Identifiants

Créer un identifiant

BetaManagedAgentsCredential beta().vaults().credentials().create(params, requestOptions = RequestOptions.none())

POST/v1/vaults/{vault_id}/credentials

Lister les identifiants

CredentialListPage beta().vaults().credentials().list(params = CredentialListParams.none(), requestOptions = RequestOptions.none())

GET/v1/vaults/{vault_id}/credentials

Obtenir un identifiant

BetaManagedAgentsCredential beta().vaults().credentials().retrieve(params, requestOptions = RequestOptions.none())

GET/v1/vaults/{vault_id}/credentials/{credential_id}

Mettre à jour un identifiant

BetaManagedAgentsCredential beta().vaults().credentials().update(params, requestOptions = RequestOptions.none())

POST/v1/vaults/{vault_id}/credentials/{credential_id}

Supprimer un identifiant

BetaManagedAgentsDeletedCredential beta().vaults().credentials().delete(params, requestOptions = RequestOptions.none())

DELETE/v1/vaults/{vault_id}/credentials/{credential_id}

Archiver un identifiant

BetaManagedAgentsCredential beta().vaults().credentials().archive(params, requestOptions = RequestOptions.none())

POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive

Valider un identifiant

BetaManagedAgentsCredentialValidation beta().vaults().credentials().mcpOAuthValidate(params, requestOptions = RequestOptions.none())

POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate

Models

class BetaManagedAgentsCredential { type; id; archivedAt; /* 6 more */ }

A credential stored in a vault. Sensitive fields are never returned in responses.

class BetaManagedAgentsCredentialNetworkingParams: union

class BetaManagedAgentsUnrestrictedCredentialNetworkingParams { type; }

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type type

class BetaManagedAgentsLimitedCredentialNetworkingParams { type; allowedHosts; }

Substitute the secret only on requests to the listed hosts.

Type type

List<String> allowedHosts

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

class BetaManagedAgentsCredentialValidation { type; credentialId; hasRefreshToken; /* 5 more */ }

Result of live-probing a credential against its configured MCP server.

enum BetaManagedAgentsCredentialValidationStatus

Overall verdict of a credential validation probe.

VALID("valid")

The credential successfully authenticated against its MCP server.

INVALID("invalid")

The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.

UNKNOWN("unknown")

The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.

class BetaManagedAgentsDeletedCredential { type; id; }

Confirmation of a deleted credential.

Type type

String id

Unique identifier of the deleted credential.

class BetaManagedAgentsEnvironmentVariableAuthResponse { type; injectionLocation; networking; secretName; }

Environment variable credential details. The secret value is never returned.

class BetaManagedAgentsEnvironmentVariableCreateParams { type; networking; secretName; /* 2 more */ }

Parameters for creating an environment variable credential.

class BetaManagedAgentsEnvironmentVariableUpdateParams { type; injectionLocation; networking; secretValue; }

Parameters for updating an environment variable credential. secret_name is immutable.

class BetaManagedAgentsInjectionLocationParams { body; header; }

Where in the outbound request the secret value may be substituted.

Optional<Boolean> body

Substitute when the placeholder appears in the request body.

class BetaManagedAgentsInjectionLocationResponse { body; header; }

Where in the outbound request the secret value is substituted.

boolean body

Whether the placeholder is substituted in the request body.

class BetaManagedAgentsInjectionLocationUpdateParams { body; header; }

Updated injection location.

Optional<Boolean> body

Substitute when the placeholder appears in the request body.

class BetaManagedAgentsLimitedCredentialNetworkingParams { type; allowedHosts; }

Substitute the secret only on requests to the listed hosts.

Type type

List<String> allowedHosts

class BetaManagedAgentsLimitedCredentialNetworkingResponse { type; allowedHosts; }

The secret is substituted only on requests to the listed hosts.

Type type

List<String> allowedHosts

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

class BetaManagedAgentsMcpOAuthAuthResponse { type; mcpServerUrl; expiresAt; refresh; }

OAuth credential details for an MCP server.

Type type

String mcpServerUrl

URL of the MCP server this credential authenticates against.

Optional<LocalDateTime> expiresAt

A timestamp in RFC 3339 format

formatdate-time

Optional<BetaManagedAgentsMcpOAuthRefreshResponse> refresh

Refresh token configuration, if the credential supports token refresh.

class BetaManagedAgentsMcpOAuthCreateParams { type; accessToken; mcpServerUrl; /* 2 more */ }

Parameters for creating an MCP OAuth credential.

Type type

String accessToken

OAuth access token.

minLength1

maxLength8192

String mcpServerUrl

URL of the MCP server this credential authenticates against.

minLength1

maxLength2047

Optional<LocalDateTime> expiresAt

A timestamp in RFC 3339 format

formatdate-time

Optional<BetaManagedAgentsMcpOAuthRefreshParams> refresh

Refresh token configuration, if the credential supports token refresh.

class BetaManagedAgentsMcpOAuthRefreshParams { clientId; refreshToken; tokenEndpoint; /* 3 more */ }

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMcpOAuthRefreshResponse { clientId; tokenEndpoint; tokenEndpointAuth; /* 2 more */ }

OAuth refresh token configuration returned in credential responses.

class BetaManagedAgentsMcpOAuthRefreshUpdateParams { refreshToken; scope; tokenEndpointAuth; }

Parameters for updating OAuth refresh token configuration.

Optional<String> refreshToken

Updated OAuth refresh token.

minLength1

maxLength8192

Optional<String> scope

Updated OAuth scope for the refresh request.

maxLength8192

Optional<TokenEndpointAuth> tokenEndpointAuth

One of the following:

class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam { type; clientSecret; }

Updated HTTP Basic authentication parameters for the token endpoint.

Type type

Optional<String> clientSecret

Updated OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthPostUpdateParam { type; clientSecret; }

Updated POST body authentication parameters for the token endpoint.

Type type

Optional<String> clientSecret

Updated OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsMcpOAuthUpdateParams { type; accessToken; expiresAt; refresh; }

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

class BetaManagedAgentsMcpProbe { httpResponse; method; }

The failing step of an MCP validation probe.

Optional<BetaManagedAgentsRefreshHttpResponse> httpResponse

The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).

String body

Response body. May be truncated and has sensitive values scrubbed.

boolean bodyTruncated

Whether body was truncated.

String contentType

Value of the Content-Type response header.

long statusCode

HTTP status code.

formatint32

String method

The MCP method that failed (for example initialize or tools/list).

class BetaManagedAgentsRefreshHttpResponse { body; bodyTruncated; contentType; statusCode; }

An HTTP response captured during a credential validation probe.

String body

Response body. May be truncated and has sensitive values scrubbed.

boolean bodyTruncated

Whether body was truncated.

String contentType

Value of the Content-Type response header.

long statusCode

HTTP status code.

formatint32

class BetaManagedAgentsRefreshObject { httpResponse; status; }

Outcome of a refresh-token exchange attempted during credential validation.

Optional<BetaManagedAgentsRefreshHttpResponse> httpResponse

The captured HTTP error response from the token endpoint. Populated only when status is failed.

String body

Response body. May be truncated and has sensitive values scrubbed.

boolean bodyTruncated

Whether body was truncated.

String contentType

Value of the Content-Type response header.

long statusCode

HTTP status code.

formatint32

Status status

Outcome of the refresh attempt.

One of the following:

SUCCEEDED("succeeded")

The token endpoint returned a new access token.

FAILED("failed")

The token endpoint returned an error response. See http_response for detail.

CONNECT_ERROR("connect_error")

The token endpoint could not be reached (DNS, TLS, or connection error).

NO_REFRESH_TOKEN("no_refresh_token")

No refresh token is stored for the credential, so no exchange was attempted.

class BetaManagedAgentsStaticBearerAuthResponse { type; mcpServerUrl; }

Static bearer token credential details for an MCP server.

Type type

String mcpServerUrl

URL of the MCP server this credential authenticates against.

class BetaManagedAgentsStaticBearerCreateParams { type; token; mcpServerUrl; }

Parameters for creating a static bearer token credential.

Type type

String token

Static bearer token value.

minLength1

maxLength8192

String mcpServerUrl

URL of the MCP server this credential authenticates against.

minLength1

maxLength2047

class BetaManagedAgentsStaticBearerUpdateParams { type; token; }

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

Type type

Optional<String> token

Updated static bearer token value.

minLength1

maxLength8192

class BetaManagedAgentsTokenEndpointAuthBasicParam { type; clientSecret; }

Token endpoint uses HTTP Basic authentication with client credentials.

Type type

String clientSecret

OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthBasicResponse { type; }

Token endpoint uses HTTP Basic authentication with client credentials.

Type type

class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam { type; clientSecret; }

Updated HTTP Basic authentication parameters for the token endpoint.

Type type

Optional<String> clientSecret

Updated OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthNoneParam { type; }

Token endpoint requires no client authentication.

Type type

class BetaManagedAgentsTokenEndpointAuthNoneResponse { type; }

Token endpoint requires no client authentication.

Type type

class BetaManagedAgentsTokenEndpointAuthPostParam { type; clientSecret; }

Token endpoint uses POST body authentication with client credentials.

Type type

String clientSecret

OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthPostResponse { type; }

Token endpoint uses POST body authentication with client credentials.

Type type

class BetaManagedAgentsTokenEndpointAuthPostUpdateParam { type; clientSecret; }

Updated POST body authentication parameters for the token endpoint.

Type type

Optional<String> clientSecret

Updated OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsUnrestrictedCredentialNetworkingParams { type; }

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type type

class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse { type; }

The secret is substituted on any host the session's Environment network policy permits egress to.

Type type