Claude Platform Docs

認証情報

認証情報を作成
client.Beta.Vaults.Credentials.New(ctx, vaultID, params) (*BetaManagedAgentsCredential, error)
POST/v1/vaults/{vault_id}/credentials
認証情報の一覧を取得
client.Beta.Vaults.Credentials.List(ctx, vaultID, params) (*PageCursor[BetaManagedAgentsCredential], error)
GET/v1/vaults/{vault_id}/credentials
認証情報を取得
client.Beta.Vaults.Credentials.Get(ctx, credentialID, params) (*BetaManagedAgentsCredential, error)
GET/v1/vaults/{vault_id}/credentials/{credential_id}
認証情報を更新
client.Beta.Vaults.Credentials.Update(ctx, credentialID, params) (*BetaManagedAgentsCredential, error)
POST/v1/vaults/{vault_id}/credentials/{credential_id}
認証情報を削除
client.Beta.Vaults.Credentials.Delete(ctx, credentialID, params) (*BetaManagedAgentsDeletedCredential, error)
DELETE/v1/vaults/{vault_id}/credentials/{credential_id}
認証情報をアーカイブ
client.Beta.Vaults.Credentials.Archive(ctx, credentialID, params) (*BetaManagedAgentsCredential, error)
POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive
認証情報を検証
client.Beta.Vaults.Credentials.MCPOAuthValidate(ctx, credentialID, params) (*BetaManagedAgentsCredentialValidation, error)
POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate
Models
type BetaManagedAgentsCredential struct { Type: "vault_credential"; ID; ArchivedAt; /* 6 more */ }

A credential stored in a vault. Sensitive fields are never returned in responses.

type BetaManagedAgentsCredentialNetworkingParamsUnion interface{…}
One of the following:
type BetaManagedAgentsUnrestrictedCredentialNetworkingParams struct { Type: "unrestricted" }

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsType
type BetaManagedAgentsLimitedCredentialNetworkingParams struct { Type: "limited"; AllowedHosts }

Substitute the secret only on requests to the listed hosts.

Type BetaManagedAgentsLimitedCredentialNetworkingParamsType
AllowedHosts []string

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

type BetaManagedAgentsCredentialValidation struct { Type: "vault_credential_validation"; CredentialID; HasRefreshToken; /* 5 more */ }

Result of live-probing a credential against its configured MCP server.

type BetaManagedAgentsCredentialValidationStatus string

Overall verdict of a credential validation probe.

One of the following:
const BetaManagedAgentsCredentialValidationStatusValid BetaManagedAgentsCredentialValidationStatus = "valid"

The credential successfully authenticated against its MCP server.

const BetaManagedAgentsCredentialValidationStatusInvalid BetaManagedAgentsCredentialValidationStatus = "invalid"

The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.

const BetaManagedAgentsCredentialValidationStatusUnknown BetaManagedAgentsCredentialValidationStatus = "unknown"

The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.

type BetaManagedAgentsDeletedCredential struct { Type: "vault_credential_deleted"; ID }

Confirmation of a deleted credential.

Type BetaManagedAgentsDeletedCredentialType
ID string

Unique identifier of the deleted credential.

type BetaManagedAgentsEnvironmentVariableAuthResponse struct { Type: "environment_variable"; InjectionLocation; Networking; SecretName }

Environment variable credential details. The secret value is never returned.

type BetaManagedAgentsEnvironmentVariableCreateParams struct { Type: "environment_variable"; Networking; SecretName; /* 2 more */ }

Parameters for creating an environment variable credential.

type BetaManagedAgentsEnvironmentVariableUpdateParams struct { Type: "environment_variable"; InjectionLocation; Networking; SecretValue }

Parameters for updating an environment variable credential. secret_name is immutable.

type BetaManagedAgentsInjectionLocationParams struct { Body; Header }

Where in the outbound request the secret value may be substituted.

Body bool Optional

Substitute when the placeholder appears in the request body.

Header bool Optional

Substitute when the placeholder appears in a request header value.

type BetaManagedAgentsInjectionLocationResponse struct { Body; Header }

Where in the outbound request the secret value is substituted.

Body bool

Whether the placeholder is substituted in the request body.

Header bool

Whether the placeholder is substituted in request header values.

type BetaManagedAgentsInjectionLocationUpdateParams struct { Body; Header }

Updated injection location.

Body bool Optional

Substitute when the placeholder appears in the request body.

Header bool Optional

Substitute when the placeholder appears in a request header value.

type BetaManagedAgentsLimitedCredentialNetworkingParams struct { Type: "limited"; AllowedHosts }

Substitute the secret only on requests to the listed hosts.

Type BetaManagedAgentsLimitedCredentialNetworkingParamsType
AllowedHosts []string

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

type BetaManagedAgentsLimitedCredentialNetworkingResponse struct { Type: "limited"; AllowedHosts }

The secret is substituted only on requests to the listed hosts.

Type BetaManagedAgentsLimitedCredentialNetworkingResponseType
AllowedHosts []string

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

type BetaManagedAgentsMCPOAuthAuthResponse struct { Type: "mcp_oauth"; MCPServerURL; ExpiresAt; Refresh }

OAuth credential details for an MCP server.

Type BetaManagedAgentsMCPOAuthAuthResponseType
MCPServerURL string

URL of the MCP server this credential authenticates against.

ExpiresAt Time Optional

A timestamp in RFC 3339 format

formatdate-time
Refresh BetaManagedAgentsMCPOAuthRefreshResponse Optional

Refresh token configuration, if the credential supports token refresh.

type BetaManagedAgentsMCPOAuthCreateParams struct { Type: "mcp_oauth"; AccessToken; MCPServerURL; /* 2 more */ }

Parameters for creating an MCP OAuth credential.

Type BetaManagedAgentsMCPOAuthCreateParamsType
AccessToken string

OAuth access token.

minLength1
maxLength8192
MCPServerURL string

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
ExpiresAt Time Optional

A timestamp in RFC 3339 format

formatdate-time
Refresh BetaManagedAgentsMCPOAuthRefreshParams Optional

Refresh token configuration, if the credential supports token refresh.

type BetaManagedAgentsMCPOAuthRefreshParams struct { ClientID; RefreshToken; TokenEndpoint; /* 3 more */ }

OAuth refresh token parameters for creating a credential with refresh support.

type BetaManagedAgentsMCPOAuthRefreshResponse struct { ClientID; TokenEndpoint; TokenEndpointAuth; /* 2 more */ }

OAuth refresh token configuration returned in credential responses.

type BetaManagedAgentsMCPOAuthRefreshUpdateParams struct { RefreshToken; Scope; TokenEndpointAuth }

Parameters for updating OAuth refresh token configuration.

RefreshToken string Optional

Updated OAuth refresh token.

minLength1
maxLength8192
Scope string Optional

Updated OAuth scope for the refresh request.

maxLength8192
TokenEndpointAuth BetaManagedAgentsMCPOAuthRefreshUpdateParamsTokenEndpointAuthUnion Optional
One of the following:
type BetaManagedAgentsTokenEndpointAuthBasicUpdateParam struct { Type: "client_secret_basic"; ClientSecret }

Updated HTTP Basic authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthBasicUpdateParamType
ClientSecret string Optional

Updated OAuth client secret.

minLength1
maxLength512
type BetaManagedAgentsTokenEndpointAuthPostUpdateParam struct { Type: "client_secret_post"; ClientSecret }

Updated POST body authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthPostUpdateParamType
ClientSecret string Optional

Updated OAuth client secret.

minLength1
maxLength512
type BetaManagedAgentsMCPOAuthUpdateParams struct { Type: "mcp_oauth"; AccessToken; ExpiresAt; Refresh }

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

type BetaManagedAgentsMCPProbe struct { HTTPResponse; Method }

The failing step of an MCP validation probe.

HTTPResponse BetaManagedAgentsRefreshHTTPResponse

The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).

Body string

Response body. May be truncated and has sensitive values scrubbed.

BodyTruncated bool

Whether body was truncated.

ContentType string

Value of the Content-Type response header.

StatusCode int64

HTTP status code.

formatint32
Method string

The MCP method that failed (for example initialize or tools/list).

type BetaManagedAgentsRefreshHTTPResponse struct { Body; BodyTruncated; ContentType; StatusCode }

An HTTP response captured during a credential validation probe.

Body string

Response body. May be truncated and has sensitive values scrubbed.

BodyTruncated bool

Whether body was truncated.

ContentType string

Value of the Content-Type response header.

StatusCode int64

HTTP status code.

formatint32
type BetaManagedAgentsRefreshObject struct { HTTPResponse; Status }

Outcome of a refresh-token exchange attempted during credential validation.

HTTPResponse BetaManagedAgentsRefreshHTTPResponse

The captured HTTP error response from the token endpoint. Populated only when status is failed.

Body string

Response body. May be truncated and has sensitive values scrubbed.

BodyTruncated bool

Whether body was truncated.

ContentType string

Value of the Content-Type response header.

StatusCode int64

HTTP status code.

formatint32
Status BetaManagedAgentsRefreshObjectStatus

Outcome of the refresh attempt.

One of the following:
const BetaManagedAgentsRefreshObjectStatusSucceeded BetaManagedAgentsRefreshObjectStatus = "succeeded"

The token endpoint returned a new access token.

const BetaManagedAgentsRefreshObjectStatusFailed BetaManagedAgentsRefreshObjectStatus = "failed"

The token endpoint returned an error response. See http_response for detail.

const BetaManagedAgentsRefreshObjectStatusConnectError BetaManagedAgentsRefreshObjectStatus = "connect_error"

The token endpoint could not be reached (DNS, TLS, or connection error).

const BetaManagedAgentsRefreshObjectStatusNoRefreshToken BetaManagedAgentsRefreshObjectStatus = "no_refresh_token"

No refresh token is stored for the credential, so no exchange was attempted.

type BetaManagedAgentsStaticBearerAuthResponse struct { Type: "static_bearer"; MCPServerURL }

Static bearer token credential details for an MCP server.

Type BetaManagedAgentsStaticBearerAuthResponseType
MCPServerURL string

URL of the MCP server this credential authenticates against.

type BetaManagedAgentsStaticBearerCreateParams struct { Type: "static_bearer"; Token; MCPServerURL }

Parameters for creating a static bearer token credential.

Type BetaManagedAgentsStaticBearerCreateParamsType
Token string

Static bearer token value.

minLength1
maxLength8192
MCPServerURL string

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
type BetaManagedAgentsStaticBearerUpdateParams struct { Type: "static_bearer"; Token }

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

Type BetaManagedAgentsStaticBearerUpdateParamsType
Token string Optional

Updated static bearer token value.

minLength1
maxLength8192
type BetaManagedAgentsTokenEndpointAuthBasicParam struct { Type: "client_secret_basic"; ClientSecret }

Token endpoint uses HTTP Basic authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthBasicParamType
ClientSecret string

OAuth client secret.

minLength1
maxLength512
type BetaManagedAgentsTokenEndpointAuthBasicResponse struct { Type: "client_secret_basic" }

Token endpoint uses HTTP Basic authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthBasicResponseType
type BetaManagedAgentsTokenEndpointAuthBasicUpdateParam struct { Type: "client_secret_basic"; ClientSecret }

Updated HTTP Basic authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthBasicUpdateParamType
ClientSecret string Optional

Updated OAuth client secret.

minLength1
maxLength512
type BetaManagedAgentsTokenEndpointAuthNoneParam struct { Type: "none" }

Token endpoint requires no client authentication.

Type BetaManagedAgentsTokenEndpointAuthNoneParamType
type BetaManagedAgentsTokenEndpointAuthNoneResponse struct { Type: "none" }

Token endpoint requires no client authentication.

Type BetaManagedAgentsTokenEndpointAuthNoneResponseType
type BetaManagedAgentsTokenEndpointAuthPostParam struct { Type: "client_secret_post"; ClientSecret }

Token endpoint uses POST body authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthPostParamType
ClientSecret string

OAuth client secret.

minLength1
maxLength512
type BetaManagedAgentsTokenEndpointAuthPostResponse struct { Type: "client_secret_post" }

Token endpoint uses POST body authentication with client credentials.

Type BetaManagedAgentsTokenEndpointAuthPostResponseType
type BetaManagedAgentsTokenEndpointAuthPostUpdateParam struct { Type: "client_secret_post"; ClientSecret }

Updated POST body authentication parameters for the token endpoint.

Type BetaManagedAgentsTokenEndpointAuthPostUpdateParamType
ClientSecret string Optional

Updated OAuth client secret.

minLength1
maxLength512
type BetaManagedAgentsUnrestrictedCredentialNetworkingParams struct { Type: "unrestricted" }

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingParamsType
type BetaManagedAgentsUnrestrictedCredentialNetworkingResponse struct { Type: "unrestricted" }

The secret is substituted on any host the session's Environment network policy permits egress to.

Type BetaManagedAgentsUnrestrictedCredentialNetworkingResponseType