Claude Platform Docs

Credentials

Create a Credential
$client->beta->vaults->credentials->create(string vaultID, Auth auth, ?string displayName, ?array<string,string> metadata, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
List Credentials
$client->beta->vaults->credentials->list(string vaultID, ?bool includeArchived, ?int limit, ?string page, ?list<AnthropicBeta> betas, ?string workspaceID): PageCursor<ManagedAgentsCredential>
GET/v1/vaults/{vault_id}/credentials
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
Retrieve a Credential
$client->beta->vaults->credentials->retrieve(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
GET/v1/vaults/{vault_id}/credentials/{credential_id}
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
Update a Credential
$client->beta->vaults->credentials->update(string credentialID, string vaultID, ?Auth auth, ?string displayName, ?array<string,string> metadata, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
Delete a Credential
$client->beta->vaults->credentials->delete(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsDeletedCredential
DELETE/v1/vaults/{vault_id}/credentials/{credential_id}
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
Archive a Credential
$client->beta->vaults->credentials->archive(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
Validate an MCP OAuth Credential
$client->beta->vaults->credentials->mcpOAuthValidate(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredentialValidation
POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate
Requires anthropic-beta: managed-agents-2026-04-01. How to send beta headers
Models
class ManagedAgentsCredential { $type = 'vault_credential'; $id; $archivedAt; /* 6 more */ }
"vault_credential" type
string id

The unique ID of the credential (vcrd_...).

?\Datetime archivedAt

When the credential was archived. Null if not archived.

Auth auth

Authentication configuration for this credential.

\Datetime createdAt

A timestamp in RFC 3339 format

array<string,string> metadata

Arbitrary key-value metadata attached to the credential.

\Datetime updatedAt

A timestamp in RFC 3339 format

string vaultID

Identifier of the vault this credential belongs to.

?string displayName

Human-readable name for the credential.

class ManagedAgentsCredentialNetworkingParams
One of the following:
class ManagedAgentsUnrestrictedCredentialNetworkingParams { $type = 'unrestricted'; }
"unrestricted" type
class ManagedAgentsLimitedCredentialNetworkingParams { $type = 'limited'; $allowedHosts; }
"limited" type
list<string> allowedHosts

The destination hosts of the outbound requests that the credential's secret is substituted into.

Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *. wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.

class ManagedAgentsCredentialValidation { $type = 'vault_credential_validation'; $credentialID; $hasRefreshToken; /* 5 more */ }
"vault_credential_validation" type
string credentialID

Unique identifier of the credential that was validated.

bool hasRefreshToken

Whether the credential has a refresh token configured.

?ManagedAgentsMCPProbe mcpProbe

Details of the MCP probe step that failed, or null if the probe succeeded or there was no access token to test.

?ManagedAgentsRefreshObject refresh

Details of the refresh-token exchange attempted on a 401. Null when no refresh was attempted.

ManagedAgentsCredentialValidationStatus status

Overall verdict of the validation probe.

\Datetime validatedAt

When the validation probe was performed.

string vaultID

Identifier of the vault containing the credential.

enum ManagedAgentsCredentialValidationStatus
One of the following:
"valid"

The credential successfully authenticated against its MCP server.

"invalid"

The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again.

"unknown"

The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out.

class ManagedAgentsDeletedCredential { $type = 'vault_credential_deleted'; $id; }
"vault_credential_deleted" type
string id

The unique ID of the deleted credential (vcrd_...).

class ManagedAgentsEnvironmentVariableAuthResponse { $type = 'environment_variable'; $injectionLocation; $networking; $secretName; }
"environment_variable" type
ManagedAgentsInjectionLocationResponse injectionLocation

Where in the outbound request the secret value is substituted.

Networking networking

Outbound hosts the secret value is substituted on.

string secretName

Name of the environment variable.

class ManagedAgentsEnvironmentVariableCreateParams { $type = 'environment_variable'; $networking; $secretName; /* 2 more */ }
"environment_variable" type
ManagedAgentsCredentialNetworkingParams networking

Outbound hosts the secret value is substituted on.

string secretName

Name of the environment variable. Immutable after create.

string secretValue

The secret to substitute into the agent's outbound requests. It's write-only and never returned in responses.

?ManagedAgentsInjectionLocationParams injectionLocation

Where in the outbound request the secret value may be substituted.

class ManagedAgentsEnvironmentVariableUpdateParams { $type = 'environment_variable'; $injectionLocation; $networking; $secretValue; }
"environment_variable" type
?ManagedAgentsInjectionLocationUpdateParams injectionLocation

Updated injection location.

?ManagedAgentsCredentialNetworkingParams networking

The new networking scope, which replaces the stored one as a whole.

?string secretValue

The new secret value to replace the stored one.

class ManagedAgentsInjectionLocationParams { $body; $header; }
?bool body

Substitute when the placeholder appears in the request body.

?bool header

Substitute when the placeholder appears in a request header value.

class ManagedAgentsInjectionLocationResponse { $body; $header; }
bool body

Whether the placeholder is substituted in the request body.

bool header

Whether the placeholder is substituted in request header values.

class ManagedAgentsInjectionLocationUpdateParams { $body; $header; }
?bool body

Substitute when the placeholder appears in the request body.

?bool header

Substitute when the placeholder appears in a request header value.

class ManagedAgentsLimitedCredentialNetworkingParams { $type = 'limited'; $allowedHosts; }
"limited" type
list<string> allowedHosts

The destination hosts of the outbound requests that the credential's secret is substituted into.

Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *. wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.

class ManagedAgentsLimitedCredentialNetworkingResponse { $type = 'limited'; $allowedHosts; }
"limited" type
list<string> allowedHosts

The destination hosts of the outbound requests that the credential's secret is substituted into.

An entry matches the request host exactly. An entry such as *.example.com matches any subdomain of example.com but not example.com itself.

class ManagedAgentsMCPOAuthAuthResponse { $type = 'mcp_oauth'; $mcpServerURL; $expiresAt; $refresh; }
"mcp_oauth" type
string mcpServerURL

URL of the MCP server this credential authenticates against.

?\Datetime expiresAt

When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.

?ManagedAgentsMCPOAuthRefreshResponse refresh

Refresh token configuration, if the credential supports token refresh.

class ManagedAgentsMCPOAuthCreateParams { $type = 'mcp_oauth'; $accessToken; $mcpServerURL; /* 2 more */ }
"mcp_oauth" type
string accessToken

The OAuth access token to send to the MCP server.

string mcpServerURL

URL of the MCP server this credential authenticates against.

?\Datetime expiresAt

When access_token expires, in RFC 3339.

Must be in the future.

?ManagedAgentsMCPOAuthRefreshParams refresh

Refresh token configuration, if the credential supports token refresh.

class ManagedAgentsMCPOAuthRefreshParams { $clientID; $refreshToken; $tokenEndpoint; /* 3 more */ }
string clientID

The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created.

string refreshToken

The OAuth refresh token that the API uses to get a new access token when the current one expires.

string tokenEndpoint

Token endpoint URL used to refresh the access token.

TokenEndpointAuth tokenEndpointAuth
?string resource

OAuth resource indicator.

?string scope

OAuth scope for the refresh request.

class ManagedAgentsMCPOAuthRefreshResponse { $clientID; $tokenEndpoint; $tokenEndpointAuth; /* 2 more */ }
string clientID

The OAuth client ID used when refreshing the access token.

string tokenEndpoint

Token endpoint URL used to refresh the access token.

TokenEndpointAuth tokenEndpointAuth
?string resource

OAuth resource indicator.

?string scope

OAuth scope for the refresh request.

class ManagedAgentsMCPOAuthRefreshUpdateParams { $refreshToken; $scope; $tokenEndpointAuth; }
?string refreshToken

The new OAuth refresh token to replace the stored one.

?string scope

The new OAuth scope for refresh requests. Send an empty string to clear the stored scope.

?TokenEndpointAuth tokenEndpointAuth
class ManagedAgentsMCPOAuthUpdateParams { $type = 'mcp_oauth'; $accessToken; $expiresAt; $refresh; }
"mcp_oauth" type
?string accessToken

The new OAuth access token to replace the stored one.

?\Datetime expiresAt

When the credential's access token expires, in RFC 3339. Leave it out to keep the stored expiry.

If you send a new access_token, send its expires_at too, or the new token keeps the old expiry.

Must be in the future.

?ManagedAgentsMCPOAuthRefreshUpdateParams refresh

Updated refresh token configuration.

class ManagedAgentsMCPProbe { $httpResponse; $method; }
?ManagedAgentsRefreshHTTPResponse httpResponse

The HTTP error response from the MCP server, or null if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure.

string method

The MCP method that failed (for example initialize or tools/list).

class ManagedAgentsRefreshHTTPResponse { $body; $bodyTruncated; $contentType; $statusCode; }
string body

Response body. May be truncated and has sensitive values scrubbed.

bool bodyTruncated

Whether body was truncated.

string contentType

Value of the Content-Type response header.

int statusCode

HTTP status code.

class ManagedAgentsRefreshObject { $httpResponse; $status; }
?ManagedAgentsRefreshHTTPResponse httpResponse

The captured HTTP error response from the token endpoint. Populated only when status is failed.

Status status

Outcome of the refresh attempt.

class ManagedAgentsStaticBearerAuthResponse { $type = 'static_bearer'; $mcpServerURL; }
"static_bearer" type
string mcpServerURL

URL of the MCP server this credential authenticates against.

class ManagedAgentsStaticBearerCreateParams { $type = 'static_bearer'; $token; $mcpServerURL; }
"static_bearer" type
string token

The static bearer token to send to the MCP server, such as an API key or personal access token.

string mcpServerURL

URL of the MCP server this credential authenticates against.

class ManagedAgentsStaticBearerUpdateParams { $type = 'static_bearer'; $token; }
"static_bearer" type
?string token

The new static bearer token to replace the stored one.

class ManagedAgentsTokenEndpointAuthBasicParam { $type = 'client_secret_basic'; $clientSecret; }
"client_secret_basic" type
string clientSecret

The OAuth client secret, sent to token_endpoint with HTTP Basic authentication.

class ManagedAgentsTokenEndpointAuthBasicResponse { $type = 'client_secret_basic'; }
"client_secret_basic" type
class ManagedAgentsTokenEndpointAuthBasicUpdateParam { $type = 'client_secret_basic'; $clientSecret; }
"client_secret_basic" type
?string clientSecret

A new OAuth client secret to replace the stored one.

The credential must already use client_secret_basic or client_secret_post. It keeps its current token_endpoint_auth type, even if the type sent with this secret is the other one.

class ManagedAgentsTokenEndpointAuthNoneParam { $type = 'none'; }
"none" type
class ManagedAgentsTokenEndpointAuthNoneResponse { $type = 'none'; }
"none" type
class ManagedAgentsTokenEndpointAuthPostParam { $type = 'client_secret_post'; $clientSecret; }
"client_secret_post" type
string clientSecret

The OAuth client secret, sent to token_endpoint in the POST body.

class ManagedAgentsTokenEndpointAuthPostResponse { $type = 'client_secret_post'; }
"client_secret_post" type
class ManagedAgentsTokenEndpointAuthPostUpdateParam { $type = 'client_secret_post'; $clientSecret; }
"client_secret_post" type
?string clientSecret

A new OAuth client secret to replace the stored one.

The credential must already use client_secret_basic or client_secret_post. It keeps its current token_endpoint_auth type, even if the type sent with this secret is the other one.

class ManagedAgentsUnrestrictedCredentialNetworkingParams { $type = 'unrestricted'; }
"unrestricted" type
class ManagedAgentsUnrestrictedCredentialNetworkingResponse { $type = 'unrestricted'; }
"unrestricted" type