrantMetadataMultiError, or
+// nil if none found.
+func (m *GrantMetadata) ValidateAll() error {
+	return m.validate(true)
+}
+
+func (m *GrantMetadata) validate(all bool) error {
+	if m == nil {
+		return nil
+	}
+
+	var errors []error
+
+	if all {
+		switch v := interface{}(m.GetMetadata()).(type) {
+		case interface{ ValidateAll() error }:
+			if err := v.ValidateAll(); err != nil {
+				errors = append(errors, GrantMetadataValidationError{
+					field:  "Metadata",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		case interface{ Validate() error }:
+			if err := v.Validate(); err != nil {
+				errors = append(errors, GrantMetadataValidationError{
+					field:  "Metadata",
+					reason: "embedded message failed validation",
+					cause:  err,
+				})
+			}
+		}
+	} else if v, ok := interface{}(m.GetMetadata()).(interface{ Validate() error }); ok {
+		if err := v.Validate(); err != nil {
+			return GrantMetadataValidationError{
+				field:  "Metadata",
+				reason: "embedded message failed validation",
+				cause:  err,
+			}
+		}
+	}
+
+	if len(errors) > 0 {
+		return GrantMetadataMultiError(errors)
+	}
+
+	return nil
+}
+
+// GrantMetadataMultiError is an error wrapping multiple validation errors
+// returned by GrantMetadata.ValidateAll() if the designated constraints
+// aren't met.
+type GrantMetadataMultiError []error
+
+// Error returns a concatenation of all the error messages it wraps.
+func (m GrantMetadataMultiError) Error() string {
+	var msgs []string
+	for _, err := range m {
+		msgs = append(msgs, err.Error())
+	}
+	return strings.Join(msgs, "; ")
+}
+
+// AllErrors returns a list of validation violation errors.
+func (m GrantMetadataMultiError) AllErrors() []error { return m }
+
+// GrantMetadataValidationError is the validation error returned by
+// GrantMetadata.Validate if the designated constraints aren't met.
+type GrantMetadataValidationError struct {
+	field  string
+	reason string
+	cause  error
+	key    bool
+}
+
+// Field function returns field value.
+func (e GrantMetadataValidationError) Field() string { return e.field }
+
+// Reason function returns reason value.
+func (e GrantMetadataValidationError) Reason() string { return e.reason }
+
+// Cause function returns cause value.
+func (e GrantMetadataValidationError) Cause() error { return e.cause }
+
+// Key function returns key value.
+func (e GrantMetadataValidationError) Key() bool { return e.key }
+
+// ErrorName returns error name.
+func (e GrantMetadataValidationError) ErrorName() string { return "GrantMetadataValidationError" }
+
+// Error satisfies the builtin error interface
+func (e GrantMetadataValidationError) Error() string {
+	cause := ""
+	if e.cause != nil {
+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
+	}
+
+	key := ""
+	if e.key {
+		key = "key for "
+	}
+
+	return fmt.Sprintf(
+		"invalid %sGrantMetadata.%s: %s%s",
+		key,
+		e.field,
+		e.reason,
+		cause)
+}
+
+var _ error = GrantMetadataValidationError{}
+
+var _ interface {
+	Field() string
+	Reason() string
+	Key() bool
+	Cause() error
+	ErrorName() string
+} = GrantMetadataValidationError{}
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_ratelimit.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_ratelimit.pb.go
index 60d2870..28687ef 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_ratelimit.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_ratelimit.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_ratelimit.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_request.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_request.pb.go
index a496bd9..2d85e65 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_request.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_request.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_request.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_resource_tree.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_resource_tree.pb.go
index 469f5ea..3ae9b08 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_resource_tree.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_resource_tree.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_resource_tree.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_trait.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_trait.pb.go
index 8b875bb..19bfac2 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_trait.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_trait.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_trait.proto
 
@@ -126,6 +126,64 @@ func (UserTrait_Status_Status) EnumDescriptor() ([]byte, []int) {
 	return file_c1_connector_v2_annotation_trait_proto_rawDescGZIP(), []int{0, 1, 0}
 }
 
+type AppTrait_AppFlag int32
+
+const (
+	AppTrait_APP_FLAG_UNSPECIFIED AppTrait_AppFlag = 0
+	AppTrait_APP_FLAG_HIDDEN      AppTrait_AppFlag = 1
+	AppTrait_APP_FLAG_INACTIVE    AppTrait_AppFlag = 2
+	AppTrait_APP_FLAG_SAML        AppTrait_AppFlag = 3
+	AppTrait_APP_FLAG_OIDC        AppTrait_AppFlag = 4
+	AppTrait_APP_FLAG_BOOKMARK    AppTrait_AppFlag = 5
+)
+
+// Enum value maps for AppTrait_AppFlag.
+var (
+	AppTrait_AppFlag_name = map[int32]string{
+		0: "APP_FLAG_UNSPECIFIED",
+		1: "APP_FLAG_HIDDEN",
+		2: "APP_FLAG_INACTIVE",
+		3: "APP_FLAG_SAML",
+		4: "APP_FLAG_OIDC",
+		5: "APP_FLAG_BOOKMARK",
+	}
+	AppTrait_AppFlag_value = map[string]int32{
+		"APP_FLAG_UNSPECIFIED": 0,
+		"APP_FLAG_HIDDEN":      1,
+		"APP_FLAG_INACTIVE":    2,
+		"APP_FLAG_SAML":        3,
+		"APP_FLAG_OIDC":        4,
+		"APP_FLAG_BOOKMARK":    5,
+	}
+)
+
+func (x AppTrait_AppFlag) Enum() *AppTrait_AppFlag {
+	p := new(AppTrait_AppFlag)
+	*p = x
+	return p
+}
+
+func (x AppTrait_AppFlag) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AppTrait_AppFlag) Descriptor() protoreflect.EnumDescriptor {
+	return file_c1_connector_v2_annotation_trait_proto_enumTypes[2].Descriptor()
+}
+
+func (AppTrait_AppFlag) Type() protoreflect.EnumType {
+	return &file_c1_connector_v2_annotation_trait_proto_enumTypes[2]
+}
+
+func (x AppTrait_AppFlag) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AppTrait_AppFlag.Descriptor instead.
+func (AppTrait_AppFlag) EnumDescriptor() ([]byte, []int) {
+	return file_c1_connector_v2_annotation_trait_proto_rawDescGZIP(), []int{3, 0}
+}
+
 type UserTrait struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -312,10 +370,11 @@ type AppTrait struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	HelpUrl string           `protobuf:"bytes,1,opt,name=help_url,json=helpUrl,proto3" json:"help_url,omitempty"`
-	Icon    *AssetRef        `protobuf:"bytes,2,opt,name=icon,proto3" json:"icon,omitempty"`
-	Logo    *AssetRef        `protobuf:"bytes,3,opt,name=logo,proto3" json:"logo,omitempty"`
-	Profile *structpb.Struct `protobuf:"bytes,4,opt,name=profile,proto3" json:"profile,omitempty"`
+	HelpUrl string             `protobuf:"bytes,1,opt,name=help_url,json=helpUrl,proto3" json:"help_url,omitempty"`
+	Icon    *AssetRef          `protobuf:"bytes,2,opt,name=icon,proto3" json:"icon,omitempty"`
+	Logo    *AssetRef          `protobuf:"bytes,3,opt,name=logo,proto3" json:"logo,omitempty"`
+	Profile *structpb.Struct   `protobuf:"bytes,4,opt,name=profile,proto3" json:"profile,omitempty"`
+	Flags   []AppTrait_AppFlag `protobuf:"varint,5,rep,packed,name=flags,proto3,enum=c1.connector.v2.AppTrait_AppFlag" json:"flags,omitempty"`
 }
 
 func (x *AppTrait) Reset() {
@@ -378,6 +437,13 @@ func (x *AppTrait) GetProfile() *structpb.Struct {
 	return nil
 }
 
+func (x *AppTrait) GetFlags() []AppTrait_AppFlag {
+	if x != nil {
+		return x.Flags
+	}
+	return nil
+}
+
 type UserTrait_Email struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -558,7 +624,7 @@ var file_c1_connector_v2_annotation_trait_proto_rawDesc = []byte{
 	0x12, 0x31, 0x0a, 0x07, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x66,
-	0x69, 0x6c, 0x65, 0x22, 0xd2, 0x01, 0x0a, 0x08, 0x41, 0x70, 0x70, 0x54, 0x72, 0x61, 0x69, 0x74,
+	0x69, 0x6c, 0x65, 0x22, 0x9a, 0x03, 0x0a, 0x08, 0x41, 0x70, 0x70, 0x54, 0x72, 0x61, 0x69, 0x74,
 	0x12, 0x35, 0x0a, 0x08, 0x68, 0x65, 0x6c, 0x70, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x09, 0x42, 0x1a, 0xfa, 0x42, 0x17, 0x72, 0x15, 0x20, 0x01, 0x28, 0x80, 0x08, 0x3a, 0x08,
 	0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0xd0, 0x01, 0x01, 0x88, 0x01, 0x01, 0x52, 0x07,
@@ -571,11 +637,23 @@ var file_c1_connector_v2_annotation_trait_proto_rawDesc = []byte{
 	0x04, 0x6c, 0x6f, 0x67, 0x6f, 0x12, 0x31, 0x0a, 0x07, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65,
 	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52,
-	0x07, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x64, 0x75, 0x63, 0x74, 0x6f, 0x72,
-	0x6f, 0x6e, 0x65, 0x2f, 0x62, 0x61, 0x74, 0x6f, 0x6e, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62,
-	0x2f, 0x63, 0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76, 0x32,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x07, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x37, 0x0a, 0x05, 0x66, 0x6c, 0x61, 0x67,
+	0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0e, 0x32, 0x21, 0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x41, 0x70, 0x70, 0x54, 0x72, 0x61,
+	0x69, 0x74, 0x2e, 0x41, 0x70, 0x70, 0x46, 0x6c, 0x61, 0x67, 0x52, 0x05, 0x66, 0x6c, 0x61, 0x67,
+	0x73, 0x22, 0x8c, 0x01, 0x0a, 0x07, 0x41, 0x70, 0x70, 0x46, 0x6c, 0x61, 0x67, 0x12, 0x18, 0x0a,
+	0x14, 0x41, 0x50, 0x50, 0x5f, 0x46, 0x4c, 0x41, 0x47, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x50, 0x50, 0x5f, 0x46,
+	0x4c, 0x41, 0x47, 0x5f, 0x48, 0x49, 0x44, 0x44, 0x45, 0x4e, 0x10, 0x01, 0x12, 0x15, 0x0a, 0x11,
+	0x41, 0x50, 0x50, 0x5f, 0x46, 0x4c, 0x41, 0x47, 0x5f, 0x49, 0x4e, 0x41, 0x43, 0x54, 0x49, 0x56,
+	0x45, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x41, 0x50, 0x50, 0x5f, 0x46, 0x4c, 0x41, 0x47, 0x5f,
+	0x53, 0x41, 0x4d, 0x4c, 0x10, 0x03, 0x12, 0x11, 0x0a, 0x0d, 0x41, 0x50, 0x50, 0x5f, 0x46, 0x4c,
+	0x41, 0x47, 0x5f, 0x4f, 0x49, 0x44, 0x43, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x41, 0x50, 0x50,
+	0x5f, 0x46, 0x4c, 0x41, 0x47, 0x5f, 0x42, 0x4f, 0x4f, 0x4b, 0x4d, 0x41, 0x52, 0x4b, 0x10, 0x05,
+	0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63,
+	0x6f, 0x6e, 0x64, 0x75, 0x63, 0x74, 0x6f, 0x72, 0x6f, 0x6e, 0x65, 0x2f, 0x62, 0x61, 0x74, 0x6f,
+	0x6e, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -590,38 +668,40 @@ func file_c1_connector_v2_annotation_trait_proto_rawDescGZIP() []byte {
 	return file_c1_connector_v2_annotation_trait_proto_rawDescData
 }
 
-var file_c1_connector_v2_annotation_trait_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_c1_connector_v2_annotation_trait_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
 var file_c1_connector_v2_annotation_trait_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_c1_connector_v2_annotation_trait_proto_goTypes = []interface{}{
 	(UserTrait_AccountType)(0),   // 0: c1.connector.v2.UserTrait.AccountType
 	(UserTrait_Status_Status)(0), // 1: c1.connector.v2.UserTrait.Status.Status
-	(*UserTrait)(nil),            // 2: c1.connector.v2.UserTrait
-	(*GroupTrait)(nil),           // 3: c1.connector.v2.GroupTrait
-	(*RoleTrait)(nil),            // 4: c1.connector.v2.RoleTrait
-	(*AppTrait)(nil),             // 5: c1.connector.v2.AppTrait
-	(*UserTrait_Email)(nil),      // 6: c1.connector.v2.UserTrait.Email
-	(*UserTrait_Status)(nil),     // 7: c1.connector.v2.UserTrait.Status
-	(*structpb.Struct)(nil),      // 8: google.protobuf.Struct
-	(*AssetRef)(nil),             // 9: c1.connector.v2.AssetRef
+	(AppTrait_AppFlag)(0),        // 2: c1.connector.v2.AppTrait.AppFlag
+	(*UserTrait)(nil),            // 3: c1.connector.v2.UserTrait
+	(*GroupTrait)(nil),           // 4: c1.connector.v2.GroupTrait
+	(*RoleTrait)(nil),            // 5: c1.connector.v2.RoleTrait
+	(*AppTrait)(nil),             // 6: c1.connector.v2.AppTrait
+	(*UserTrait_Email)(nil),      // 7: c1.connector.v2.UserTrait.Email
+	(*UserTrait_Status)(nil),     // 8: c1.connector.v2.UserTrait.Status
+	(*structpb.Struct)(nil),      // 9: google.protobuf.Struct
+	(*AssetRef)(nil),             // 10: c1.connector.v2.AssetRef
 }
 var file_c1_connector_v2_annotation_trait_proto_depIdxs = []int32{
-	6,  // 0: c1.connector.v2.UserTrait.emails:type_name -> c1.connector.v2.UserTrait.Email
-	7,  // 1: c1.connector.v2.UserTrait.status:type_name -> c1.connector.v2.UserTrait.Status
-	8,  // 2: c1.connector.v2.UserTrait.profile:type_name -> google.protobuf.Struct
-	9,  // 3: c1.connector.v2.UserTrait.icon:type_name -> c1.connector.v2.AssetRef
+	7,  // 0: c1.connector.v2.UserTrait.emails:type_name -> c1.connector.v2.UserTrait.Email
+	8,  // 1: c1.connector.v2.UserTrait.status:type_name -> c1.connector.v2.UserTrait.Status
+	9,  // 2: c1.connector.v2.UserTrait.profile:type_name -> google.protobuf.Struct
+	10, // 3: c1.connector.v2.UserTrait.icon:type_name -> c1.connector.v2.AssetRef
 	0,  // 4: c1.connector.v2.UserTrait.account_type:type_name -> c1.connector.v2.UserTrait.AccountType
-	9,  // 5: c1.connector.v2.GroupTrait.icon:type_name -> c1.connector.v2.AssetRef
-	8,  // 6: c1.connector.v2.GroupTrait.profile:type_name -> google.protobuf.Struct
-	8,  // 7: c1.connector.v2.RoleTrait.profile:type_name -> google.protobuf.Struct
-	9,  // 8: c1.connector.v2.AppTrait.icon:type_name -> c1.connector.v2.AssetRef
-	9,  // 9: c1.connector.v2.AppTrait.logo:type_name -> c1.connector.v2.AssetRef
-	8,  // 10: c1.connector.v2.AppTrait.profile:type_name -> google.protobuf.Struct
-	1,  // 11: c1.connector.v2.UserTrait.Status.status:type_name -> c1.connector.v2.UserTrait.Status.Status
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	10, // 5: c1.connector.v2.GroupTrait.icon:type_name -> c1.connector.v2.AssetRef
+	9,  // 6: c1.connector.v2.GroupTrait.profile:type_name -> google.protobuf.Struct
+	9,  // 7: c1.connector.v2.RoleTrait.profile:type_name -> google.protobuf.Struct
+	10, // 8: c1.connector.v2.AppTrait.icon:type_name -> c1.connector.v2.AssetRef
+	10, // 9: c1.connector.v2.AppTrait.logo:type_name -> c1.connector.v2.AssetRef
+	9,  // 10: c1.connector.v2.AppTrait.profile:type_name -> google.protobuf.Struct
+	2,  // 11: c1.connector.v2.AppTrait.flags:type_name -> c1.connector.v2.AppTrait.AppFlag
+	1,  // 12: c1.connector.v2.UserTrait.Status.status:type_name -> c1.connector.v2.UserTrait.Status.Status
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_c1_connector_v2_annotation_trait_proto_init() }
@@ -709,7 +789,7 @@ func file_c1_connector_v2_annotation_trait_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_c1_connector_v2_annotation_trait_proto_rawDesc,
-			NumEnums:      2,
+			NumEnums:      3,
 			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_v1_identifier.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_v1_identifier.pb.go
index bcadd60..de9b128 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_v1_identifier.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_v1_identifier.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/annotation_v1_identifier.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.go
index 3872e6e..4fab9b2 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/asset.proto
 
@@ -121,6 +121,7 @@ type AssetServiceGetAssetResponse struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Msg:
+	//
 	//	*AssetServiceGetAssetResponse_Metadata_
 	//	*AssetServiceGetAssetResponse_Data_
 	Msg isAssetServiceGetAssetResponse_Msg `protobuf_oneof:"msg"`
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.validate.go
index b615bd9..bc36a62 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/asset.pb.validate.go
@@ -310,9 +310,20 @@ func (m *AssetServiceGetAssetResponse) validate(all bool) error {
 
 	var errors []error
 
-	switch m.Msg.(type) {
-
+	oneofMsgPresent := false
+	switch v := m.Msg.(type) {
 	case *AssetServiceGetAssetResponse_Metadata_:
+		if v == nil {
+			err := AssetServiceGetAssetResponseValidationError{
+				field:  "Msg",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofMsgPresent = true
 
 		if all {
 			switch v := interface{}(m.GetMetadata()).(type) {
@@ -344,6 +355,17 @@ func (m *AssetServiceGetAssetResponse) validate(all bool) error {
 		}
 
 	case *AssetServiceGetAssetResponse_Data_:
+		if v == nil {
+			err := AssetServiceGetAssetResponseValidationError{
+				field:  "Msg",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofMsgPresent = true
 
 		if all {
 			switch v := interface{}(m.GetData()).(type) {
@@ -375,6 +397,9 @@ func (m *AssetServiceGetAssetResponse) validate(all bool) error {
 		}
 
 	default:
+		_ = v // ensures v is used
+	}
+	if !oneofMsgPresent {
 		err := AssetServiceGetAssetResponseValidationError{
 			field:  "Msg",
 			reason: "value is required",
@@ -383,7 +408,6 @@ func (m *AssetServiceGetAssetResponse) validate(all bool) error {
 			return err
 		}
 		errors = append(errors, err)
-
 	}
 
 	if len(errors) > 0 {
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.go
index 366de3d..bb19988 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/config.proto
 
@@ -206,6 +206,7 @@ type Field struct {
 	DisplayName string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
 	Placeholder string `protobuf:"bytes,4,opt,name=placeholder,proto3" json:"placeholder,omitempty"`
 	// Types that are assignable to Field:
+	//
 	//	*Field_Str
 	//	*Field_Select
 	//	*Field_Random
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.validate.go
index 5c42668..f38d6c2 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/config.pb.validate.go
@@ -496,9 +496,18 @@ func (m *Field) validate(all bool) error {
 
 	// no validation rules for Placeholder
 
-	switch m.Field.(type) {
-
+	switch v := m.Field.(type) {
 	case *Field_Str:
+		if v == nil {
+			err := FieldValidationError{
+				field:  "Field",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetStr()).(type) {
@@ -530,6 +539,16 @@ func (m *Field) validate(all bool) error {
 		}
 
 	case *Field_Select:
+		if v == nil {
+			err := FieldValidationError{
+				field:  "Field",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetSelect()).(type) {
@@ -561,6 +580,16 @@ func (m *Field) validate(all bool) error {
 		}
 
 	case *Field_Random:
+		if v == nil {
+			err := FieldValidationError{
+				field:  "Field",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetRandom()).(type) {
@@ -592,6 +621,16 @@ func (m *Field) validate(all bool) error {
 		}
 
 	case *Field_File:
+		if v == nil {
+			err := FieldValidationError{
+				field:  "Field",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetFile()).(type) {
@@ -622,6 +661,8 @@ func (m *Field) validate(all bool) error {
 			}
 		}
 
+	default:
+		_ = v // ensures v is used
 	}
 
 	if len(errors) > 0 {
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.go
index 1ca7d25..178afd1 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/connector.proto
 
@@ -303,7 +303,7 @@ var file_c1_connector_v2_connector_proto_rawDesc = []byte{
 	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75,
 	0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61,
 	0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x22, 0xf0, 0x02, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x4d,
+	0x6f, 0x22, 0xf3, 0x02, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x4d,
 	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x2d, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c,
 	0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xfa,
 	0x42, 0x07, 0x72, 0x05, 0x20, 0x01, 0x28, 0x80, 0x08, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c,
@@ -323,46 +323,47 @@ var file_c1_connector_v2_connector_proto_rawDesc = []byte{
 	0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x06, 0x20,
 	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2c, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xfa, 0x42, 0x07,
-	0x72, 0x05, 0x20, 0x01, 0x28, 0x80, 0x20, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x24, 0x0a, 0x22, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
-	0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x65, 0x0a, 0x23, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47, 0x65,
-	0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x3e, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
-	0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0x21, 0x0a, 0x1f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x22, 0x5a, 0x0a, 0x20, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2f, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42, 0x0a,
+	0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x24, 0x0a, 0x22, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47, 0x65, 0x74, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x65, 0x0a,
+	0x23, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3e, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0x21, 0x0a, 0x1f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
 	0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x36, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f,
-	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x41, 0x6e, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x32, 0xfd, 0x01, 0x0a, 0x10, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x78, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x33, 0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-	0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x34, 0x2e, 0x63, 0x31, 0x2e, 0x63,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47, 0x65, 0x74, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x6f, 0x0a, 0x08, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x12, 0x30, 0x2e, 0x63, 0x31,
-	0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x56, 0x61,
-	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e,
-	0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63,
-	0x6f, 0x6e, 0x64, 0x75, 0x63, 0x74, 0x6f, 0x72, 0x6f, 0x6e, 0x65, 0x2f, 0x62, 0x61, 0x74, 0x6f,
-	0x6e, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x31, 0x2f, 0x63, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x5a, 0x0a, 0x20, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x36, 0x0a, 0x0b, 0x61,
+	0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x32, 0xfd, 0x01, 0x0a, 0x10, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x78, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x33, 0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x34, 0x2e, 0x63,
+	0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x43,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x47,
+	0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x6f, 0x0a, 0x08, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x12, 0x30,
+	0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32,
+	0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x31, 0x2e, 0x63, 0x31, 0x2e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e,
+	0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x64, 0x75, 0x63, 0x74, 0x6f, 0x72, 0x6f, 0x6e, 0x65, 0x2f, 0x62,
+	0x61, 0x74, 0x6f, 0x6e, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x31, 0x2f, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x76, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.validate.go
index 9e0ad52..8be348f 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/connector.pb.validate.go
@@ -236,15 +236,19 @@ func (m *ConnectorMetadata) validate(all bool) error {
 
 	}
 
-	if l := len(m.GetDescription()); l < 1 || l > 4096 {
-		err := ConnectorMetadataValidationError{
-			field:  "Description",
-			reason: "value length must be between 1 and 4096 bytes, inclusive",
-		}
-		if !all {
-			return err
+	if m.GetDescription() != "" {
+
+		if l := len(m.GetDescription()); l < 1 || l > 4096 {
+			err := ConnectorMetadataValidationError{
+				field:  "Description",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
 		}
-		errors = append(errors, err)
+
 	}
 
 	if len(errors) > 0 {
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.go
index 360f903..9c067a4 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/entitlement.proto
 
@@ -363,7 +363,7 @@ var file_c1_connector_v2_entitlement_proto_rawDesc = []byte{
 	0x69, 0x7a, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x42, 0x0a, 0xfa, 0x42, 0x07, 0x2a, 0x05,
 	0x18, 0xfa, 0x01, 0x40, 0x01, 0x52, 0x08, 0x70, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12,
 	0x2c, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0,
+	0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0,
 	0x01, 0x01, 0x52, 0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a,
 	0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03,
 	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
@@ -376,7 +376,7 @@ var file_c1_connector_v2_entitlement_proto_rawDesc = []byte{
 	0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e,
 	0x74, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x12, 0x35, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f,
 	0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52,
+	0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52,
 	0x0d, 0x6e, 0x65, 0x78, 0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36,
 	0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20,
 	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.validate.go
index b9ec9c4..95da9a2 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/entitlement.pb.validate.go
@@ -366,10 +366,10 @@ func (m *EntitlementsServiceListEntitlementsRequest) validate(all bool) error {
 
 	if m.GetPageToken() != "" {
 
-		if l := len(m.GetPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetPageToken()); l < 1 || l > 4096 {
 			err := EntitlementsServiceListEntitlementsRequestValidationError{
 				field:  "PageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
@@ -555,10 +555,10 @@ func (m *EntitlementsServiceListEntitlementsResponse) validate(all bool) error {
 
 	if m.GetNextPageToken() != "" {
 
-		if l := len(m.GetNextPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetNextPageToken()); l < 1 || l > 4096 {
 			err := EntitlementsServiceListEntitlementsResponseValidationError{
 				field:  "NextPageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.go
index 7f20bde..09e5e6e 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/grant.proto
 
@@ -477,7 +477,7 @@ var file_c1_connector_v2_grant_proto_rawDesc = []byte{
 	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x42, 0x0a, 0xfa, 0x42, 0x07, 0x2a, 0x05, 0x18, 0xfa,
 	0x01, 0x40, 0x01, 0x52, 0x08, 0x70, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x2c, 0x0a,
 	0x0a, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01,
+	0x09, 0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01,
 	0x52, 0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a, 0x0b, 0x61,
 	0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
@@ -489,7 +489,7 @@ var file_c1_connector_v2_grant_proto_rawDesc = []byte{
 	0x63, 0x74, 0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x72, 0x61, 0x6e, 0x74, 0x52, 0x04, 0x6c,
 	0x69, 0x73, 0x74, 0x12, 0x35, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x70, 0x61, 0x67, 0x65,
 	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42,
-	0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52, 0x0d, 0x6e, 0x65, 0x78,
+	0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x0d, 0x6e, 0x65, 0x78,
 	0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a, 0x0b, 0x61, 0x6e,
 	0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
 	0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.validate.go
index b1de12a..3b3fd63 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/grant.pb.validate.go
@@ -337,10 +337,10 @@ func (m *GrantsServiceListGrantsRequest) validate(all bool) error {
 
 	if m.GetPageToken() != "" {
 
-		if l := len(m.GetPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetPageToken()); l < 1 || l > 4096 {
 			err := GrantsServiceListGrantsRequestValidationError{
 				field:  "PageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
@@ -523,10 +523,10 @@ func (m *GrantsServiceListGrantsResponse) validate(all bool) error {
 
 	if m.GetNextPageToken() != "" {
 
-		if l := len(m.GetNextPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetNextPageToken()); l < 1 || l > 4096 {
 			err := GrantsServiceListGrantsResponseValidationError{
 				field:  "NextPageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.go
index c016673..a75ba81 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector/v2/resource.proto
 
@@ -607,7 +607,7 @@ var file_c1_connector_v2_resource_proto_rawDesc = []byte{
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x0b, 0x61,
 	0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2f, 0x0a, 0x0b, 0x64, 0x65,
 	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42,
-	0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52, 0x0b,
+	0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x0b,
 	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x5e, 0x0a, 0x05, 0x54,
 	0x72, 0x61, 0x69, 0x74, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x52, 0x41, 0x49, 0x54, 0x5f, 0x55, 0x4e,
 	0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x54,
@@ -625,7 +625,7 @@ var file_c1_connector_v2_resource_proto_rawDesc = []byte{
 	0x28, 0x0d, 0x42, 0x0a, 0xfa, 0x42, 0x07, 0x2a, 0x05, 0x18, 0xfa, 0x01, 0x40, 0x01, 0x52, 0x08,
 	0x70, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x2c, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x65,
 	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42,
-	0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52, 0x09, 0x70, 0x61, 0x67,
+	0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x09, 0x70, 0x61, 0x67,
 	0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61,
 	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e,
@@ -638,7 +638,7 @@ var file_c1_connector_v2_resource_proto_rawDesc = []byte{
 	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x6c,
 	0x69, 0x73, 0x74, 0x12, 0x35, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x70, 0x61, 0x67, 0x65,
 	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42,
-	0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52, 0x0d, 0x6e, 0x65, 0x78,
+	0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x0d, 0x6e, 0x65, 0x78,
 	0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a, 0x0b, 0x61, 0x6e,
 	0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
 	0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
@@ -688,7 +688,7 @@ var file_c1_connector_v2_resource_proto_rawDesc = []byte{
 	0x0a, 0xfa, 0x42, 0x07, 0x2a, 0x05, 0x18, 0xfa, 0x01, 0x40, 0x01, 0x52, 0x08, 0x70, 0x61, 0x67,
 	0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x2c, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f,
 	0x6b, 0x65, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa, 0x42, 0x0a, 0x72, 0x08,
-	0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52, 0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f,
+	0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f,
 	0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
 	0x6e, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x0b,
@@ -700,7 +700,7 @@ var file_c1_connector_v2_resource_proto_rawDesc = []byte{
 	0x6f, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x04,
 	0x6c, 0x69, 0x73, 0x74, 0x12, 0x35, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f, 0x70, 0x61, 0x67,
 	0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0d, 0xfa,
-	0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x10, 0xd0, 0x01, 0x01, 0x52, 0x0d, 0x6e, 0x65,
+	0x42, 0x0a, 0x72, 0x08, 0x20, 0x01, 0x28, 0x80, 0x20, 0xd0, 0x01, 0x01, 0x52, 0x0d, 0x6e, 0x65,
 	0x78, 0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x36, 0x0a, 0x0b, 0x61,
 	0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.validate.go
index d69c37a..a8df1fb 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/resource.pb.validate.go
@@ -150,10 +150,10 @@ func (m *ResourceType) validate(all bool) error {
 
 	if m.GetDescription() != "" {
 
-		if l := len(m.GetDescription()); l < 1 || l > 2048 {
+		if l := len(m.GetDescription()); l < 1 || l > 4096 {
 			err := ResourceTypeValidationError{
 				field:  "Description",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
@@ -310,10 +310,10 @@ func (m *ResourceTypesServiceListResourceTypesRequest) validate(all bool) error
 
 	if m.GetPageToken() != "" {
 
-		if l := len(m.GetPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetPageToken()); l < 1 || l > 4096 {
 			err := ResourceTypesServiceListResourceTypesRequestValidationError{
 				field:  "PageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
@@ -500,10 +500,10 @@ func (m *ResourceTypesServiceListResourceTypesResponse) validate(all bool) error
 
 	if m.GetNextPageToken() != "" {
 
-		if l := len(m.GetNextPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetNextPageToken()); l < 1 || l > 4096 {
 			err := ResourceTypesServiceListResourceTypesResponseValidationError{
 				field:  "NextPageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
@@ -1058,10 +1058,10 @@ func (m *ResourcesServiceListResourcesRequest) validate(all bool) error {
 
 	if m.GetPageToken() != "" {
 
-		if l := len(m.GetPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetPageToken()); l < 1 || l > 4096 {
 			err := ResourcesServiceListResourcesRequestValidationError{
 				field:  "PageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
@@ -1246,10 +1246,10 @@ func (m *ResourcesServiceListResourcesResponse) validate(all bool) error {
 
 	if m.GetNextPageToken() != "" {
 
-		if l := len(m.GetNextPageToken()); l < 1 || l > 2048 {
+		if l := len(m.GetNextPageToken()); l < 1 || l > 4096 {
 			err := ResourcesServiceListResourcesResponseValidationError{
 				field:  "NextPageToken",
-				reason: "value length must be between 1 and 2048 bytes, inclusive",
+				reason: "value length must be between 1 and 4096 bytes, inclusive",
 			}
 			if !all {
 				return err
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector_wrapper/v1/connector_wrapper.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector_wrapper/v1/connector_wrapper.pb.go
index b0e4107..6a8cbc3 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connector_wrapper/v1/connector_wrapper.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connector_wrapper/v1/connector_wrapper.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connector_wrapper/v1/connector_wrapper.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.go
index c21e55b..a3bee55 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/connectorapi/baton/v1/baton.proto
 
@@ -88,6 +88,7 @@ type Task struct {
 	Id     string      `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	Status Task_Status `protobuf:"varint,2,opt,name=status,proto3,enum=c1.connectorapi.baton.v1.Task_Status" json:"status,omitempty"`
 	// Types that are assignable to TaskType:
+	//
 	//	*Task_None
 	//	*Task_Hello
 	//	*Task_SyncFull
@@ -602,6 +603,7 @@ type BatonServiceUploadAssetRequest struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Msg:
+	//
 	//	*BatonServiceUploadAssetRequest_Metadata
 	//	*BatonServiceUploadAssetRequest_Data
 	//	*BatonServiceUploadAssetRequest_Eof
@@ -747,6 +749,7 @@ type BatonServiceFinishTaskRequest struct {
 	TaskId string         `protobuf:"bytes,2,opt,name=task_id,json=taskId,proto3" json:"task_id,omitempty"`
 	Status *status.Status `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
 	// Types that are assignable to FinalState:
+	//
 	//	*BatonServiceFinishTaskRequest_Error_
 	//	*BatonServiceFinishTaskRequest_Success_
 	FinalState isBatonServiceFinishTaskRequest_FinalState `protobuf_oneof:"final_state"`
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.validate.go
index 9fbadae..8d56d08 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1/baton.pb.validate.go
@@ -60,9 +60,18 @@ func (m *Task) validate(all bool) error {
 
 	// no validation rules for Status
 
-	switch m.TaskType.(type) {
-
+	switch v := m.TaskType.(type) {
 	case *Task_None:
+		if v == nil {
+			err := TaskValidationError{
+				field:  "TaskType",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetNone()).(type) {
@@ -94,6 +103,16 @@ func (m *Task) validate(all bool) error {
 		}
 
 	case *Task_Hello:
+		if v == nil {
+			err := TaskValidationError{
+				field:  "TaskType",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetHello()).(type) {
@@ -125,6 +144,16 @@ func (m *Task) validate(all bool) error {
 		}
 
 	case *Task_SyncFull:
+		if v == nil {
+			err := TaskValidationError{
+				field:  "TaskType",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetSyncFull()).(type) {
@@ -156,6 +185,16 @@ func (m *Task) validate(all bool) error {
 		}
 
 	case *Task_Grant:
+		if v == nil {
+			err := TaskValidationError{
+				field:  "TaskType",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetGrant()).(type) {
@@ -187,6 +226,16 @@ func (m *Task) validate(all bool) error {
 		}
 
 	case *Task_Revoke:
+		if v == nil {
+			err := TaskValidationError{
+				field:  "TaskType",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetRevoke()).(type) {
@@ -217,6 +266,8 @@ func (m *Task) validate(all bool) error {
 			}
 		}
 
+	default:
+		_ = v // ensures v is used
 	}
 
 	if len(errors) > 0 {
@@ -1422,9 +1473,20 @@ func (m *BatonServiceUploadAssetRequest) validate(all bool) error {
 
 	var errors []error
 
-	switch m.Msg.(type) {
-
+	oneofMsgPresent := false
+	switch v := m.Msg.(type) {
 	case *BatonServiceUploadAssetRequest_Metadata:
+		if v == nil {
+			err := BatonServiceUploadAssetRequestValidationError{
+				field:  "Msg",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofMsgPresent = true
 
 		if all {
 			switch v := interface{}(m.GetMetadata()).(type) {
@@ -1456,6 +1518,17 @@ func (m *BatonServiceUploadAssetRequest) validate(all bool) error {
 		}
 
 	case *BatonServiceUploadAssetRequest_Data:
+		if v == nil {
+			err := BatonServiceUploadAssetRequestValidationError{
+				field:  "Msg",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofMsgPresent = true
 
 		if all {
 			switch v := interface{}(m.GetData()).(type) {
@@ -1487,6 +1560,17 @@ func (m *BatonServiceUploadAssetRequest) validate(all bool) error {
 		}
 
 	case *BatonServiceUploadAssetRequest_Eof:
+		if v == nil {
+			err := BatonServiceUploadAssetRequestValidationError{
+				field:  "Msg",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofMsgPresent = true
 
 		if all {
 			switch v := interface{}(m.GetEof()).(type) {
@@ -1518,6 +1602,9 @@ func (m *BatonServiceUploadAssetRequest) validate(all bool) error {
 		}
 
 	default:
+		_ = v // ensures v is used
+	}
+	if !oneofMsgPresent {
 		err := BatonServiceUploadAssetRequestValidationError{
 			field:  "Msg",
 			reason: "value is required",
@@ -1526,7 +1613,6 @@ func (m *BatonServiceUploadAssetRequest) validate(all bool) error {
 			return err
 		}
 		errors = append(errors, err)
-
 	}
 
 	if len(errors) > 0 {
@@ -1820,9 +1906,20 @@ func (m *BatonServiceFinishTaskRequest) validate(all bool) error {
 		}
 	}
 
-	switch m.FinalState.(type) {
-
+	oneofFinalStatePresent := false
+	switch v := m.FinalState.(type) {
 	case *BatonServiceFinishTaskRequest_Error_:
+		if v == nil {
+			err := BatonServiceFinishTaskRequestValidationError{
+				field:  "FinalState",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofFinalStatePresent = true
 
 		if all {
 			switch v := interface{}(m.GetError()).(type) {
@@ -1854,6 +1951,17 @@ func (m *BatonServiceFinishTaskRequest) validate(all bool) error {
 		}
 
 	case *BatonServiceFinishTaskRequest_Success_:
+		if v == nil {
+			err := BatonServiceFinishTaskRequestValidationError{
+				field:  "FinalState",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
+		oneofFinalStatePresent = true
 
 		if all {
 			switch v := interface{}(m.GetSuccess()).(type) {
@@ -1885,6 +1993,9 @@ func (m *BatonServiceFinishTaskRequest) validate(all bool) error {
 		}
 
 	default:
+		_ = v // ensures v is used
+	}
+	if !oneofFinalStatePresent {
 		err := BatonServiceFinishTaskRequestValidationError{
 			field:  "FinalState",
 			reason: "value is required",
@@ -1893,7 +2004,6 @@ func (m *BatonServiceFinishTaskRequest) validate(all bool) error {
 			return err
 		}
 		errors = append(errors, err)
-
 	}
 
 	if len(errors) > 0 {
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.go
index aca7fb2..63cf4cc 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/ratelimit/v1/ratelimit.proto
 
@@ -634,6 +634,7 @@ type RateLimiterConfig struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Type:
+	//
 	//	*RateLimiterConfig_Disabled
 	//	*RateLimiterConfig_SlidingMem
 	//	*RateLimiterConfig_FixedMem
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.validate.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.validate.go
index cb2407f..330bb6f 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.validate.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1/ratelimit.pb.validate.go
@@ -1308,9 +1308,18 @@ func (m *RateLimiterConfig) validate(all bool) error {
 
 	var errors []error
 
-	switch m.Type.(type) {
-
+	switch v := m.Type.(type) {
 	case *RateLimiterConfig_Disabled:
+		if v == nil {
+			err := RateLimiterConfigValidationError{
+				field:  "Type",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetDisabled()).(type) {
@@ -1342,6 +1351,16 @@ func (m *RateLimiterConfig) validate(all bool) error {
 		}
 
 	case *RateLimiterConfig_SlidingMem:
+		if v == nil {
+			err := RateLimiterConfigValidationError{
+				field:  "Type",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetSlidingMem()).(type) {
@@ -1373,6 +1392,16 @@ func (m *RateLimiterConfig) validate(all bool) error {
 		}
 
 	case *RateLimiterConfig_FixedMem:
+		if v == nil {
+			err := RateLimiterConfigValidationError{
+				field:  "Type",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetFixedMem()).(type) {
@@ -1404,6 +1433,16 @@ func (m *RateLimiterConfig) validate(all bool) error {
 		}
 
 	case *RateLimiterConfig_External:
+		if v == nil {
+			err := RateLimiterConfigValidationError{
+				field:  "Type",
+				reason: "oneof value cannot be a typed-nil",
+			}
+			if !all {
+				return err
+			}
+			errors = append(errors, err)
+		}
 
 		if all {
 			switch v := interface{}(m.GetExternal()).(type) {
@@ -1434,6 +1473,8 @@ func (m *RateLimiterConfig) validate(all bool) error {
 			}
 		}
 
+	default:
+		_ = v // ensures v is used
 	}
 
 	if len(errors) > 0 {
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/entitlement.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/entitlement.pb.go
index cf828d1..e4affa4 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/entitlement.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/entitlement.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/reader/v2/entitlement.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/grant.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/grant.pb.go
index 5e86527..bcca484 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/grant.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/grant.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/reader/v2/grant.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/resource.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/resource.pb.go
index c9bf1dc..21624d9 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/resource.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/reader/v2/resource.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/reader/v2/resource.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pb/c1/utls/v1/tls.pb.go b/vendor/github.com/conductorone/baton-sdk/pb/c1/utls/v1/tls.pb.go
index ce7d459..be8a6c3 100644
--- a/vendor/github.com/conductorone/baton-sdk/pb/c1/utls/v1/tls.pb.go
+++ b/vendor/github.com/conductorone/baton-sdk/pb/c1/utls/v1/tls.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0-devel
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: c1/utls/v1/tls.proto
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/cli/cli.go b/vendor/github.com/conductorone/baton-sdk/pkg/cli/cli.go
index 8b62117..4bf0152 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/cli/cli.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/cli/cli.go
@@ -220,6 +220,22 @@ func NewCmd[T any, PtrT *T](
 	cmd.MarkFlagsRequiredTogether("grant-entitlement", "grant-principal", "grant-principal-type")
 	cmd.PersistentFlags().String("revoke-grant", "", "The grant to revoke ($BATON_REVOKE_GRANT)")
 	cmd.MarkFlagsMutuallyExclusive("grant-entitlement", "revoke-grant")
+	err = cmd.PersistentFlags().MarkHidden("grant-entitlement")
+	if err != nil {
+		return nil, err
+	}
+	err = cmd.PersistentFlags().MarkHidden("grant-principal")
+	if err != nil {
+		return nil, err
+	}
+	err = cmd.PersistentFlags().MarkHidden("grant-principal-type")
+	if err != nil {
+		return nil, err
+	}
+	err = cmd.PersistentFlags().MarkHidden("revoke-grant")
+	if err != nil {
+		return nil, err
+	}
 
 	// Flags for daemon mode
 	cmd.PersistentFlags().BoolP("daemon-mode", "d", false, "Run in daemon mode ($BATON_DAEMON_MODE)")
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/connectorrunner/runner.go b/vendor/github.com/conductorone/baton-sdk/pkg/connectorrunner/runner.go
index ca9bc01..75d1a0a 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/connectorrunner/runner.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/connectorrunner/runner.go
@@ -3,23 +3,32 @@ package connectorrunner
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"os/signal"
 	"time"
 
+	"golang.org/x/sync/semaphore"
+
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"go.uber.org/zap"
+	"google.golang.org/protobuf/types/known/durationpb"
+
 	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
 	ratelimitV1 "github.com/conductorone/baton-sdk/pb/c1/ratelimit/v1"
 	"github.com/conductorone/baton-sdk/pkg/tasks"
 	"github.com/conductorone/baton-sdk/pkg/tasks/c1api"
 	"github.com/conductorone/baton-sdk/pkg/tasks/local"
 	"github.com/conductorone/baton-sdk/pkg/types"
-	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
-	"go.uber.org/zap"
-	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/conductorone/baton-sdk/internal/connector"
 )
 
+const (
+	// taskConcurrency configures how many tasks we run concurrently.
+	taskConcurrency = 3
+)
+
 type connectorRunner struct {
 	cw      types.ClientWrapper
 	oneShot bool
@@ -67,51 +76,111 @@ func (c *connectorRunner) handleContextCancel(ctx context.Context) error {
 		return nil
 	}
 
-	l.Debug("unexpected context cancellation", zap.Error(err))
+	l.Debug("runner: unexpected context cancellation", zap.Error(err))
 	return err
 }
+func (c *connectorRunner) processTask(ctx context.Context, task *v1.Task) error {
+	cc, err := c.cw.C(ctx)
+	if err != nil {
+		return fmt.Errorf("runner: error creating connector client: %w", err)
+	}
+
+	err = c.tasks.Process(ctx, task, cc)
+	if err != nil {
+		return fmt.Errorf("runner: error processing task: %w", err)
+	}
+
+	return nil
+}
+
+func (c *connectorRunner) backoff(ctx context.Context, errCount int) time.Duration {
+	waitDuration := time.Duration(errCount*errCount) * time.Second
+	if waitDuration > time.Minute {
+		waitDuration = time.Minute
+	}
+	return waitDuration
+}
 
 func (c *connectorRunner) run(ctx context.Context) error {
 	l := ctxzap.Extract(ctx)
 
-	var waitDuration time.Duration
-	var nextTask *v1.Task
+	sem := semaphore.NewWeighted(int64(taskConcurrency))
+
+	waitDuration := time.Second * 0
+	errCount := 0
 	var err error
 	for {
 		select {
 		case <-ctx.Done():
 			return c.handleContextCancel(ctx)
 		case <-time.After(waitDuration):
-		}
+			l.Debug("runner: claiming worker")
+			// Acquire a worker slot before we call Next() so we don't claim a task before we can actually process it.
+			err = sem.Acquire(ctx, 1)
+			if err != nil {
+				// Any error returned from Acquire() is due to the context being cancelled.
+				sem.Release(1)
+				return c.handleContextCancel(ctx)
+			}
+			l.Debug("runner: worker claimed, checking for next task")
 
-		nextTask, waitDuration, err = c.tasks.Next(ctx)
-		if err != nil {
-			l.Error("error getting next task", zap.Error(err))
-			continue
-		}
+			// Fetch the next task.
+			nextTask, nextWaitDuration, err := c.tasks.Next(ctx)
+			if err != nil {
+				// TODO(morgabra) Use a library with jitter for this?
+				errCount++
+				waitDuration = c.backoff(ctx, errCount)
+				l.Error("runner: error getting next task", zap.Error(err), zap.Int("err_count", errCount), zap.Duration("wait_duration", waitDuration))
+				sem.Release(1)
+				continue
+			}
 
-		if nextTask == nil {
-			l.Info("No tasks available. Waiting to check again.", zap.Duration("wait_duration", waitDuration))
-			if c.oneShot {
-				l.Debug("One-shot mode enabled. Exiting.")
-				return nil
+			errCount = 0
+			waitDuration = nextWaitDuration
+
+			// nil tasks mean there are no tasks to process.
+			if nextTask == nil {
+				sem.Release(1)
+				l.Debug("runner: no tasks to process", zap.Duration("wait_duration", waitDuration))
+				if c.oneShot {
+					l.Debug("runner: one-shot mode enabled. Exiting.")
+					return nil
+				}
+				continue
 			}
-			continue
-		}
 
-		cc, err := c.cw.C(ctx)
-		if err != nil {
-			l.Error("error getting connector client", zap.Error(err), zap.String("task_id", nextTask.GetId()))
-			continue
-		}
+			l.Debug("runner: got task", zap.String("task_id", nextTask.Id), zap.String("task_type", tasks.GetType(nextTask).String()))
 
-		err = c.tasks.Process(ctx, nextTask, cc)
-		if err != nil {
-			l.Error("error processing task", zap.Error(err), zap.String("task_id", nextTask.GetId()))
-			continue
-		}
+			// If we're in one-shot mode, process the task synchronously.
+			if c.oneShot {
+				l.Debug("runner: one-shot mode enabled. Performing action synchronously.")
+				err := c.processTask(ctx, nextTask)
+				sem.Release(1)
+				if err != nil {
+					l.Error(
+						"runner: error processing on-demand task",
+						zap.Error(err),
+						zap.String("task_id", nextTask.Id),
+						zap.String("task_type", tasks.GetType(nextTask).String()),
+					)
+					return err
+				}
+				continue
+			}
 
-		l.Info("Task complete! Waiting before checking for more tasks...", zap.Duration("wait_duration", waitDuration))
+			// We got a task, so process it concurrently.
+			go func(t *v1.Task) {
+				l.Debug("runner: starting processing task", zap.String("task_id", t.Id), zap.String("task_type", tasks.GetType(t).String()))
+				defer sem.Release(1)
+				err := c.processTask(ctx, t)
+				if err != nil {
+					l.Error("runner: error processing task", zap.Error(err), zap.String("task_id", t.Id), zap.String("task_type", tasks.GetType(t).String()))
+				}
+				l.Debug("runner: task processed", zap.String("task_id", t.Id), zap.String("task_type", tasks.GetType(t).String()))
+			}(nextTask)
+
+			l.Debug("runner: dispatched task, waiting for next task", zap.Duration("wait_duration", waitDuration))
+		}
 	}
 }
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/provisioner/provisioner.go b/vendor/github.com/conductorone/baton-sdk/pkg/provisioner/provisioner.go
index a66a115..a13739c 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/provisioner/provisioner.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/provisioner/provisioner.go
@@ -146,6 +146,7 @@ func (p *Provisioner) revoke(ctx context.Context) error {
 			Id:          grant.Grant.Id,
 			Entitlement: entitlement.Entitlement,
 			Principal:   principal.Resource,
+			Annotations: grant.Grant.Annotations,
 		},
 	})
 	if err != nil {
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/sync/syncer.go b/vendor/github.com/conductorone/baton-sdk/pkg/sync/syncer.go
index 4c1ff1d..8f6ed26 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/sync/syncer.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/sync/syncer.go
@@ -772,6 +772,71 @@ func (s *syncer) fetchResourceForPreviousSync(ctx context.Context, resourceID *v
 	return previousSyncID, nil, nil
 }
 
+func (s *syncer) fetchEtaggedGrantsForResource(
+	ctx context.Context,
+	resource *v2.Resource,
+	prevEtag *v2.ETag,
+	prevSyncID string,
+	grantResponse *v2.GrantsServiceListGrantsResponse,
+) ([]*v2.Grant, bool, error) {
+	respAnnos := annotations.Annotations(grantResponse.GetAnnotations())
+	etagMatch := &v2.ETagMatch{}
+	hasMatch, err := respAnnos.Pick(etagMatch)
+	if err != nil {
+		return nil, false, err
+	}
+
+	if !hasMatch {
+		return nil, false, nil
+	}
+
+	var ret []*v2.Grant
+
+	// No previous etag, so an etag match is not possible
+	if prevEtag == nil {
+		return nil, false, errors.New("connector returned an etag match but there is no previous sync generation to use")
+	}
+
+	// The previous etag is for a different entitlement
+	if prevEtag.EntitlementId != etagMatch.EntitlementId {
+		return nil, false, errors.New("connector returned an etag match but the entitlement id does not match the previous sync")
+	}
+
+	// We have a previous sync, and the connector would like to use the previous sync results
+	var npt string
+	// Fetch the grants for this resource from the previous sync, and store them in the current sync.
+	storeAnnos := annotations.Annotations{}
+	storeAnnos.Update(&c1zpb.SyncDetails{
+		Id: prevSyncID,
+	})
+
+	for {
+		prevGrantsResp, err := s.store.ListGrants(ctx, &v2.GrantsServiceListGrantsRequest{
+			Resource:    resource,
+			Annotations: storeAnnos,
+			PageToken:   npt,
+			PageSize:    1000,
+		})
+		if err != nil {
+			return nil, false, err
+		}
+
+		for _, g := range prevGrantsResp.List {
+			if g.Entitlement.Id != etagMatch.EntitlementId {
+				continue
+			}
+			ret = append(ret, g)
+		}
+
+		if prevGrantsResp.NextPageToken == "" {
+			break
+		}
+		npt = prevGrantsResp.NextPageToken
+	}
+
+	return ret, true, nil
+}
+
 // syncGrantsForResource fetches the grants for a specific resource from the connector.
 func (s *syncer) syncGrantsForResource(ctx context.Context, resourceID *v2.ResourceId) error {
 	resourceResponse, err := s.store.GetResource(ctx, &reader_v2.ResourcesReaderServiceGetResourceRequest{
@@ -785,92 +850,53 @@ func (s *syncer) syncGrantsForResource(ctx context.Context, resourceID *v2.Resou
 
 	var prevSyncID string
 	var prevEtag *v2.ETag
+	var etagMatch bool
+	var grants []*v2.Grant
 
 	resourceAnnos := annotations.Annotations(resource.GetAnnotations())
 	pageToken := s.state.PageToken(ctx)
-	// Empty page token, so we're on the first page of grants for this resource
-	if pageToken == "" {
-		prevSyncID, prevEtag, err = s.fetchResourceForPreviousSync(ctx, resourceID)
-		if err != nil {
-			return err
-		}
-		resourceAnnos.Update(prevEtag)
-		resource.Annotations = resourceAnnos
-	}
 
-	resp, err := s.connector.ListGrants(ctx, &v2.GrantsServiceListGrantsRequest{Resource: resourceResponse.Resource, PageToken: pageToken})
+	prevSyncID, prevEtag, err = s.fetchResourceForPreviousSync(ctx, resourceID)
 	if err != nil {
 		return err
 	}
+	resourceAnnos.Update(prevEtag)
+	resource.Annotations = resourceAnnos
 
-	nextPageToken := resp.NextPageToken
-
-	respAnnos := annotations.Annotations(resp.GetAnnotations())
-	etagMatch := respAnnos.Contains(&v2.ETagMatch{})
-
-	var grantsRet []*v2.Grant
-
-	// We have a previous etag, and the connector has indicated an etag match
-	if etagMatch {
-		if prevEtag == nil {
-			return errors.New("connector returned an etag match - but there is no previous sync generation to use")
-		}
-
-		// We have a previous sync, and the connector would like to use the previous sync results
-		var npt string
-		// Fetch the grants for this resource from the previous sync, and store them in the current sync.
-		storeAnnos := annotations.Annotations{}
-		storeAnnos.Update(&c1zpb.SyncDetails{
-			Id: prevSyncID,
-		})
-
-		for {
-			prevGrantsResp, err := s.store.ListGrants(ctx, &v2.GrantsServiceListGrantsRequest{
-				Resource:    resource,
-				Annotations: storeAnnos,
-				PageToken:   npt,
-				PageSize:    1000,
-			})
-			if err != nil {
-				return err
-			}
-
-			grantsRet = append(grantsRet, prevGrantsResp.List...)
-
-			if prevGrantsResp.NextPageToken == "" {
-				break
-			}
-			npt = prevGrantsResp.NextPageToken
-		}
+	resp, err := s.connector.ListGrants(ctx, &v2.GrantsServiceListGrantsRequest{Resource: resource, PageToken: pageToken})
+	if err != nil {
+		return err
 	}
 
-	// We want to process any grants from the previous sync first so that if there is a conflict
-	grantsRet = append(grantsRet, resp.List...)
-
-	for _, grant := range grantsRet {
-		err = s.store.PutGrant(ctx, grant)
-		if err != nil {
-			return err
-		}
+	// Fetch any etagged grants for this resource
+	var etaggedGrants []*v2.Grant
+	etaggedGrants, etagMatch, err = s.fetchEtaggedGrantsForResource(ctx, resource, prevEtag, prevSyncID, resp)
+	if err != nil {
+		return err
 	}
+	grants = append(grants, etaggedGrants...)
 
-	s.handleProgress(ctx, s.state.Current(), len(grantsRet))
+	// We want to process any grants from the previous sync first so that if there is a conflict, the newer data takes precedence
+	grants = append(grants, resp.List...)
 
-	if nextPageToken != "" {
-		err = s.state.NextPage(ctx, nextPageToken)
+	for _, grant := range grants {
+		err = s.store.PutGrant(ctx, grant)
 		if err != nil {
 			return err
 		}
-		return nil
 	}
 
-	s.state.FinishAction(ctx)
+	s.handleProgress(ctx, s.state.Current(), len(grants))
 
+	// We may want to update the etag on the resource. If we matched a previous etag, then we should use that.
+	// Otherwise, we should use the etag from the response if provided.
 	var updatedETag *v2.ETag
+
 	if etagMatch {
 		updatedETag = prevEtag
 	} else {
 		newETag := &v2.ETag{}
+		respAnnos := annotations.Annotations(resp.GetAnnotations())
 		ok, err := respAnnos.Pick(newETag)
 		if err != nil {
 			return err
@@ -889,6 +915,16 @@ func (s *syncer) syncGrantsForResource(ctx context.Context, resourceID *v2.Resou
 		}
 	}
 
+	if resp.NextPageToken != "" {
+		err = s.state.NextPage(ctx, resp.NextPageToken)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	s.state.FinishAction(ctx)
+
 	return nil
 }
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/full_sync.go b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/full_sync.go
index 7a1d1fd..6f5d582 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/full_sync.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/full_sync.go
@@ -5,18 +5,21 @@ import (
 	"io"
 	"os"
 
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"go.uber.org/zap"
+
 	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
+	"github.com/conductorone/baton-sdk/pkg/annotations"
 	sdkSync "github.com/conductorone/baton-sdk/pkg/sync"
 	"github.com/conductorone/baton-sdk/pkg/tasks"
 	"github.com/conductorone/baton-sdk/pkg/types"
-	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
-	"go.uber.org/zap"
 )
 
 type fullSyncHelpers interface {
 	ConnectorClient() types.ConnectorClient
 	Upload(ctx context.Context, r io.ReadSeeker) error
-	FinishTask(ctx context.Context, err error) error
+	FinishTask(ctx context.Context, annos annotations.Annotations, err error) error
+	HeartbeatTask(ctx context.Context, annos annotations.Annotations) (context.Context, error)
 }
 
 type fullSyncTaskHandler struct {
@@ -24,45 +27,62 @@ type fullSyncTaskHandler struct {
 	helpers fullSyncHelpers
 }
 
+// TODO(morgabra) We should handle task resumption here. The task should contain at least an active sync id so we can
+// resume syncing if we get restarted or fail to heartbeat temporarily.
+// TODO(morgabra) Ideally we can tell the difference between a task cancellation and a task failure via the result
+// of HeartbeatTask(). If we get cancelled, we probably want to clean up our sync state. If we fail to heartbeat, we
+// might want to keep our sync state around so we can resume the task.
+// TODO(morgabra) If we have a task with no sync_id set, we should create one and set it via heartbeat annotations? If we have a
+// task with a sync_id and it doesn't match our current state sync_id, we should reject the task. If we have a task
+// with a sync_id that does match our current state, we should resume our current sync, if possible.
 func (c *fullSyncTaskHandler) HandleTask(ctx context.Context) error {
-	l := ctxzap.Extract(ctx).With(zap.String("task_id", c.task.GetId()), zap.Stringer("task_type", tasks.GetType(c.task)))
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
 
+	l := ctxzap.Extract(ctx).With(zap.String("task_id", c.task.GetId()), zap.Stringer("task_type", tasks.GetType(c.task)))
 	l.Info("Handling full sync task.")
 
 	assetFile, err := os.CreateTemp("", "baton-sdk-sync-upload")
 	if err != nil {
 		l.Error("failed to create temp file", zap.Error(err))
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
 	}
 	c1zPath := assetFile.Name()
 	err = assetFile.Close()
 	if err != nil {
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
 	}
 
 	syncer, err := sdkSync.NewSyncer(ctx, c.helpers.ConnectorClient(), sdkSync.WithC1ZPath(c1zPath))
 	if err != nil {
 		l.Error("failed to create syncer", zap.Error(err))
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
+	}
+
+	// TODO(morgabra) Add annotation for for sync_id, or come up with some other way to track sync state.
+	ctx, err = c.helpers.HeartbeatTask(ctx, nil)
+	if err != nil {
+		l.Error("failed to heartbeat task", zap.Error(err))
+		return err
 	}
 
 	// TODO(jirwin): Should we attempt to retry at all before failing the task?
 	err = syncer.Sync(ctx)
 	if err != nil {
 		l.Error("failed to sync", zap.Error(err))
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
 	}
 
 	err = syncer.Close(ctx)
 	if err != nil {
 		l.Error("failed to close syncer", zap.Error(err))
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
 	}
 
 	c1zF, err := os.Open(c1zPath)
 	if err != nil {
 		l.Error("failed to open sync asset prior to upload", zap.Error(err))
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
 	}
 	defer func(f *os.File) {
 		err = f.Close()
@@ -78,10 +98,10 @@ func (c *fullSyncTaskHandler) HandleTask(ctx context.Context) error {
 	err = c.helpers.Upload(ctx, c1zF)
 	if err != nil {
 		l.Error("failed to upload sync asset", zap.Error(err))
-		return c.helpers.FinishTask(ctx, err)
+		return c.helpers.FinishTask(ctx, nil, err)
 	}
 
-	return c.helpers.FinishTask(ctx, nil)
+	return c.helpers.FinishTask(ctx, nil, nil)
 }
 
 func newFullSyncTaskHandler(task *v1.Task, helpers fullSyncHelpers) tasks.TaskHandler {
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/grant.go b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/grant.go
index 10cd7f6..8486a61 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/grant.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/grant.go
@@ -4,17 +4,19 @@ import (
 	"context"
 	"errors"
 
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"go.uber.org/zap"
+
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
+	"github.com/conductorone/baton-sdk/pkg/annotations"
 	"github.com/conductorone/baton-sdk/pkg/tasks"
 	"github.com/conductorone/baton-sdk/pkg/types"
-	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
-	"go.uber.org/zap"
 )
 
 type grantHelpers interface {
 	ConnectorClient() types.ConnectorClient
-	FinishTask(ctx context.Context, err error) error
+	FinishTask(ctx context.Context, annos annotations.Annotations, err error) error
 }
 
 type grantTaskHandler struct {
@@ -32,22 +34,22 @@ func (g *grantTaskHandler) HandleTask(ctx context.Context) error {
 			zap.Any("entitlement", g.task.GetGrant().GetEntitlement()),
 			zap.Any("principal", g.task.GetGrant().GetPrincipal()),
 		)
-		return g.helpers.FinishTask(ctx, errors.Join(errors.New("malformed grant task"), ErrTaskNonRetryable))
+		return g.helpers.FinishTask(ctx, nil, errors.Join(errors.New("malformed grant task"), ErrTaskNonRetryable))
 	}
 
 	grant := g.task.GetGrant()
 
 	cc := g.helpers.ConnectorClient()
-	_, err := cc.Grant(ctx, &v2.GrantManagerServiceGrantRequest{
+	resp, err := cc.Grant(ctx, &v2.GrantManagerServiceGrantRequest{
 		Entitlement: grant.Entitlement,
 		Principal:   grant.Principal,
 	})
 	if err != nil {
 		l.Error("failed while granting entitlement", zap.Error(err))
-		return g.helpers.FinishTask(ctx, errors.Join(err, ErrTaskNonRetryable))
+		return g.helpers.FinishTask(ctx, nil, errors.Join(err, ErrTaskNonRetryable))
 	}
 
-	return g.helpers.FinishTask(ctx, nil)
+	return g.helpers.FinishTask(ctx, resp.GetAnnotations(), nil)
 }
 
 func newGrantTaskHandler(task *v1.Task, helpers grantHelpers) tasks.TaskHandler {
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/hello.go b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/hello.go
index 79d145e..e372843 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/hello.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/hello.go
@@ -20,9 +20,8 @@ type helloHelpers interface {
 }
 
 type helloTaskHandler struct {
-	task          *v1.Task
-	includeTaskID bool
-	helpers       helloHelpers
+	task    *v1.Task
+	helpers helloHelpers
 }
 
 func (c *helloTaskHandler) osInfo(ctx context.Context) (*v1.BatonServiceHelloRequest_OSInfo, error) {
@@ -82,11 +81,7 @@ func (c *helloTaskHandler) HandleTask(ctx context.Context) error {
 		return err
 	}
 
-	// The API changes behavior based on whether the task ID is included in the request or not
 	taskID := c.task.GetId()
-	if !c.includeTaskID {
-		taskID = ""
-	}
 
 	osInfo, err := c.osInfo(ctx)
 	if err != nil {
@@ -106,10 +101,9 @@ func (c *helloTaskHandler) HandleTask(ctx context.Context) error {
 	return nil
 }
 
-func newHelloTaskHandler(task *v1.Task, includeTaskID bool, helpers helloHelpers) *helloTaskHandler {
+func newHelloTaskHandler(task *v1.Task, helpers helloHelpers) *helloTaskHandler {
 	return &helloTaskHandler{
-		task:          task,
-		helpers:       helpers,
-		includeTaskID: includeTaskID,
+		task:    task,
+		helpers: helpers,
 	}
 }
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/manager.go b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/manager.go
index b1b50f7..4fbbd3b 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/manager.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/manager.go
@@ -6,126 +6,152 @@ import (
 	"sync"
 	"time"
 
-	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
-	"github.com/conductorone/baton-sdk/pkg/tasks"
-	"github.com/conductorone/baton-sdk/pkg/types"
+	"github.com/conductorone/baton-sdk/pkg/annotations"
+
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
-	"github.com/segmentio/ksuid"
 	"go.uber.org/zap"
 	pbstatus "google.golang.org/genproto/googleapis/rpc/status"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
+	"github.com/conductorone/baton-sdk/pkg/tasks"
+	"github.com/conductorone/baton-sdk/pkg/types"
 )
 
 var (
-	errTimeoutDuration      = time.Second * 30
-	ErrTaskHeartbeatFailure = errors.New("task heart beating failed")
-	ErrTaskNonRetryable     = errors.New("task failed and is non-retryable")
-	startupHelloTaskID      = ksuid.New().String()
+	// getHeartbeatInterval configures limits on how often we heartbeat a running task.
+	maxHeartbeatInterval     = time.Minute * 5
+	minHeartbeatInterval     = time.Second * 1
+	defaultHeartbeatInterval = time.Second * 30
+
+	// pollInterval configures limits on how often we poll for new tasks.
+	maxPollInterval = time.Minute * 5
+	minPollInterval = time.Second * 0
+
+	taskMaximumHeartbeatFailures = 10
+
+	ErrTaskCancelled       = errors.New("task was cancelled")
+	ErrTaskHeartbeatFailed = errors.New("task failed heartbeat")
+
+	ErrTaskNonRetryable = errors.New("task failed and is non-retryable")
 )
 
 type c1ApiTaskManager struct {
-	startupHello  sync.Once
+	mtx           sync.Mutex
+	started       bool
+	queue         []*v1.Task
 	serviceClient BatonServiceClient
 }
 
-func (c *c1ApiTaskManager) backoffJitter(d time.Duration) time.Duration {
-	return d
-}
-
-func (c *c1ApiTaskManager) heartbeatTask(ctx context.Context, task *v1.Task) error {
-	// HACK(jirwin): We don't want to heartbeat the startup hello task, so we generate a unique ID for it and skip it here.
-	if task.GetId() == startupHelloTaskID {
-		return nil
+// getHeartbeatInterval returns an appropriate heartbeat interval. If the interval is 0, it will return the default heartbeat interval.
+// Otherwise, it will be clamped between minHeartbeatInterval and maxHeartbeatInterval.
+func getHeartbeatInterval(d time.Duration) time.Duration {
+	switch {
+	case d == 0:
+		return defaultHeartbeatInterval
+	case d < minHeartbeatInterval:
+		return minHeartbeatInterval
+	case d > maxHeartbeatInterval:
+		return maxHeartbeatInterval
+	default:
+		return d
 	}
+}
 
-	l := ctxzap.Extract(ctx).With(zap.String("task_id", task.GetId()), zap.Stringer("task_type", tasks.GetType(task)))
-	var waitDuration time.Duration
-
-	for {
-		l.Debug("waiting to heartbeat", zap.Duration("wait_duration", waitDuration))
-		select {
-		case <-ctx.Done():
-			return nil
-
-		case <-time.After(waitDuration):
-			resp, err := c.serviceClient.Heartbeat(ctx, &v1.BatonServiceHeartbeatRequest{
-				TaskId: task.GetId(),
-			})
-			if err != nil && !errors.Is(err, context.Canceled) {
-				l.Error("error sending heartbeat", zap.Error(err))
-				return err
-			}
-
-			if resp == nil {
-				l.Debug("heartbeat response was nil")
-				return nil
-			}
-
-			l.Debug("heartbeat successful", zap.Duration("next_deadline", resp.GetNextHeartbeat().AsDuration()))
-			if resp.Cancelled {
-				return ErrTaskHeartbeatFailure
-			}
-			waitDuration = resp.GetNextHeartbeat().AsDuration()
-		}
+// getNextPoll returns an appropriate poll interval. It will be clamped between minPollInterval and maxPollInterval.
+func getNextPoll(d time.Duration) time.Duration {
+	switch {
+	case d < minPollInterval:
+		return minPollInterval
+	case d > maxPollInterval:
+		return maxPollInterval
+	default:
+		return d
 	}
 }
 
 func (c *c1ApiTaskManager) Next(ctx context.Context) (*v1.Task, time.Duration, error) {
 	l := ctxzap.Extract(ctx)
 
-	var task *v1.Task
-	c.startupHello.Do(func() {
-		l.Debug("queueing startup hello task")
-		task = &v1.Task{
-			Id: startupHelloTaskID,
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	if !c.started {
+		l.Debug("c1_api_task_manager.Next(): queueing initial hello task")
+		c.started = true
+		// Append a hello task to the queue on startup.
+		c.queue = append(c.queue, &v1.Task{
+			Id:     "",
+			Status: v1.Task_STATUS_PENDING,
 			TaskType: &v1.Task_Hello{
 				Hello: &v1.Task_HelloTask{},
 			},
-		}
-	})
+		})
+
+		// TODO(morgabra) Get resumable tasks here and queue them.
+	}
 
-	if task != nil {
-		return task, c.backoffJitter(time.Second), nil
+	if len(c.queue) != 0 {
+		t := c.queue[0]
+		c.queue = c.queue[1:]
+		l.Debug("c1_api_task_manager.Next(): returning queued task", zap.String("task_id", t.GetId()), zap.Stringer("task_type", tasks.GetType(t)))
+		return t, 0, nil
 	}
 
-	l.Info("Checking for new tasks...")
+	l.Debug("c1_api_task_manager.Next(): checking for new tasks")
 
 	resp, err := c.serviceClient.GetTask(ctx, &v1.BatonServiceGetTaskRequest{})
 	if err != nil {
-		return nil, c.backoffJitter(errTimeoutDuration), err
+		return nil, 0, err
 	}
 
-	if resp.Task == nil || tasks.Is(resp.Task, tasks.NoneType) {
-		return nil, c.backoffJitter(resp.GetNextPoll().AsDuration()), nil
+	nextPoll := getNextPoll(resp.GetNextPoll().AsDuration())
+	l = l.With(zap.Duration("next_poll", nextPoll))
+
+	if resp.GetTask() == nil || tasks.Is(resp.GetTask(), tasks.NoneType) {
+		l.Debug("c1_api_task_manager.Next(): no tasks available")
+		return nil, nextPoll, nil
 	}
 
-	return resp.Task, c.backoffJitter(resp.GetNextPoll().AsDuration()), nil
+	l = l.With(
+		zap.String("task_id", resp.GetTask().GetId()),
+		zap.Stringer("task_type", tasks.GetType(resp.GetTask())),
+	)
+
+	l.Debug("c1_api_task_manager.Next(): got task")
+	return resp.GetTask(), nextPoll, nil
 }
 
-func (c *c1ApiTaskManager) finishTask(ctx context.Context, task *v1.Task, err error) error {
+func (c *c1ApiTaskManager) finishTask(ctx context.Context, task *v1.Task, annos annotations.Annotations, err error) error {
 	l := ctxzap.Extract(ctx)
+	l = l.With(
+		zap.String("task_id", task.GetId()),
+		zap.Stringer("task_type", tasks.GetType(task)),
+	)
 
 	finishCtx, finishCanc := context.WithTimeout(context.Background(), time.Second*30)
 	defer finishCanc()
 
 	if err == nil {
-		l.Debug("finishing task successfully")
+		l.Info("c1_api_task_manager.finishTask(): finishing task successfully")
 		_, err = c.serviceClient.FinishTask(finishCtx, &v1.BatonServiceFinishTaskRequest{
 			TaskId: task.GetId(),
+			Status: nil,
 			FinalState: &v1.BatonServiceFinishTaskRequest_Success_{
-				Success: &v1.BatonServiceFinishTaskRequest_Success{},
+				Success: &v1.BatonServiceFinishTaskRequest_Success{
+					Annotations: annos,
+				},
 			},
 		})
 		if err != nil {
-			l.Error("error while attempting to finish task successfully", zap.Error(err))
+			l.Error("c1_api_task_manager.finishTask(): error while attempting to finish task successfully", zap.Error(err))
 			return err
 		}
 
 		return nil
 	}
 
-	l.Error("finishing task with error", zap.Error(err))
+	l.Error("c1_api_task_manager.finishTask(): finishing task with error", zap.Error(err))
 
 	statusErr, ok := status.FromError(err)
 	if !ok {
@@ -141,11 +167,12 @@ func (c *c1ApiTaskManager) finishTask(ctx context.Context, task *v1.Task, err er
 		FinalState: &v1.BatonServiceFinishTaskRequest_Error_{
 			Error: &v1.BatonServiceFinishTaskRequest_Error{
 				NonRetryable: errors.Is(err, ErrTaskNonRetryable),
+				Annotations:  annos,
 			},
 		},
 	})
 	if rpcErr != nil {
-		l.Error("error finishing task", zap.Error(rpcErr))
+		l.Error("c1_api_task_manager.finishTask(): error finishing task", zap.Error(rpcErr))
 		return errors.Join(err, rpcErr)
 	}
 
@@ -155,7 +182,7 @@ func (c *c1ApiTaskManager) finishTask(ctx context.Context, task *v1.Task, err er
 func (c *c1ApiTaskManager) Process(ctx context.Context, task *v1.Task, cc types.ConnectorClient) error {
 	l := ctxzap.Extract(ctx)
 	if task == nil {
-		l.Debug("process called with nil task -- continuing")
+		l.Debug("c1_api_task_manager.Process(): process called with nil task -- continuing")
 		return nil
 	}
 
@@ -164,19 +191,7 @@ func (c *c1ApiTaskManager) Process(ctx context.Context, task *v1.Task, cc types.
 		zap.Stringer("task_type", tasks.GetType(task)),
 	)
 
-	l.Debug("processing task")
-
-	taskCtx, cancelTask := context.WithCancelCause(ctx)
-	defer cancelTask(nil)
-
-	// Begin heartbeat loop for task
-	go func() {
-		err := c.heartbeatTask(taskCtx, task)
-		if err != nil && !errors.Is(err, context.Canceled) {
-			l.Debug("error while heart beating", zap.Error(err))
-			cancelTask(err)
-		}
-	}()
+	l.Info("c1_api_task_manager.Process(): processing task")
 
 	tHelpers := &taskHelpers{
 		task:          task,
@@ -194,7 +209,7 @@ func (c *c1ApiTaskManager) Process(ctx context.Context, task *v1.Task, cc types.
 		handler = newFullSyncTaskHandler(task, tHelpers)
 
 	case tasks.HelloType:
-		handler = newHelloTaskHandler(task, task.GetId() != startupHelloTaskID, tHelpers)
+		handler = newHelloTaskHandler(task, tHelpers)
 
 	case tasks.GrantType:
 		handler = newGrantTaskHandler(task, tHelpers)
@@ -203,17 +218,12 @@ func (c *c1ApiTaskManager) Process(ctx context.Context, task *v1.Task, cc types.
 		handler = newRevokeTaskHandler(task, tHelpers)
 
 	default:
-		return c.finishTask(ctx, task, errors.New("unsupported task type"))
-	}
-
-	if handler == nil {
-		return c.finishTask(ctx, task, errors.New("unsupported task type - no handler"))
+		return c.finishTask(ctx, task, nil, errors.New("unsupported task type"))
 	}
 
 	err := handler.HandleTask(ctx)
 	if err != nil {
-		l.Error("error while handling task", zap.Error(err))
-		cancelTask(err)
+		l.Error("c1_api_task_manager.Process(): error while handling task", zap.Error(err))
 		return err
 	}
 
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/revoke.go b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/revoke.go
index 8d866a8..a1d51b7 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/revoke.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/revoke.go
@@ -4,17 +4,20 @@ import (
 	"context"
 	"errors"
 
+	"github.com/conductorone/baton-sdk/pkg/annotations"
+
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"go.uber.org/zap"
+
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
 	"github.com/conductorone/baton-sdk/pkg/tasks"
 	"github.com/conductorone/baton-sdk/pkg/types"
-	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
-	"go.uber.org/zap"
 )
 
 type revokeHelpers interface {
 	ConnectorClient() types.ConnectorClient
-	FinishTask(ctx context.Context, err error) error
+	FinishTask(ctx context.Context, annos annotations.Annotations, err error) error
 }
 
 type revokeTaskHandler struct {
@@ -27,19 +30,19 @@ func (r *revokeTaskHandler) HandleTask(ctx context.Context) error {
 
 	if r.task.GetRevoke() == nil || r.task.GetRevoke().GetGrant() == nil {
 		l.Error("revoke task was nil or missing grant", zap.Any("revoke", r.task.GetRevoke()), zap.Any("grant", r.task.GetRevoke().GetGrant()))
-		return r.helpers.FinishTask(ctx, errors.Join(errors.New("invalid task type"), ErrTaskNonRetryable))
+		return r.helpers.FinishTask(ctx, nil, errors.Join(errors.New("invalid task type"), ErrTaskNonRetryable))
 	}
 
 	cc := r.helpers.ConnectorClient()
-	_, err := cc.Revoke(ctx, &v2.GrantManagerServiceRevokeRequest{
+	resp, err := cc.Revoke(ctx, &v2.GrantManagerServiceRevokeRequest{
 		Grant: r.task.GetRevoke().GetGrant(),
 	})
 	if err != nil {
 		l.Error("failed while granting entitlement", zap.Error(err))
-		return r.helpers.FinishTask(ctx, errors.Join(err, ErrTaskNonRetryable))
+		return r.helpers.FinishTask(ctx, nil, errors.Join(err, ErrTaskNonRetryable))
 	}
 
-	return r.helpers.FinishTask(ctx, nil)
+	return r.helpers.FinishTask(ctx, resp.GetAnnotations(), nil)
 }
 
 func newRevokeTaskHandler(task *v1.Task, helpers revokeHelpers) tasks.TaskHandler {
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/task_helpers.go b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/task_helpers.go
index 8822a5d..5f02e21 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/task_helpers.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/tasks/c1api/task_helpers.go
@@ -4,6 +4,13 @@ import (
 	"context"
 	"errors"
 	"io"
+	"time"
+
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"go.uber.org/zap"
+
+	"github.com/conductorone/baton-sdk/pkg/annotations"
+	"github.com/conductorone/baton-sdk/pkg/tasks"
 
 	v1 "github.com/conductorone/baton-sdk/pb/c1/connectorapi/baton/v1"
 	"github.com/conductorone/baton-sdk/pkg/types"
@@ -14,7 +21,7 @@ type taskHelpers struct {
 	serviceClient BatonServiceClient
 	cc            types.ConnectorClient
 
-	taskFinisher func(ctx context.Context, task *v1.Task, err error) error
+	taskFinisher func(ctx context.Context, task *v1.Task, annos annotations.Annotations, err error) error
 }
 
 func (t *taskHelpers) ConnectorClient() types.ConnectorClient {
@@ -28,13 +35,101 @@ func (t *taskHelpers) Upload(ctx context.Context, r io.ReadSeeker) error {
 	return t.serviceClient.Upload(ctx, t.task, r)
 }
 
-func (t *taskHelpers) FinishTask(ctx context.Context, err error) error {
+func (t *taskHelpers) FinishTask(ctx context.Context, annos annotations.Annotations, err error) error {
 	if t.task == nil {
 		return errors.New("cannot finish task: task is nil")
 	}
-	return t.taskFinisher(ctx, t.task, err)
+	return t.taskFinisher(ctx, t.task, annos, err)
 }
 
 func (t *taskHelpers) HelloClient() batonHelloClient {
 	return t.serviceClient
 }
+
+// HeartbeatTask will call the heartbeat service endpoint for the task until the context is cancelled. An initial heartbeat is
+// synchronously run, and if successful a goroutine is spawned that will heartbeat periodically respecting the returned heartbeat interval.
+// If the given context is cancelled, the returned context will be cancelled with the same cause.
+// If the heartbeat fails, this function will retry up to taskMaximumHeartbeatFailures times before cancelling the returned context with ErrTaskHeartbeatFailed.
+// If the task is cancelled by the server, the returned context will be cancelled with ErrTaskCancelled.
+func (t *taskHelpers) HeartbeatTask(ctx context.Context, annos annotations.Annotations) (context.Context, error) {
+	l := ctxzap.Extract(ctx).With(zap.String("task_id", t.task.GetId()), zap.Stringer("task_type", tasks.GetType(t.task)))
+	rCtx, rCancel := context.WithCancelCause(ctx)
+
+	l.Debug("heartbeat: sending initial heartbeat")
+	resp, err := t.serviceClient.Heartbeat(ctx, &v1.BatonServiceHeartbeatRequest{
+		TaskId:      t.task.GetId(),
+		Annotations: annos,
+	})
+	if err != nil {
+		err = errors.Join(ErrTaskHeartbeatFailed, err)
+		l.Error("heartbeat: failed sending initial heartbeat", zap.Error(err))
+		rCancel(err)
+		return nil, err
+	}
+	if resp.Cancelled {
+		err = ErrTaskCancelled
+		l.Debug("heartbeat: task was cancelled by server")
+		rCancel(err)
+		return nil, err
+	}
+
+	heartbeatInterval := getHeartbeatInterval(resp.GetNextHeartbeat().AsDuration())
+	l.Debug("heartbeat: initial heartbeat success", zap.Duration("next_heartbeat", heartbeatInterval))
+
+	go func() {
+		attempts := 0
+		for {
+			attempts++
+			l = l.With(zap.Int("attempts", attempts))
+
+			if attempts >= taskMaximumHeartbeatFailures {
+				l.Error("heartbeat: failed after 10 attempts")
+				rCancel(ErrTaskHeartbeatFailed)
+				return
+			}
+
+			l.Debug("heartbeat: waiting", zap.Duration("next_heartbeat", heartbeatInterval))
+			select {
+			case <-ctx.Done():
+				l.Debug("heartbeat: context cancelled, stopping", zap.NamedError("cause", context.Cause(ctx)))
+				rCancel(ctx.Err())
+				return
+
+			case <-time.After(heartbeatInterval):
+				resp, err := t.serviceClient.Heartbeat(ctx, &v1.BatonServiceHeartbeatRequest{
+					TaskId:      t.task.GetId(),
+					Annotations: annos,
+				})
+				if err != nil {
+					// If our parent context gets cancelled we can just leave.
+					if ctxErr := ctx.Err(); ctxErr != nil {
+						l.Debug("heartbeat: context cancelled while sending heartbeat", zap.Error(err), zap.NamedError("cause", context.Cause(ctx)))
+						rCancel(ctx.Err())
+						return
+					}
+					l.Error("heartbeat: failed sending heartbeat", zap.Error(err))
+
+					// TODO(morgabra) Set the interval lower and then backoff on subsequent failures.
+					continue
+				}
+
+				if resp == nil {
+					l.Error("heartbeat: response was nil")
+					heartbeatInterval = defaultHeartbeatInterval
+					continue
+				}
+
+				heartbeatInterval = getHeartbeatInterval(resp.GetNextHeartbeat().AsDuration())
+				l.Debug("heartbeat: success", zap.Duration("next_heartbeat", heartbeatInterval))
+				if resp.Cancelled {
+					l.Debug("heartbeat: task was cancelled by server")
+					rCancel(ErrTaskCancelled)
+					return
+				}
+				attempts = 0
+			}
+		}
+	}()
+
+	return rCtx, nil
+}
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/types/grant/grant.go b/vendor/github.com/conductorone/baton-sdk/pkg/types/grant/grant.go
index e9af52f..6a55b48 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/types/grant/grant.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/types/grant/grant.go
@@ -7,22 +7,40 @@ import (
 	"github.com/conductorone/baton-sdk/pkg/annotations"
 	eopt "github.com/conductorone/baton-sdk/pkg/types/entitlement"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/structpb"
 )
 
-type GrantOption func(*v2.Grant)
+type GrantOption func(*v2.Grant) error
 
 type GrantPrincipal interface {
 	proto.Message
 	GetBatonResource() bool
 }
 
+func WithGrantMetadata(metadata map[string]interface{}) GrantOption {
+	return func(g *v2.Grant) error {
+		md, err := structpb.NewStruct(metadata)
+		if err != nil {
+			return err
+		}
+
+		annos := annotations.Annotations(g.Annotations)
+		annos.Update(md)
+		g.Annotations = annos
+
+		return nil
+	}
+}
+
 func WithAnnotation(msgs ...proto.Message) GrantOption {
-	return func(g *v2.Grant) {
+	return func(g *v2.Grant) error {
 		annos := annotations.Annotations(g.Annotations)
 		for _, msg := range msgs {
 			annos.Append(msg)
 		}
 		g.Annotations = annos
+
+		return nil
 	}
 }
 
@@ -55,7 +73,10 @@ func NewGrant(resource *v2.Resource, entitlementName string, principal GrantPrin
 	grant.Id = fmt.Sprintf("%s:%s:%s", entitlement.Id, resourceID.ResourceType, resourceID.Resource)
 
 	for _, grantOption := range grantOptions {
-		grantOption(grant)
+		err := grantOption(grant)
+		if err != nil {
+			panic(err)
+		}
 	}
 
 	return grant
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/app_trait.go b/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/app_trait.go
index 4fbb22d..8d2335d 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/app_trait.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/app_trait.go
@@ -26,6 +26,13 @@ func WithAppLogo(assetRef *v2.AssetRef) AppTraitOption {
 	}
 }
 
+func WithAppFlags(flags ...v2.AppTrait_AppFlag) AppTraitOption {
+	return func(at *v2.AppTrait) error {
+		at.Flags = flags
+		return nil
+	}
+}
+
 func WithAppProfile(profile map[string]interface{}) AppTraitOption {
 	return func(at *v2.AppTrait) error {
 		p, err := structpb.NewStruct(profile)
diff --git a/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/resource.go b/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/resource.go
index ca92147..71fe101 100644
--- a/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/resource.go
+++ b/vendor/github.com/conductorone/baton-sdk/pkg/types/resource/resource.go
@@ -16,6 +16,9 @@ func WithAnnotation(msgs ...proto.Message) ResourceOption {
 	return func(r *v2.Resource) error {
 		annos := annotations.Annotations(r.Annotations)
 		for _, msg := range msgs {
+			if msg == nil {
+				continue
+			}
 			annos.Append(msg)
 		}
 		r.Annotations = annos
diff --git a/vendor/golang.org/x/sync/LICENSE b/vendor/golang.org/x/sync/LICENSE
new file mode 100644
index 0000000..6a66aea
--- /dev/null
+++ b/vendor/golang.org/x/sync/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/golang.org/x/sync/PATENTS b/vendor/golang.org/x/sync/PATENTS
new file mode 100644
index 0000000..7330990
--- /dev/null
+++ b/vendor/golang.org/x/sync/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/vendor/golang.org/x/sync/semaphore/semaphore.go b/vendor/golang.org/x/sync/semaphore/semaphore.go
new file mode 100644
index 0000000..30f632c
--- /dev/null
+++ b/vendor/golang.org/x/sync/semaphore/semaphore.go
@@ -0,0 +1,136 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package semaphore provides a weighted semaphore implementation.
+package semaphore // import "golang.org/x/sync/semaphore"
+
+import (
+	"container/list"
+	"context"
+	"sync"
+)
+
+type waiter struct {
+	n     int64
+	ready chan<- struct{} // Closed when semaphore acquired.
+}
+
+// NewWeighted creates a new weighted semaphore with the given
+// maximum combined weight for concurrent access.
+func NewWeighted(n int64) *Weighted {
+	w := &Weighted{size: n}
+	return w
+}
+
+// Weighted provides a way to bound concurrent access to a resource.
+// The callers can request access with a given weight.
+type Weighted struct {
+	size    int64
+	cur     int64
+	mu      sync.Mutex
+	waiters list.List
+}
+
+// Acquire acquires the semaphore with a weight of n, blocking until resources
+// are available or ctx is done. On success, returns nil. On failure, returns
+// ctx.Err() and leaves the semaphore unchanged.
+//
+// If ctx is already done, Acquire may still succeed without blocking.
+func (s *Weighted) Acquire(ctx context.Context, n int64) error {
+	s.mu.Lock()
+	if s.size-s.cur >= n && s.waiters.Len() == 0 {
+		s.cur += n
+		s.mu.Unlock()
+		return nil
+	}
+
+	if n > s.size {
+		// Don't make other Acquire calls block on one that's doomed to fail.
+		s.mu.Unlock()
+		<-ctx.Done()
+		return ctx.Err()
+	}
+
+	ready := make(chan struct{})
+	w := waiter{n: n, ready: ready}
+	elem := s.waiters.PushBack(w)
+	s.mu.Unlock()
+
+	select {
+	case <-ctx.Done():
+		err := ctx.Err()
+		s.mu.Lock()
+		select {
+		case <-ready:
+			// Acquired the semaphore after we were canceled.  Rather than trying to
+			// fix up the queue, just pretend we didn't notice the cancelation.
+			err = nil
+		default:
+			isFront := s.waiters.Front() == elem
+			s.waiters.Remove(elem)
+			// If we're at the front and there're extra tokens left, notify other waiters.
+			if isFront && s.size > s.cur {
+				s.notifyWaiters()
+			}
+		}
+		s.mu.Unlock()
+		return err
+
+	case <-ready:
+		return nil
+	}
+}
+
+// TryAcquire acquires the semaphore with a weight of n without blocking.
+// On success, returns true. On failure, returns false and leaves the semaphore unchanged.
+func (s *Weighted) TryAcquire(n int64) bool {
+	s.mu.Lock()
+	success := s.size-s.cur >= n && s.waiters.Len() == 0
+	if success {
+		s.cur += n
+	}
+	s.mu.Unlock()
+	return success
+}
+
+// Release releases the semaphore with a weight of n.
+func (s *Weighted) Release(n int64) {
+	s.mu.Lock()
+	s.cur -= n
+	if s.cur < 0 {
+		s.mu.Unlock()
+		panic("semaphore: released more than held")
+	}
+	s.notifyWaiters()
+	s.mu.Unlock()
+}
+
+func (s *Weighted) notifyWaiters() {
+	for {
+		next := s.waiters.Front()
+		if next == nil {
+			break // No more waiters blocked.
+		}
+
+		w := next.Value.(waiter)
+		if s.size-s.cur < w.n {
+			// Not enough tokens for the next waiter.  We could keep going (to try to
+			// find a waiter with a smaller request), but under load that could cause
+			// starvation for large requests; instead, we leave all remaining waiters
+			// blocked.
+			//
+			// Consider a semaphore used as a read-write lock, with N tokens, N
+			// readers, and one writer.  Each reader can Acquire(1) to obtain a read
+			// lock.  The writer can Acquire(N) to obtain a write lock, excluding all
+			// of the readers.  If we allow the readers to jump ahead in the queue,
+			// the writer will starve — there is always one token available for every
+			// reader.
+			break
+		}
+
+		s.cur += w.n
+		s.waiters.Remove(next)
+		close(w.ready)
+	}
+}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index afe0565..9444c3f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -118,7 +118,7 @@ github.com/aws/smithy-go/waiter
 # github.com/benbjohnson/clock v1.3.5
 ## explicit; go 1.15
 github.com/benbjohnson/clock
-# github.com/conductorone/baton-sdk v0.1.0
+# github.com/conductorone/baton-sdk v0.1.4
 ## explicit; go 1.20
 github.com/conductorone/baton-sdk/internal/connector
 github.com/conductorone/baton-sdk/pb/c1/c1z/v1
@@ -351,6 +351,9 @@ golang.org/x/net/trace
 ## explicit; go 1.17
 golang.org/x/oauth2
 golang.org/x/oauth2/internal
+# golang.org/x/sync v0.1.0
+## explicit
+golang.org/x/sync/semaphore
 # golang.org/x/sys v0.10.0
 ## explicit; go 1.17
 golang.org/x/sys/internal/unsafeheader