Claude Platform Docs

Credentials

Create Credential
beta.vaults.credentials.create(strvault_id, CredentialCreateParams**kwargs) -> BetaManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials
List Credentials
beta.vaults.credentials.list(strvault_id, CredentialListParams**kwargs) -> SyncPageCursor[BetaManagedAgentsCredential]
GET/v1/vaults/{vault_id}/credentials
Get Credential
beta.vaults.credentials.retrieve(strcredential_id, CredentialRetrieveParams**kwargs) -> BetaManagedAgentsCredential
GET/v1/vaults/{vault_id}/credentials/{credential_id}
Update Credential
beta.vaults.credentials.update(strcredential_id, CredentialUpdateParams**kwargs) -> BetaManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}
Delete Credential
beta.vaults.credentials.delete(strcredential_id, CredentialDeleteParams**kwargs) -> BetaManagedAgentsDeletedCredential
DELETE/v1/vaults/{vault_id}/credentials/{credential_id}
Archive Credential
beta.vaults.credentials.archive(strcredential_id, CredentialArchiveParams**kwargs) -> BetaManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive
Validate Credential
beta.vaults.credentials.mcp_oauth_validate(strcredential_id, CredentialMCPOAuthValidateParams**kwargs) -> BetaManagedAgentsCredentialValidation
POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate
Models
class BetaManagedAgentsCredential: …

A credential stored in a vault. Sensitive fields are never returned in responses.

BetaManagedAgentsCredentialNetworkingParams

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

One of the following:
class BetaManagedAgentsUnrestrictedCredentialNetworkingParams: …

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

type: Literal["unrestricted"]
class BetaManagedAgentsLimitedCredentialNetworkingParams: …

Substitute the secret only on requests to the listed hosts.

allowed_hosts: List[str]

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

type: Literal["limited"]
class BetaManagedAgentsCredentialValidation: …

Result of live-probing a credential against its configured MCP server.

Literal["valid", "invalid", "unknown"]

Overall verdict of a credential validation probe.

One of the following:
"valid"
"invalid"
"unknown"
class BetaManagedAgentsDeletedCredential: …

Confirmation of a deleted credential.

id: str

Unique identifier of the deleted credential.

type: Literal["vault_credential_deleted"]
class BetaManagedAgentsEnvironmentVariableAuthResponse: …

Environment variable credential details. The secret value is never returned.

class BetaManagedAgentsEnvironmentVariableCreateParams: …

Parameters for creating an environment variable credential.

class BetaManagedAgentsEnvironmentVariableUpdateParams: …

Parameters for updating an environment variable credential. secret_name is immutable.

class BetaManagedAgentsInjectionLocationParams: …

Where in the outbound request the secret value may be substituted.

body: Optional[bool]

Substitute when the placeholder appears in the request body.

header: Optional[bool]

Substitute when the placeholder appears in a request header value.

class BetaManagedAgentsInjectionLocationResponse: …

Where in the outbound request the secret value is substituted.

body: bool

Whether the placeholder is substituted in the request body.

header: bool

Whether the placeholder is substituted in request header values.

class BetaManagedAgentsInjectionLocationUpdateParams: …

Updated injection location.

body: Optional[bool]

Substitute when the placeholder appears in the request body.

header: Optional[bool]

Substitute when the placeholder appears in a request header value.

class BetaManagedAgentsLimitedCredentialNetworkingParams: …

Substitute the secret only on requests to the listed hosts.

allowed_hosts: List[str]

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

type: Literal["limited"]
class BetaManagedAgentsLimitedCredentialNetworkingResponse: …

The secret is substituted only on requests to the listed hosts.

allowed_hosts: List[str]

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

type: Literal["limited"]
class BetaManagedAgentsMCPOAuthAuthResponse: …

OAuth credential details for an MCP server.

mcp_server_url: str

URL of the MCP server this credential authenticates against.

type: Literal["mcp_oauth"]
expires_at: Optional[datetime]

A timestamp in RFC 3339 format

formatdate-time
refresh: Optional[BetaManagedAgentsMCPOAuthRefreshResponse]

OAuth refresh token configuration returned in credential responses.

class BetaManagedAgentsMCPOAuthCreateParams: …

Parameters for creating an MCP OAuth credential.

access_token: str

OAuth access token.

minLength1
maxLength8192
mcp_server_url: str

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
type: Literal["mcp_oauth"]
expires_at: Optional[datetime]

A timestamp in RFC 3339 format

formatdate-time
refresh: Optional[BetaManagedAgentsMCPOAuthRefreshParams]

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMCPOAuthRefreshParams: …

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMCPOAuthRefreshResponse: …

OAuth refresh token configuration returned in credential responses.

class BetaManagedAgentsMCPOAuthRefreshUpdateParams: …

Parameters for updating OAuth refresh token configuration.

class BetaManagedAgentsMCPOAuthUpdateParams: …

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

type: Literal["mcp_oauth"]
access_token: Optional[str]

Updated OAuth access token.

minLength1
maxLength8192
expires_at: Optional[datetime]

A timestamp in RFC 3339 format

formatdate-time
refresh: Optional[BetaManagedAgentsMCPOAuthRefreshUpdateParams]

Parameters for updating OAuth refresh token configuration.

class BetaManagedAgentsMCPProbe: …

The failing step of an MCP validation probe.

http_response: Optional[BetaManagedAgentsRefreshHTTPResponse]

An HTTP response captured during a credential validation probe.

body: str

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: str

Value of the Content-Type response header.

status_code: int

HTTP status code.

formatint32
method: str

The MCP method that failed (for example initialize or tools/list).

class BetaManagedAgentsRefreshHTTPResponse: …

An HTTP response captured during a credential validation probe.

body: str

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: str

Value of the Content-Type response header.

status_code: int

HTTP status code.

formatint32
class BetaManagedAgentsRefreshObject: …

Outcome of a refresh-token exchange attempted during credential validation.

http_response: Optional[BetaManagedAgentsRefreshHTTPResponse]

An HTTP response captured during a credential validation probe.

body: str

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: str

Value of the Content-Type response header.

status_code: int

HTTP status code.

formatint32
status: Literal["succeeded", "failed", "connect_error", "no_refresh_token"]

Outcome of a refresh-token exchange attempted during credential validation.

One of the following:
"succeeded"
"failed"
"connect_error"
"no_refresh_token"
class BetaManagedAgentsStaticBearerAuthResponse: …

Static bearer token credential details for an MCP server.

mcp_server_url: str

URL of the MCP server this credential authenticates against.

type: Literal["static_bearer"]
class BetaManagedAgentsStaticBearerCreateParams: …

Parameters for creating a static bearer token credential.

token: str

Static bearer token value.

minLength1
maxLength8192
mcp_server_url: str

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
type: Literal["static_bearer"]
class BetaManagedAgentsStaticBearerUpdateParams: …

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

type: Literal["static_bearer"]
token: Optional[str]

Updated static bearer token value.

minLength1
maxLength8192
class BetaManagedAgentsTokenEndpointAuthBasicParam: …

Token endpoint uses HTTP Basic authentication with client credentials.

client_secret: str

OAuth client secret.

minLength1
maxLength512
type: Literal["client_secret_basic"]
class BetaManagedAgentsTokenEndpointAuthBasicResponse: …

Token endpoint uses HTTP Basic authentication with client credentials.

type: Literal["client_secret_basic"]
class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam: …

Updated HTTP Basic authentication parameters for the token endpoint.

type: Literal["client_secret_basic"]
client_secret: Optional[str]

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsTokenEndpointAuthNoneParam: …

Token endpoint requires no client authentication.

type: Literal["none"]
class BetaManagedAgentsTokenEndpointAuthNoneResponse: …

Token endpoint requires no client authentication.

type: Literal["none"]
class BetaManagedAgentsTokenEndpointAuthPostParam: …

Token endpoint uses POST body authentication with client credentials.

client_secret: str

OAuth client secret.

minLength1
maxLength512
type: Literal["client_secret_post"]
class BetaManagedAgentsTokenEndpointAuthPostResponse: …

Token endpoint uses POST body authentication with client credentials.

type: Literal["client_secret_post"]
class BetaManagedAgentsTokenEndpointAuthPostUpdateParam: …

Updated POST body authentication parameters for the token endpoint.

type: Literal["client_secret_post"]
client_secret: Optional[str]

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsUnrestrictedCredentialNetworkingParams: …

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

type: Literal["unrestricted"]
class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse: …

The secret is substituted on any host the session's Environment network policy permits egress to.

type: Literal["unrestricted"]