Credentials

Create Credential

client.Beta.Vaults.Credentials.New(ctx, vaultID, params) (*BetaManagedAgentsCredential, error)

POST/v1/vaults/{vault_id}/credentials

List Credentials

client.Beta.Vaults.Credentials.List(ctx, vaultID, params) (*PageCursor[BetaManagedAgentsCredential], error)

GET/v1/vaults/{vault_id}/credentials

Get Credential

client.Beta.Vaults.Credentials.Get(ctx, credentialID, params) (*BetaManagedAgentsCredential, error)

GET/v1/vaults/{vault_id}/credentials/{credential_id}

Update Credential

client.Beta.Vaults.Credentials.Update(ctx, credentialID, params) (*BetaManagedAgentsCredential, error)

POST/v1/vaults/{vault_id}/credentials/{credential_id}

Delete Credential

client.Beta.Vaults.Credentials.Delete(ctx, credentialID, params) (*BetaManagedAgentsDeletedCredential, error)

DELETE/v1/vaults/{vault_id}/credentials/{credential_id}

Archive Credential

client.Beta.Vaults.Credentials.Archive(ctx, credentialID, params) (*BetaManagedAgentsCredential, error)

POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive

Validate Credential

client.Beta.Vaults.Credentials.MCPOAuthValidate(ctx, credentialID, params) (*BetaManagedAgentsCredentialValidation, error)

POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate

Models

type BetaManagedAgentsCredential struct{…}

A credential stored in a vault. Sensitive fields are never returned in responses.

type BetaManagedAgentsCredentialNetworkingParamsUnionResp interface{…}

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

One of the following:

type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsResp struct{…}

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsType

type BetaManagedAgentsLimitedCredentialNetworkingParamsResp struct{…}

Substitute the secret only on requests to the listed hosts.

AllowedHosts []string

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

Type BetaManagedAgentsLimitedCredentialNetworkingParamsType

type BetaManagedAgentsCredentialValidation struct{…}

Result of live-probing a credential against its configured MCP server.

type BetaManagedAgentsCredentialValidationStatus string

Overall verdict of a credential validation probe.

One of the following:

const BetaManagedAgentsCredentialValidationStatusValid BetaManagedAgentsCredentialValidationStatus = "valid"

const BetaManagedAgentsCredentialValidationStatusInvalid BetaManagedAgentsCredentialValidationStatus = "invalid"

const BetaManagedAgentsCredentialValidationStatusUnknown BetaManagedAgentsCredentialValidationStatus = "unknown"

type BetaManagedAgentsDeletedCredential struct{…}

Confirmation of a deleted credential.

ID string

Unique identifier of the deleted credential.

Type BetaManagedAgentsDeletedCredentialType

type BetaManagedAgentsEnvironmentVariableAuthResponse struct{…}

Environment variable credential details. The secret value is never returned.

InjectionLocation BetaManagedAgentsInjectionLocationResponse

Where in the outbound request the secret value is substituted.

Body bool

Whether the placeholder is substituted in the request body.

Networking BetaManagedAgentsEnvironmentVariableAuthResponseNetworkingUnion

Outbound hosts the secret value is substituted on.

One of the following:

type BetaManagedAgentsUnrestrictedCredentialNetworkingResponse struct{…}

The secret is substituted on any host the session's Environment network policy permits egress to.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingResponseType

type BetaManagedAgentsLimitedCredentialNetworkingResponse struct{…}

The secret is substituted only on requests to the listed hosts.

AllowedHosts []string

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

Type BetaManagedAgentsLimitedCredentialNetworkingResponseType

SecretName string

Name of the environment variable.

Type BetaManagedAgentsEnvironmentVariableAuthResponseType

type BetaManagedAgentsEnvironmentVariableCreateParamsResp struct{…}

Parameters for creating an environment variable credential.

type BetaManagedAgentsEnvironmentVariableUpdateParamsResp struct{…}

Parameters for updating an environment variable credential. secret_name is immutable.

Type BetaManagedAgentsEnvironmentVariableUpdateParamsType

InjectionLocation BetaManagedAgentsInjectionLocationUpdateParamsResp Optional

Updated injection location.

Body bool Optional

Substitute when the placeholder appears in the request body.

Networking BetaManagedAgentsCredentialNetworkingParamsUnionResp Optional

Updated networking scope. Full replacement.

One of the following:

type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsResp struct{…}

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsType

type BetaManagedAgentsLimitedCredentialNetworkingParamsResp struct{…}

Substitute the secret only on requests to the listed hosts.

AllowedHosts []string

Type BetaManagedAgentsLimitedCredentialNetworkingParamsType

SecretValue string Optional

Updated secret value.

minLength1

maxLength4096

type BetaManagedAgentsInjectionLocationParamsResp struct{…}

Where in the outbound request the secret value may be substituted.

Body bool Optional

Substitute when the placeholder appears in the request body.

type BetaManagedAgentsInjectionLocationResponse struct{…}

Where in the outbound request the secret value is substituted.

Body bool

Whether the placeholder is substituted in the request body.

type BetaManagedAgentsInjectionLocationUpdateParamsResp struct{…}

Updated injection location.

Body bool Optional

Substitute when the placeholder appears in the request body.

type BetaManagedAgentsLimitedCredentialNetworkingParamsResp struct{…}

Substitute the secret only on requests to the listed hosts.

AllowedHosts []string

Type BetaManagedAgentsLimitedCredentialNetworkingParamsType

type BetaManagedAgentsLimitedCredentialNetworkingResponse struct{…}

The secret is substituted only on requests to the listed hosts.

AllowedHosts []string

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

Type BetaManagedAgentsLimitedCredentialNetworkingResponseType

type BetaManagedAgentsMCPOAuthAuthResponse struct{…}

OAuth credential details for an MCP server.

type BetaManagedAgentsMCPOAuthCreateParamsResp struct{…}

Parameters for creating an MCP OAuth credential.

AccessToken string

OAuth access token.

minLength1

maxLength8192

MCPServerURL string

URL of the MCP server this credential authenticates against.

minLength1

maxLength2047

Type BetaManagedAgentsMCPOAuthCreateParamsType

ExpiresAt Time Optional

A timestamp in RFC 3339 format

formatdate-time

Refresh BetaManagedAgentsMCPOAuthRefreshParamsResp Optional

OAuth refresh token parameters for creating a credential with refresh support.

type BetaManagedAgentsMCPOAuthRefreshParamsResp struct{…}

OAuth refresh token parameters for creating a credential with refresh support.

type BetaManagedAgentsMCPOAuthRefreshResponse struct{…}

OAuth refresh token configuration returned in credential responses.

ClientID string

OAuth client ID.

TokenEndpoint string

Token endpoint URL used to refresh the access token.

TokenEndpointAuth BetaManagedAgentsMCPOAuthRefreshResponseTokenEndpointAuthUnion

Token endpoint requires no client authentication.

One of the following:

type BetaManagedAgentsTokenEndpointAuthNoneResponse struct{…}

Token endpoint requires no client authentication.

Type BetaManagedAgentsTokenEndpointAuthNoneResponseType

type BetaManagedAgentsTokenEndpointAuthBasicResponse struct{…}

Token endpoint uses HTTP Basic authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthBasicResponseType

type BetaManagedAgentsTokenEndpointAuthPostResponse struct{…}

Token endpoint uses POST body authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthPostResponseType

Resource string Optional

OAuth resource indicator.

Scope string Optional

OAuth scope for the refresh request.

type BetaManagedAgentsMCPOAuthRefreshUpdateParamsResp struct{…}

Parameters for updating OAuth refresh token configuration.

RefreshToken string Optional

Updated OAuth refresh token.

minLength1

maxLength4096

Scope string Optional

Updated OAuth scope for the refresh request.

maxLength8192

TokenEndpointAuth BetaManagedAgentsMCPOAuthRefreshUpdateParamsTokenEndpointAuthUnionResp Optional

Updated HTTP Basic authentication parameters for the token endpoint.

One of the following:

type BetaManagedAgentsTokenEndpointAuthBasicUpdateParamResp struct{…}

Updated HTTP Basic authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthBasicUpdateParamType

ClientSecret string Optional

Updated OAuth client secret.

minLength1

maxLength512

type BetaManagedAgentsTokenEndpointAuthPostUpdateParamResp struct{…}

Updated POST body authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthPostUpdateParamType

ClientSecret string Optional

Updated OAuth client secret.

minLength1

maxLength512

type BetaManagedAgentsMCPOAuthUpdateParamsResp struct{…}

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

type BetaManagedAgentsMCPProbe struct{…}

The failing step of an MCP validation probe.

HTTPResponse BetaManagedAgentsRefreshHTTPResponse

An HTTP response captured during a credential validation probe.

Body string

Response body. May be truncated and has sensitive values scrubbed.

BodyTruncated bool

Whether body was truncated.

ContentType string

Value of the Content-Type response header.

StatusCode int64

HTTP status code.

formatint32

Method string

The MCP method that failed (for example initialize or tools/list).

type BetaManagedAgentsRefreshHTTPResponse struct{…}

An HTTP response captured during a credential validation probe.

Body string

Response body. May be truncated and has sensitive values scrubbed.

BodyTruncated bool

Whether body was truncated.

ContentType string

Value of the Content-Type response header.

StatusCode int64

HTTP status code.

formatint32

type BetaManagedAgentsRefreshObject struct{…}

Outcome of a refresh-token exchange attempted during credential validation.

HTTPResponse BetaManagedAgentsRefreshHTTPResponse

An HTTP response captured during a credential validation probe.

Body string

Response body. May be truncated and has sensitive values scrubbed.

BodyTruncated bool

Whether body was truncated.

ContentType string

Value of the Content-Type response header.

StatusCode int64

HTTP status code.

formatint32

Status BetaManagedAgentsRefreshObjectStatus

Outcome of a refresh-token exchange attempted during credential validation.

One of the following:

const BetaManagedAgentsRefreshObjectStatusSucceeded BetaManagedAgentsRefreshObjectStatus = "succeeded"

const BetaManagedAgentsRefreshObjectStatusFailed BetaManagedAgentsRefreshObjectStatus = "failed"

const BetaManagedAgentsRefreshObjectStatusConnectError BetaManagedAgentsRefreshObjectStatus = "connect_error"

const BetaManagedAgentsRefreshObjectStatusNoRefreshToken BetaManagedAgentsRefreshObjectStatus = "no_refresh_token"

type BetaManagedAgentsStaticBearerAuthResponse struct{…}

Static bearer token credential details for an MCP server.

MCPServerURL string

URL of the MCP server this credential authenticates against.

Type BetaManagedAgentsStaticBearerAuthResponseType

type BetaManagedAgentsStaticBearerCreateParamsResp struct{…}

Parameters for creating a static bearer token credential.

Token string

Static bearer token value.

minLength1

maxLength8192

MCPServerURL string

URL of the MCP server this credential authenticates against.

minLength1

maxLength2047

Type BetaManagedAgentsStaticBearerCreateParamsType

type BetaManagedAgentsStaticBearerUpdateParamsResp struct{…}

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

Type BetaManagedAgentsStaticBearerUpdateParamsType

Token string Optional

Updated static bearer token value.

minLength1

maxLength8192

type BetaManagedAgentsTokenEndpointAuthBasicParamResp struct{…}

Token endpoint uses HTTP Basic authentication with client credentials.

ClientSecret string

OAuth client secret.

minLength1

maxLength512

Type BetaManagedAgentsTokenEndpointAuthBasicParamType

type BetaManagedAgentsTokenEndpointAuthBasicResponse struct{…}

Token endpoint uses HTTP Basic authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthBasicResponseType

type BetaManagedAgentsTokenEndpointAuthBasicUpdateParamResp struct{…}

Updated HTTP Basic authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthBasicUpdateParamType

ClientSecret string Optional

Updated OAuth client secret.

minLength1

maxLength512

type BetaManagedAgentsTokenEndpointAuthNoneParamResp struct{…}

Token endpoint requires no client authentication.

Type BetaManagedAgentsTokenEndpointAuthNoneParamType

type BetaManagedAgentsTokenEndpointAuthNoneResponse struct{…}

Token endpoint requires no client authentication.

Type BetaManagedAgentsTokenEndpointAuthNoneResponseType

type BetaManagedAgentsTokenEndpointAuthPostParamResp struct{…}

Token endpoint uses POST body authentication with client credentials.

ClientSecret string

OAuth client secret.

minLength1

maxLength512

Type BetaManagedAgentsTokenEndpointAuthPostParamType

type BetaManagedAgentsTokenEndpointAuthPostResponse struct{…}

Token endpoint uses POST body authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthPostResponseType

type BetaManagedAgentsTokenEndpointAuthPostUpdateParamResp struct{…}

Updated POST body authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthPostUpdateParamType

ClientSecret string Optional

Updated OAuth client secret.

minLength1

maxLength512

type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsResp struct{…}

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsType

type BetaManagedAgentsUnrestrictedCredentialNetworkingResponse struct{…}

The secret is substituted on any host the session's Environment network policy permits egress to.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingResponseType