Kredensial

Buat Kredensial

beta.vaults.credentials.create(vault_id, **kwargs) -> BetaManagedAgentsCredential

POST/v1/vaults/{vault_id}/credentials

Daftar Kredensial

beta.vaults.credentials.list(vault_id, **kwargs) -> PageCursor<BetaManagedAgentsCredential>

GET/v1/vaults/{vault_id}/credentials

Dapatkan Kredensial

beta.vaults.credentials.retrieve(credential_id, **kwargs) -> BetaManagedAgentsCredential

GET/v1/vaults/{vault_id}/credentials/{credential_id}

Perbarui Kredensial

beta.vaults.credentials.update(credential_id, **kwargs) -> BetaManagedAgentsCredential

POST/v1/vaults/{vault_id}/credentials/{credential_id}

Hapus Kredensial

beta.vaults.credentials.delete(credential_id, **kwargs) -> BetaManagedAgentsDeletedCredential

DELETE/v1/vaults/{vault_id}/credentials/{credential_id}

Arsipkan Kredensial

beta.vaults.credentials.archive(credential_id, **kwargs) -> BetaManagedAgentsCredential

POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive

Validasi Kredensial

beta.vaults.credentials.mcp_oauth_validate(credential_id, **kwargs) -> BetaManagedAgentsCredentialValidation

POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate

Models

class BetaManagedAgentsCredential { type: :vault_credential, id, archived_at, 6 more }

A credential stored in a vault. Sensitive fields are never returned in responses.

type BetaManagedAgentsCredentialNetworkingParams = BetaManagedAgentsUnrestrictedCredentialNetworkingParams | BetaManagedAgentsLimitedCredentialNetworkingParams

One of the following:

class BetaManagedAgentsUnrestrictedCredentialNetworkingParams { type: :unrestricted }

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

type: :unrestricted

class BetaManagedAgentsLimitedCredentialNetworkingParams { type: :limited, allowed_hosts }

Substitute the secret only on requests to the listed hosts.

type: :limited

allowed_hosts: Array[String]

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

class BetaManagedAgentsCredentialValidation { type: :vault_credential_validation, credential_id, has_refresh_token, 5 more }

Result of live-probing a credential against its configured MCP server.

type BetaManagedAgentsCredentialValidationStatus = :valid | :invalid | :unknown

Overall verdict of a credential validation probe.

One of the following:

:valid

The credential successfully authenticated against its MCP server.

:invalid

The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.

:unknown

The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.

class BetaManagedAgentsDeletedCredential { type: :vault_credential_deleted, id }

Confirmation of a deleted credential.

type: :vault_credential_deleted

id: String

Unique identifier of the deleted credential.

class BetaManagedAgentsEnvironmentVariableAuthResponse { type: :environment_variable, injection_location, networking, secret_name }

Environment variable credential details. The secret value is never returned.

class BetaManagedAgentsEnvironmentVariableCreateParams { type: :environment_variable, networking, secret_name, 2 more }

Parameters for creating an environment variable credential.

class BetaManagedAgentsEnvironmentVariableUpdateParams { type: :environment_variable, injection_location, networking, secret_value }

Parameters for updating an environment variable credential. secret_name is immutable.

class BetaManagedAgentsInjectionLocationParams { body, header }

Where in the outbound request the secret value may be substituted.

body: bool

Substitute when the placeholder appears in the request body.

class BetaManagedAgentsInjectionLocationResponse { body, header }

Where in the outbound request the secret value is substituted.

body: bool

Whether the placeholder is substituted in the request body.

class BetaManagedAgentsInjectionLocationUpdateParams { body, header }

Updated injection location.

body: bool

Substitute when the placeholder appears in the request body.

class BetaManagedAgentsLimitedCredentialNetworkingParams { type: :limited, allowed_hosts }

Substitute the secret only on requests to the listed hosts.

type: :limited

allowed_hosts: Array[String]

class BetaManagedAgentsLimitedCredentialNetworkingResponse { type: :limited, allowed_hosts }

The secret is substituted only on requests to the listed hosts.

type: :limited

allowed_hosts: Array[String]

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

class BetaManagedAgentsMCPOAuthAuthResponse { type: :mcp_oauth, mcp_server_url, expires_at, refresh }

OAuth credential details for an MCP server.

type: :mcp_oauth

mcp_server_url: String

URL of the MCP server this credential authenticates against.

expires_at: Time

A timestamp in RFC 3339 format

formatdate-time

refresh: BetaManagedAgentsMCPOAuthRefreshResponse { client_id, token_endpoint, token_endpoint_auth, 2 more }

Refresh token configuration, if the credential supports token refresh.

class BetaManagedAgentsMCPOAuthCreateParams { type: :mcp_oauth, access_token, mcp_server_url, 2 more }

Parameters for creating an MCP OAuth credential.

type: :mcp_oauth

access_token: String

OAuth access token.

minLength1

maxLength8192

mcp_server_url: String

URL of the MCP server this credential authenticates against.

minLength1

maxLength2047

expires_at: Time

A timestamp in RFC 3339 format

formatdate-time

refresh: BetaManagedAgentsMCPOAuthRefreshParams { client_id, refresh_token, token_endpoint, 3 more }

Refresh token configuration, if the credential supports token refresh.

class BetaManagedAgentsMCPOAuthRefreshParams { client_id, refresh_token, token_endpoint, 3 more }

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMCPOAuthRefreshResponse { client_id, token_endpoint, token_endpoint_auth, 2 more }

OAuth refresh token configuration returned in credential responses.

class BetaManagedAgentsMCPOAuthRefreshUpdateParams { refresh_token, scope, token_endpoint_auth }

Parameters for updating OAuth refresh token configuration.

class BetaManagedAgentsMCPOAuthUpdateParams { type: :mcp_oauth, access_token, expires_at, refresh }

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

type: :mcp_oauth

access_token: String

Updated OAuth access token.

minLength1

maxLength8192

expires_at: Time

A timestamp in RFC 3339 format

formatdate-time

refresh: BetaManagedAgentsMCPOAuthRefreshUpdateParams { refresh_token, scope, token_endpoint_auth }

Updated refresh token configuration.

class BetaManagedAgentsMCPProbe { http_response, method_ }

The failing step of an MCP validation probe.

http_response: BetaManagedAgentsRefreshHTTPResponse { body, body_truncated, content_type, status_code }

The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).

body: String

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: String

Value of the Content-Type response header.

status_code: Integer

HTTP status code.

formatint32

method_: String

The MCP method that failed (for example initialize or tools/list).

class BetaManagedAgentsRefreshHTTPResponse { body, body_truncated, content_type, status_code }

An HTTP response captured during a credential validation probe.

body: String

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: String

Value of the Content-Type response header.

status_code: Integer

HTTP status code.

formatint32

class BetaManagedAgentsRefreshObject { http_response, status }

Outcome of a refresh-token exchange attempted during credential validation.

http_response: BetaManagedAgentsRefreshHTTPResponse { body, body_truncated, content_type, status_code }

The captured HTTP error response from the token endpoint. Populated only when status is failed.

body: String

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: String

Value of the Content-Type response header.

status_code: Integer

HTTP status code.

formatint32

status: :succeeded | :failed | :connect_error | :no_refresh_token

Outcome of the refresh attempt.

One of the following:

:succeeded

The token endpoint returned a new access token.

:failed

The token endpoint returned an error response. See http_response for detail.

:connect_error

The token endpoint could not be reached (DNS, TLS, or connection error).

:no_refresh_token

No refresh token is stored for the credential, so no exchange was attempted.

class BetaManagedAgentsStaticBearerAuthResponse { type: :static_bearer, mcp_server_url }

Static bearer token credential details for an MCP server.

type: :static_bearer

mcp_server_url: String

URL of the MCP server this credential authenticates against.

class BetaManagedAgentsStaticBearerCreateParams { type: :static_bearer, token, mcp_server_url }

Parameters for creating a static bearer token credential.

type: :static_bearer

token: String

Static bearer token value.

minLength1

maxLength8192

mcp_server_url: String

URL of the MCP server this credential authenticates against.

minLength1

maxLength2047

class BetaManagedAgentsStaticBearerUpdateParams { type: :static_bearer, token }

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

type: :static_bearer

token: String

Updated static bearer token value.

minLength1

maxLength8192

class BetaManagedAgentsTokenEndpointAuthBasicParam { type: :client_secret_basic, client_secret }

Token endpoint uses HTTP Basic authentication with client credentials.

type: :client_secret_basic

client_secret: String

OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthBasicResponse { type: :client_secret_basic }

Token endpoint uses HTTP Basic authentication with client credentials.

type: :client_secret_basic

class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam { type: :client_secret_basic, client_secret }

Updated HTTP Basic authentication parameters for the token endpoint.

type: :client_secret_basic

client_secret: String

Updated OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthNoneParam { type: :none }

Token endpoint requires no client authentication.

type: :none

class BetaManagedAgentsTokenEndpointAuthNoneResponse { type: :none }

Token endpoint requires no client authentication.

type: :none

class BetaManagedAgentsTokenEndpointAuthPostParam { type: :client_secret_post, client_secret }

Token endpoint uses POST body authentication with client credentials.

type: :client_secret_post

client_secret: String

OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsTokenEndpointAuthPostResponse { type: :client_secret_post }

Token endpoint uses POST body authentication with client credentials.

type: :client_secret_post

class BetaManagedAgentsTokenEndpointAuthPostUpdateParam { type: :client_secret_post, client_secret }

Updated POST body authentication parameters for the token endpoint.

type: :client_secret_post

client_secret: String

Updated OAuth client secret.

minLength1

maxLength512

class BetaManagedAgentsUnrestrictedCredentialNetworkingParams { type: :unrestricted }

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

type: :unrestricted

class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse { type: :unrestricted }

The secret is substituted on any host the session's Environment network policy permits egress to.

type: :unrestricted