Claude Platform Docs

Credentials

Create Credential
BetaManagedAgentsCredential beta().vaults().credentials().create(CredentialCreateParamsparams, RequestOptionsrequestOptions = RequestOptions.none())
POST/v1/vaults/{vault_id}/credentials
List Credentials
CredentialListPage beta().vaults().credentials().list(CredentialListParamsparams = CredentialListParams.none(), RequestOptionsrequestOptions = RequestOptions.none())
GET/v1/vaults/{vault_id}/credentials
Get Credential
BetaManagedAgentsCredential beta().vaults().credentials().retrieve(CredentialRetrieveParamsparams, RequestOptionsrequestOptions = RequestOptions.none())
GET/v1/vaults/{vault_id}/credentials/{credential_id}
Update Credential
BetaManagedAgentsCredential beta().vaults().credentials().update(CredentialUpdateParamsparams, RequestOptionsrequestOptions = RequestOptions.none())
POST/v1/vaults/{vault_id}/credentials/{credential_id}
Delete Credential
BetaManagedAgentsDeletedCredential beta().vaults().credentials().delete(CredentialDeleteParamsparams, RequestOptionsrequestOptions = RequestOptions.none())
DELETE/v1/vaults/{vault_id}/credentials/{credential_id}
Archive Credential
BetaManagedAgentsCredential beta().vaults().credentials().archive(CredentialArchiveParamsparams, RequestOptionsrequestOptions = RequestOptions.none())
POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive
Validate Credential
BetaManagedAgentsCredentialValidation beta().vaults().credentials().mcpOAuthValidate(CredentialMcpOAuthValidateParamsparams, RequestOptionsrequestOptions = RequestOptions.none())
POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate
Models
class BetaManagedAgentsCredential:

A credential stored in a vault. Sensitive fields are never returned in responses.

class BetaManagedAgentsCredentialNetworkingParams: A class that can be one of several variants.union

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

class BetaManagedAgentsUnrestrictedCredentialNetworkingParams:

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type type
class BetaManagedAgentsLimitedCredentialNetworkingParams:

Substitute the secret only on requests to the listed hosts.

List<String> allowedHosts

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

Type type
class BetaManagedAgentsCredentialValidation:

Result of live-probing a credential against its configured MCP server.

enum BetaManagedAgentsCredentialValidationStatus:

Overall verdict of a credential validation probe.

VALID("valid")
INVALID("invalid")
UNKNOWN("unknown")
class BetaManagedAgentsDeletedCredential:

Confirmation of a deleted credential.

String id

Unique identifier of the deleted credential.

Type type
class BetaManagedAgentsEnvironmentVariableAuthResponse:

Environment variable credential details. The secret value is never returned.

BetaManagedAgentsInjectionLocationResponse injectionLocation

Where in the outbound request the secret value is substituted.

boolean body

Whether the placeholder is substituted in the request body.

boolean header

Whether the placeholder is substituted in request header values.

Networking networking

Outbound hosts the secret value is substituted on.

One of the following:
class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse:

The secret is substituted on any host the session's Environment network policy permits egress to.

Type type
class BetaManagedAgentsLimitedCredentialNetworkingResponse:

The secret is substituted only on requests to the listed hosts.

List<String> allowedHosts

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

Type type
String secretName

Name of the environment variable.

Type type
class BetaManagedAgentsEnvironmentVariableCreateParams:

Parameters for creating an environment variable credential.

class BetaManagedAgentsEnvironmentVariableUpdateParams:

Parameters for updating an environment variable credential. secret_name is immutable.

class BetaManagedAgentsInjectionLocationParams:

Where in the outbound request the secret value may be substituted.

Optional<Boolean> body

Substitute when the placeholder appears in the request body.

Optional<Boolean> header

Substitute when the placeholder appears in a request header value.

class BetaManagedAgentsInjectionLocationResponse:

Where in the outbound request the secret value is substituted.

boolean body

Whether the placeholder is substituted in the request body.

boolean header

Whether the placeholder is substituted in request header values.

class BetaManagedAgentsInjectionLocationUpdateParams:

Updated injection location.

Optional<Boolean> body

Substitute when the placeholder appears in the request body.

Optional<Boolean> header

Substitute when the placeholder appears in a request header value.

class BetaManagedAgentsLimitedCredentialNetworkingParams:

Substitute the secret only on requests to the listed hosts.

List<String> allowedHosts

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

Type type
class BetaManagedAgentsLimitedCredentialNetworkingResponse:

The secret is substituted only on requests to the listed hosts.

List<String> allowedHosts

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

Type type
class BetaManagedAgentsMcpOAuthAuthResponse:

OAuth credential details for an MCP server.

class BetaManagedAgentsMcpOAuthCreateParams:

Parameters for creating an MCP OAuth credential.

String accessToken

OAuth access token.

minLength1
maxLength8192
String mcpServerUrl

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
Type type
Optional<LocalDateTime> expiresAt

A timestamp in RFC 3339 format

formatdate-time
Optional<BetaManagedAgentsMcpOAuthRefreshParams> refresh

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMcpOAuthRefreshParams:

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMcpOAuthRefreshResponse:

OAuth refresh token configuration returned in credential responses.

String clientId

OAuth client ID.

String tokenEndpoint

Token endpoint URL used to refresh the access token.

TokenEndpointAuth tokenEndpointAuth

Token endpoint requires no client authentication.

One of the following:
class BetaManagedAgentsTokenEndpointAuthNoneResponse:

Token endpoint requires no client authentication.

Type type
class BetaManagedAgentsTokenEndpointAuthBasicResponse:

Token endpoint uses HTTP Basic authentication with client credentials.

Type type
class BetaManagedAgentsTokenEndpointAuthPostResponse:

Token endpoint uses POST body authentication with client credentials.

Type type
Optional<String> resource

OAuth resource indicator.

Optional<String> scope

OAuth scope for the refresh request.

class BetaManagedAgentsMcpOAuthRefreshUpdateParams:

Parameters for updating OAuth refresh token configuration.

Optional<String> refreshToken

Updated OAuth refresh token.

minLength1
maxLength4096
Optional<String> scope

Updated OAuth scope for the refresh request.

maxLength8192
Optional<TokenEndpointAuth> tokenEndpointAuth

Updated HTTP Basic authentication parameters for the token endpoint.

One of the following:
class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam:

Updated HTTP Basic authentication parameters for the token endpoint.

Type type
Optional<String> clientSecret

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsTokenEndpointAuthPostUpdateParam:

Updated POST body authentication parameters for the token endpoint.

Type type
Optional<String> clientSecret

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsMcpOAuthUpdateParams:

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

class BetaManagedAgentsMcpProbe:

The failing step of an MCP validation probe.

Optional<BetaManagedAgentsRefreshHttpResponse> httpResponse

An HTTP response captured during a credential validation probe.

String body

Response body. May be truncated and has sensitive values scrubbed.

boolean bodyTruncated

Whether body was truncated.

String contentType

Value of the Content-Type response header.

long statusCode

HTTP status code.

formatint32
String method

The MCP method that failed (for example initialize or tools/list).

class BetaManagedAgentsRefreshHttpResponse:

An HTTP response captured during a credential validation probe.

String body

Response body. May be truncated and has sensitive values scrubbed.

boolean bodyTruncated

Whether body was truncated.

String contentType

Value of the Content-Type response header.

long statusCode

HTTP status code.

formatint32
class BetaManagedAgentsRefreshObject:

Outcome of a refresh-token exchange attempted during credential validation.

Optional<BetaManagedAgentsRefreshHttpResponse> httpResponse

An HTTP response captured during a credential validation probe.

String body

Response body. May be truncated and has sensitive values scrubbed.

boolean bodyTruncated

Whether body was truncated.

String contentType

Value of the Content-Type response header.

long statusCode

HTTP status code.

formatint32
Status status

Outcome of a refresh-token exchange attempted during credential validation.

One of the following:
SUCCEEDED("succeeded")
FAILED("failed")
CONNECT_ERROR("connect_error")
NO_REFRESH_TOKEN("no_refresh_token")
class BetaManagedAgentsStaticBearerAuthResponse:

Static bearer token credential details for an MCP server.

String mcpServerUrl

URL of the MCP server this credential authenticates against.

Type type
class BetaManagedAgentsStaticBearerCreateParams:

Parameters for creating a static bearer token credential.

String token

Static bearer token value.

minLength1
maxLength8192
String mcpServerUrl

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
Type type
class BetaManagedAgentsStaticBearerUpdateParams:

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

Type type
Optional<String> token

Updated static bearer token value.

minLength1
maxLength8192
class BetaManagedAgentsTokenEndpointAuthBasicParam:

Token endpoint uses HTTP Basic authentication with client credentials.

String clientSecret

OAuth client secret.

minLength1
maxLength512
Type type
class BetaManagedAgentsTokenEndpointAuthBasicResponse:

Token endpoint uses HTTP Basic authentication with client credentials.

Type type
class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam:

Updated HTTP Basic authentication parameters for the token endpoint.

Type type
Optional<String> clientSecret

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsTokenEndpointAuthNoneParam:

Token endpoint requires no client authentication.

Type type
class BetaManagedAgentsTokenEndpointAuthNoneResponse:

Token endpoint requires no client authentication.

Type type
class BetaManagedAgentsTokenEndpointAuthPostParam:

Token endpoint uses POST body authentication with client credentials.

String clientSecret

OAuth client secret.

minLength1
maxLength512
Type type
class BetaManagedAgentsTokenEndpointAuthPostResponse:

Token endpoint uses POST body authentication with client credentials.

Type type
class BetaManagedAgentsTokenEndpointAuthPostUpdateParam:

Updated POST body authentication parameters for the token endpoint.

Type type
Optional<String> clientSecret

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsUnrestrictedCredentialNetworkingParams:

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type type
class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse:

The secret is substituted on any host the session's Environment network policy permits egress to.

Type type