Claude Platform Docs

Credenciales

Crear credencial
$client->beta->vaults->credentials->create(string vaultID, Auth auth, ?string displayName, ?array<string,string> metadata, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials
Listar credenciales
$client->beta->vaults->credentials->list(string vaultID, ?bool includeArchived, ?int limit, ?string page, ?list<AnthropicBeta> betas, ?string workspaceID): PageCursor<ManagedAgentsCredential>
GET/v1/vaults/{vault_id}/credentials
Obtener credencial
$client->beta->vaults->credentials->retrieve(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
GET/v1/vaults/{vault_id}/credentials/{credential_id}
Actualizar credencial
$client->beta->vaults->credentials->update(string credentialID, string vaultID, ?Auth auth, ?string displayName, ?array<string,string> metadata, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}
Eliminar credencial
$client->beta->vaults->credentials->delete(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsDeletedCredential
DELETE/v1/vaults/{vault_id}/credentials/{credential_id}
Archivar credencial
$client->beta->vaults->credentials->archive(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive
Validar credencial
$client->beta->vaults->credentials->mcpOAuthValidate(string credentialID, string vaultID, ?list<AnthropicBeta> betas, ?string workspaceID): ManagedAgentsCredentialValidation
POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate
Models
class ManagedAgentsCredential { $type; $id; $archivedAt; /* 6 more */ }
Type type
string id

Unique identifier for the credential.

?\Datetime archivedAt

A timestamp in RFC 3339 format

Auth auth

Authentication details for a credential.

\Datetime createdAt

A timestamp in RFC 3339 format

array<string,string> metadata

Arbitrary key-value metadata attached to the credential.

\Datetime updatedAt

A timestamp in RFC 3339 format

string vaultID

Identifier of the vault this credential belongs to.

?string displayName

Human-readable name for the credential.

class ManagedAgentsCredentialNetworkingParams
One of the following:
class ManagedAgentsUnrestrictedCredentialNetworkingParams { $type; }
Type type
class ManagedAgentsLimitedCredentialNetworkingParams { $type; $allowedHosts; }
Type type
list<string> allowedHosts

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

class ManagedAgentsCredentialValidation { $type; $credentialID; $hasRefreshToken; /* 5 more */ }
Type type
string credentialID

Unique identifier of the credential that was validated.

bool hasRefreshToken

Whether the credential has a refresh token configured.

?ManagedAgentsMCPProbe mcpProbe

The failing step of an MCP validation probe.

?ManagedAgentsRefreshObject refresh

Outcome of a refresh-token exchange attempted during credential validation.

ManagedAgentsCredentialValidationStatus status

Overall verdict of a credential validation probe.

\Datetime validatedAt

A timestamp in RFC 3339 format

string vaultID

Identifier of the vault containing the credential.

enum ManagedAgentsCredentialValidationStatus
One of the following:
"valid"
"invalid"
"unknown"
class ManagedAgentsDeletedCredential { $type; $id; }
Type type
string id

Unique identifier of the deleted credential.

class ManagedAgentsEnvironmentVariableAuthResponse { $type; $injectionLocation; $networking; $secretName; }
Type type
ManagedAgentsInjectionLocationResponse injectionLocation

Where in the outbound request the secret value is substituted.

Networking networking

Outbound hosts the secret value is substituted on.

string secretName

Name of the environment variable.

class ManagedAgentsEnvironmentVariableCreateParams { $type; $networking; $secretName; /* 2 more */ }
Type type
ManagedAgentsCredentialNetworkingParams networking

Outbound hosts the secret value is substituted on.

string secretName

Name of the environment variable. Immutable after create.

string secretValue

Secret value. Write-only; never returned in responses.

?ManagedAgentsInjectionLocationParams injectionLocation

Where in the outbound request the secret value may be substituted.

class ManagedAgentsEnvironmentVariableUpdateParams { $type; $injectionLocation; $networking; $secretValue; }
Type type
?ManagedAgentsInjectionLocationUpdateParams injectionLocation

Updated injection location.

?ManagedAgentsCredentialNetworkingParams networking

Updated networking scope. Full replacement.

?string secretValue

Updated secret value.

class ManagedAgentsInjectionLocationParams { $body; $header; }
?bool body

Substitute when the placeholder appears in the request body.

?bool header

Substitute when the placeholder appears in a request header value.

class ManagedAgentsInjectionLocationResponse { $body; $header; }
bool body

Whether the placeholder is substituted in the request body.

bool header

Whether the placeholder is substituted in request header values.

class ManagedAgentsInjectionLocationUpdateParams { $body; $header; }
?bool body

Substitute when the placeholder appears in the request body.

?bool header

Substitute when the placeholder appears in a request header value.

class ManagedAgentsLimitedCredentialNetworkingParams { $type; $allowedHosts; }
Type type
list<string> allowedHosts

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

class ManagedAgentsLimitedCredentialNetworkingResponse { $type; $allowedHosts; }
Type type
list<string> allowedHosts

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

class ManagedAgentsMCPOAuthAuthResponse { $type; $mcpServerURL; $expiresAt; $refresh; }
Type type
string mcpServerURL

URL of the MCP server this credential authenticates against.

?\Datetime expiresAt

A timestamp in RFC 3339 format

?ManagedAgentsMCPOAuthRefreshResponse refresh

OAuth refresh token configuration returned in credential responses.

class ManagedAgentsMCPOAuthCreateParams { $type; $accessToken; $mcpServerURL; /* 2 more */ }
Type type
string accessToken

OAuth access token.

string mcpServerURL

URL of the MCP server this credential authenticates against.

?\Datetime expiresAt

A timestamp in RFC 3339 format

?ManagedAgentsMCPOAuthRefreshParams refresh

OAuth refresh token parameters for creating a credential with refresh support.

class ManagedAgentsMCPOAuthRefreshParams { $clientID; $refreshToken; $tokenEndpoint; /* 3 more */ }
string clientID

OAuth client ID.

string refreshToken

OAuth refresh token.

string tokenEndpoint

Token endpoint URL used to refresh the access token.

TokenEndpointAuth tokenEndpointAuth
?string resource

OAuth resource indicator.

?string scope

OAuth scope for the refresh request.

class ManagedAgentsMCPOAuthRefreshResponse { $clientID; $tokenEndpoint; $tokenEndpointAuth; /* 2 more */ }
string clientID

OAuth client ID.

string tokenEndpoint

Token endpoint URL used to refresh the access token.

TokenEndpointAuth tokenEndpointAuth
?string resource

OAuth resource indicator.

?string scope

OAuth scope for the refresh request.

class ManagedAgentsMCPOAuthRefreshUpdateParams { $refreshToken; $scope; $tokenEndpointAuth; }
?string refreshToken

Updated OAuth refresh token.

?string scope

Updated OAuth scope for the refresh request.

?TokenEndpointAuth tokenEndpointAuth
class ManagedAgentsMCPOAuthUpdateParams { $type; $accessToken; $expiresAt; $refresh; }
Type type
?string accessToken

Updated OAuth access token.

?\Datetime expiresAt

A timestamp in RFC 3339 format

?ManagedAgentsMCPOAuthRefreshUpdateParams refresh

Parameters for updating OAuth refresh token configuration.

class ManagedAgentsMCPProbe { $httpResponse; $method; }
?ManagedAgentsRefreshHTTPResponse httpResponse

An HTTP response captured during a credential validation probe.

string method

The MCP method that failed (for example initialize or tools/list).

class ManagedAgentsRefreshHTTPResponse { $body; $bodyTruncated; $contentType; $statusCode; }
string body

Response body. May be truncated and has sensitive values scrubbed.

bool bodyTruncated

Whether body was truncated.

string contentType

Value of the Content-Type response header.

int statusCode

HTTP status code.

class ManagedAgentsRefreshObject { $httpResponse; $status; }
?ManagedAgentsRefreshHTTPResponse httpResponse

An HTTP response captured during a credential validation probe.

Status status

Outcome of a refresh-token exchange attempted during credential validation.

class ManagedAgentsStaticBearerAuthResponse { $type; $mcpServerURL; }
Type type
string mcpServerURL

URL of the MCP server this credential authenticates against.

class ManagedAgentsStaticBearerCreateParams { $type; $token; $mcpServerURL; }
Type type
string token

Static bearer token value.

string mcpServerURL

URL of the MCP server this credential authenticates against.

class ManagedAgentsStaticBearerUpdateParams { $type; $token; }
Type type
?string token

Updated static bearer token value.

class ManagedAgentsTokenEndpointAuthBasicParam { $type; $clientSecret; }
Type type
string clientSecret

OAuth client secret.

class ManagedAgentsTokenEndpointAuthBasicResponse { $type; }
Type type
class ManagedAgentsTokenEndpointAuthBasicUpdateParam { $type; $clientSecret; }
Type type
?string clientSecret

Updated OAuth client secret.

class ManagedAgentsTokenEndpointAuthNoneParam { $type; }
Type type
class ManagedAgentsTokenEndpointAuthNoneResponse { $type; }
Type type
class ManagedAgentsTokenEndpointAuthPostParam { $type; $clientSecret; }
Type type
string clientSecret

OAuth client secret.

class ManagedAgentsTokenEndpointAuthPostResponse { $type; }
Type type
class ManagedAgentsTokenEndpointAuthPostUpdateParam { $type; $clientSecret; }
Type type
?string clientSecret

Updated OAuth client secret.

class ManagedAgentsUnrestrictedCredentialNetworkingParams { $type; }
Type type
class ManagedAgentsUnrestrictedCredentialNetworkingResponse { $type; }
Type type