We operate an internal developer platform that manages Harness Vault Secrets Manager connectors on behalf of customers. We own the connector lifecycle; customers own the credentials.

On provisioning we can preflight credential validity before creating the connector. Our issue is the update path — credentials can expire between onboarding and a later reprovisioning event. The only signal we currently receive is a failed terraform apply.

We investigated test-connection as a pre-flight check, but it returns success even after credentials are invalidated. This was confirmed through both the Harness UI and REST API (POST /ng/api/connectors/testConnection/{identifier}).

To reproduce: provision a Vault connector with valid credentials, invalidate them, run test-connection (observe success), then run terraform apply (observe failure).

We expect test-connection to exercise the same validation path the Terraform provider uses during create/update, so a successful test reliably indicates a reprovision will succeed.