--- title: Credentials url: https://platform.claude.com/docs/en/api/ruby/beta/vaults/credentials --- # Credentials ## Create Credential `beta.vaults.credentials.create(vault_id, **kwargs) -> BetaManagedAgentsCredential` **POST** `/v1/vaults/{vault_id}/credentials` Create Credential ### Parameters - `vault_id: String` (path parameter) Identifier of the vault to create the credential in. - `auth: BetaManagedAgentsMCPOAuthCreateParams | BetaManagedAgentsStaticBearerCreateParams | BetaManagedAgentsEnvironmentVariableCreateParams` Authentication configuration for the credential. - `class BetaManagedAgentsMCPOAuthCreateParams` Parameters for creating an MCP OAuth credential. - `type: :mcp_oauth` - `access_token: String` OAuth access token. minLength: 1, maxLength: 8192 - `mcp_server_url: String` URL of the MCP server this credential authenticates against. minLength: 1, maxLength: 2047 - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshParams` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. minLength: 1, maxLength: 1024 - `refresh_token: String` OAuth refresh token. minLength: 1, maxLength: 8192 - `token_endpoint: String` Token endpoint URL used to refresh the access token. minLength: 1, maxLength: 2047 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam | BetaManagedAgentsTokenEndpointAuthBasicParam | BetaManagedAgentsTokenEndpointAuthPostParam` - `class BetaManagedAgentsTokenEndpointAuthNoneParam` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicParam` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsTokenEndpointAuthPostParam` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 - `resource: String` OAuth resource indicator. minLength: 1, maxLength: 2047 - `scope: String` OAuth scope for the refresh request. minLength: 1, maxLength: 8192 - `class BetaManagedAgentsStaticBearerCreateParams` Parameters for creating a static bearer token credential. - `type: :static_bearer` - `token: String` Static bearer token value. minLength: 1, maxLength: 8192 - `mcp_server_url: String` URL of the MCP server this credential authenticates against. minLength: 1, maxLength: 2047 - `class BetaManagedAgentsEnvironmentVariableCreateParams` Parameters for creating an environment variable credential. - `type: :environment_variable` - `networking: BetaManagedAgentsCredentialNetworkingParams` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingParams` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingParams` Substitute the secret only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries. - `secret_name: String` Name of the environment variable. Immutable after create. minLength: 1, maxLength: 255 - `secret_value: String` Secret value. Write-only; never returned in responses. minLength: 1, maxLength: 4096 - `injection_location: BetaManagedAgentsInjectionLocationParams` Where in the outbound request the secret value may be substituted. - `body: bool` Substitute when the placeholder appears in the request body. - `header: bool` Substitute when the placeholder appears in a request header value. - `display_name: String` Human-readable name for the credential. Up to 255 characters. maxLength: 255 - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsCredential` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: :vault_credential` - `id: String` Unique identifier for the credential. - `archived_at: Time` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse | BetaManagedAgentsStaticBearerAuthResponse | BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. - `created_at: Time` A timestamp in RFC 3339 format format: date-time - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata attached to the credential. - `updated_at: Time` A timestamp in RFC 3339 format format: date-time - `vault_id: String` Identifier of the vault this credential belongs to. - `display_name: String` Human-readable name for the credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") beta_managed_agents_credential = anthropic.beta.vaults.credentials.create( "vlt_011CZkZDLs7fYzm1hXNPeRjv", auth: { token: "bearer_exampletoken", mcp_server_url: "https://example-server.modelcontextprotocol.io/sse", type: :static_bearer } ) puts(beta_managed_agents_credential) ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## List Credentials `beta.vaults.credentials.list(vault_id, **kwargs) -> PageCursor` **GET** `/v1/vaults/{vault_id}/credentials` List Credentials ### Parameters - `vault_id: String` (path parameter) Identifier of the vault to list credentials for. - `include_archived: bool` (query parameter) Whether to include archived credentials in the results. - `limit: Integer` (query parameter) Maximum number of credentials to return per page. Defaults to 20, maximum 100. format: int32 - `page: String` (query parameter) Opaque pagination token from a previous `list_credentials` response. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsCredential` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: :vault_credential` - `id: String` Unique identifier for the credential. - `archived_at: Time` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse | BetaManagedAgentsStaticBearerAuthResponse | BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. - `created_at: Time` A timestamp in RFC 3339 format format: date-time - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata attached to the credential. - `updated_at: Time` A timestamp in RFC 3339 format format: date-time - `vault_id: String` Identifier of the vault this credential belongs to. - `display_name: String` Human-readable name for the credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") page = anthropic.beta.vaults.credentials.list("vlt_011CZkZDLs7fYzm1hXNPeRjv") puts(page) ``` #### Response (200) ```json { "data": [ { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ], "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo=" } ``` ## Get Credential `beta.vaults.credentials.retrieve(credential_id, **kwargs) -> BetaManagedAgentsCredential` **GET** `/v1/vaults/{vault_id}/credentials/{credential_id}` Get Credential ### Parameters - `vault_id: String` (path parameter) Identifier of the vault containing the credential. - `credential_id: String` (path parameter) Unique identifier of the credential to retrieve. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsCredential` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: :vault_credential` - `id: String` Unique identifier for the credential. - `archived_at: Time` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse | BetaManagedAgentsStaticBearerAuthResponse | BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. - `created_at: Time` A timestamp in RFC 3339 format format: date-time - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata attached to the credential. - `updated_at: Time` A timestamp in RFC 3339 format format: date-time - `vault_id: String` Identifier of the vault this credential belongs to. - `display_name: String` Human-readable name for the credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") beta_managed_agents_credential = anthropic.beta.vaults.credentials.retrieve( "vcrd_011CZkZEMt8gZan2iYPQfSkw", vault_id: "vlt_011CZkZDLs7fYzm1hXNPeRjv" ) puts(beta_managed_agents_credential) ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## Update Credential `beta.vaults.credentials.update(credential_id, **kwargs) -> BetaManagedAgentsCredential` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}` Update Credential ### Parameters - `vault_id: String` (path parameter) Identifier of the vault containing the credential. - `credential_id: String` (path parameter) Unique identifier of the credential to update. - `auth: BetaManagedAgentsMCPOAuthUpdateParams | BetaManagedAgentsStaticBearerUpdateParams | BetaManagedAgentsEnvironmentVariableUpdateParams` Updated authentication configuration. The `type` is immutable; the variant sent must match the stored credential's type. - `class BetaManagedAgentsMCPOAuthUpdateParams` Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable. - `type: :mcp_oauth` - `access_token: String` Updated OAuth access token. minLength: 1, maxLength: 8192 - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshUpdateParams` Updated refresh token configuration. - `refresh_token: String` Updated OAuth refresh token. minLength: 1, maxLength: 8192 - `scope: String` Updated OAuth scope for the refresh request. maxLength: 8192 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthBasicUpdateParam | BetaManagedAgentsTokenEndpointAuthPostUpdateParam` - `class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam` Updated HTTP Basic authentication parameters for the token endpoint. - `type: :client_secret_basic` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsTokenEndpointAuthPostUpdateParam` Updated POST body authentication parameters for the token endpoint. - `type: :client_secret_post` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsStaticBearerUpdateParams` Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable. - `type: :static_bearer` - `token: String` Updated static bearer token value. minLength: 1, maxLength: 8192 - `class BetaManagedAgentsEnvironmentVariableUpdateParams` Parameters for updating an environment variable credential. `secret_name` is immutable. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationUpdateParams` Updated injection location. - `body: bool` Substitute when the placeholder appears in the request body. - `header: bool` Substitute when the placeholder appears in a request header value. - `networking: BetaManagedAgentsCredentialNetworkingParams` Updated networking scope. Full replacement. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingParams` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingParams` Substitute the secret only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries. - `secret_value: String` Updated secret value. minLength: 1, maxLength: 4096 - `display_name: String` Updated human-readable name for the credential. 1-255 characters. minLength: 1, maxLength: 255 - `metadata: Hash[Symbol, String]` Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsCredential` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: :vault_credential` - `id: String` Unique identifier for the credential. - `archived_at: Time` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse | BetaManagedAgentsStaticBearerAuthResponse | BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. - `created_at: Time` A timestamp in RFC 3339 format format: date-time - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata attached to the credential. - `updated_at: Time` A timestamp in RFC 3339 format format: date-time - `vault_id: String` Identifier of the vault this credential belongs to. - `display_name: String` Human-readable name for the credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") beta_managed_agents_credential = anthropic.beta.vaults.credentials.update( "vcrd_011CZkZEMt8gZan2iYPQfSkw", vault_id: "vlt_011CZkZDLs7fYzm1hXNPeRjv" ) puts(beta_managed_agents_credential) ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## Delete Credential `beta.vaults.credentials.delete(credential_id, **kwargs) -> BetaManagedAgentsDeletedCredential` **DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}` Delete Credential ### Parameters - `vault_id: String` (path parameter) Identifier of the vault containing the credential. - `credential_id: String` (path parameter) Unique identifier of the credential to delete. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsDeletedCredential` Confirmation of a deleted credential. - `type: :vault_credential_deleted` - `id: String` Unique identifier of the deleted credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") beta_managed_agents_deleted_credential = anthropic.beta.vaults.credentials.delete( "vcrd_011CZkZEMt8gZan2iYPQfSkw", vault_id: "vlt_011CZkZDLs7fYzm1hXNPeRjv" ) puts(beta_managed_agents_deleted_credential) ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "type": "vault_credential_deleted" } ``` ## Archive Credential `beta.vaults.credentials.archive(credential_id, **kwargs) -> BetaManagedAgentsCredential` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive` Archive Credential ### Parameters - `vault_id: String` (path parameter) Identifier of the vault containing the credential. - `credential_id: String` (path parameter) Unique identifier of the credential to archive. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsCredential` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: :vault_credential` - `id: String` Unique identifier for the credential. - `archived_at: Time` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse | BetaManagedAgentsStaticBearerAuthResponse | BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. - `created_at: Time` A timestamp in RFC 3339 format format: date-time - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata attached to the credential. - `updated_at: Time` A timestamp in RFC 3339 format format: date-time - `vault_id: String` Identifier of the vault this credential belongs to. - `display_name: String` Human-readable name for the credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") beta_managed_agents_credential = anthropic.beta.vaults.credentials.archive( "vcrd_011CZkZEMt8gZan2iYPQfSkw", vault_id: "vlt_011CZkZDLs7fYzm1hXNPeRjv" ) puts(beta_managed_agents_credential) ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## Validate Credential `beta.vaults.credentials.mcp_oauth_validate(credential_id, **kwargs) -> BetaManagedAgentsCredentialValidation` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate` Validate Credential ### Parameters - `vault_id: String` (path parameter) Identifier of the vault containing the credential. - `credential_id: String` (path parameter) Unique identifier of the credential to validate. - `betas: Array[AnthropicBeta]` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `String = String` - `:"message-batches-2024-09-24"` - `:"prompt-caching-2024-07-31"` - `:"computer-use-2024-10-22"` - `:"computer-use-2025-01-24"` - `:"pdfs-2024-09-25"` - `:"token-counting-2024-11-01"` - `:"token-efficient-tools-2025-02-19"` - `:"output-128k-2025-02-19"` - `:"files-api-2025-04-14"` - `:"mcp-client-2025-04-04"` - `:"mcp-client-2025-11-20"` - `:"dev-full-thinking-2025-05-14"` - `:"interleaved-thinking-2025-05-14"` - `:"code-execution-2025-05-22"` - `:"extended-cache-ttl-2025-04-11"` - `:"context-1m-2025-08-07"` - `:"context-management-2025-06-27"` - `:"model-context-window-exceeded-2025-08-26"` - `:"skills-2025-10-02"` - `:"fast-mode-2026-02-01"` - `:"output-300k-2026-03-24"` - `:"user-profiles-2026-03-24"` - `:"user-profiles-2026-08-18"` - `:"user-profiles-2026-09-04"` - `:"advisor-tool-2026-03-01"` - `:"managed-agents-2026-04-01"` - `:"cache-diagnosis-2026-04-07"` - `:"dreaming-2026-04-21"` - `:"thinking-token-count-2026-05-13"` - `:"server-side-fallback-2026-06-01"` - `:"server-side-fallback-2026-07-01"` - `:"fallback-credit-2026-06-01"` - `:"fallback-credit-2026-07-01"` - `:"agent-memory-2026-07-22"` - `:"mid-conversation-tool-changes-2026-07-01"` - `:"compact-2026-01-12"` - `:"computer-use-2025-11-24"` - `:"mcp-tunnels-2026-06-22"` - `:"structured-outputs-2025-11-13"` - `:"task-budgets-2026-03-13"` - `:"thinking-display-updates-2026-08-18"` - `:"ce-user-management-2026-07-13"` - `:"mid-conversation-output-config-2026-07-01"` - `:"thinking-binding-controls-2026-08-01"` - `:"mid-conversation-system-clear-at-2026-08-21"` - `:"compact-2026-09-04"` - `:"inline-tools-2026-09-15"` - `:"mcp-client-2026-09-15"` - `:"ce-plugins-2026-09-01"` - `:"spend-limit-reads-2026-09-26"` - `:"telemetry-destinations-2026-08-11"` - `workspace_id: String` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `class BetaManagedAgentsCredentialValidation` Result of live-probing a credential against its configured MCP server. - `type: :vault_credential_validation` - `credential_id: String` Unique identifier of the credential that was validated. - `has_refresh_token: bool` Whether the credential has a refresh token configured. - `mcp_probe: BetaManagedAgentsMCPProbe` Details of the failing MCP probe step. Null when the probe succeeded. - `http_response: BetaManagedAgentsRefreshHTTPResponse` The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS). - `body: String` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: bool` Whether `body` was truncated. - `content_type: String` Value of the `Content-Type` response header. - `status_code: Integer` HTTP status code. format: int32 - `method_: String` The MCP method that failed (for example `initialize` or `tools/list`). - `refresh: BetaManagedAgentsRefreshObject` Details of the refresh-token exchange attempted on a 401. Null when no refresh was attempted. - `http_response: BetaManagedAgentsRefreshHTTPResponse` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `status: :succeeded | :failed | :connect_error | :no_refresh_token` Outcome of the refresh attempt. - `:succeeded` The token endpoint returned a new access token. - `:failed` The token endpoint returned an error response. See `http_response` for detail. - `:connect_error` The token endpoint could not be reached (DNS, TLS, or connection error). - `:no_refresh_token` No refresh token is stored for the credential, so no exchange was attempted. - `status: BetaManagedAgentsCredentialValidationStatus` Overall verdict of the validation probe. - `:valid` The credential successfully authenticated against its MCP server. - `:invalid` The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it. - `:unknown` The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed. - `validated_at: Time` When the validation probe was performed. format: date-time - `vault_id: String` Identifier of the vault containing the credential. ### Example ```ruby require "anthropic" anthropic = Anthropic::Client.new(api_key: "my-anthropic-api-key") beta_managed_agents_credential_validation = anthropic.beta.vaults.credentials.mcp_oauth_validate( "vcrd_011CZkZEMt8gZan2iYPQfSkw", vault_id: "vlt_011CZkZDLs7fYzm1hXNPeRjv" ) puts(beta_managed_agents_credential_validation) ``` #### Response (200) ```json { "credential_id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "has_refresh_token": true, "mcp_probe": { "http_response": { "body": "body", "body_truncated": true, "content_type": "content_type", "status_code": 0 }, "method": "method" }, "refresh": { "http_response": { "body": "body", "body_truncated": true, "content_type": "content_type", "status_code": 0 }, "status": "succeeded" }, "status": "valid", "type": "vault_credential_validation", "validated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv" } ``` ## Domain types ### Beta Managed Agents Credential - `class BetaManagedAgentsCredential` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: :vault_credential` - `id: String` Unique identifier for the credential. - `archived_at: Time` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse | BetaManagedAgentsStaticBearerAuthResponse | BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. - `created_at: Time` A timestamp in RFC 3339 format format: date-time - `metadata: Hash[Symbol, String]` Arbitrary key-value metadata attached to the credential. - `updated_at: Time` A timestamp in RFC 3339 format format: date-time - `vault_id: String` Identifier of the vault this credential belongs to. - `display_name: String` Human-readable name for the credential. ### Beta Managed Agents Credential Networking Params - `type BetaManagedAgentsCredentialNetworkingParams = BetaManagedAgentsUnrestrictedCredentialNetworkingParams | BetaManagedAgentsLimitedCredentialNetworkingParams` - `class BetaManagedAgentsUnrestrictedCredentialNetworkingParams` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingParams` Substitute the secret only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries. ### Beta Managed Agents Credential Validation - `class BetaManagedAgentsCredentialValidation` Result of live-probing a credential against its configured MCP server. - `type: :vault_credential_validation` - `credential_id: String` Unique identifier of the credential that was validated. - `has_refresh_token: bool` Whether the credential has a refresh token configured. - `mcp_probe: BetaManagedAgentsMCPProbe` Details of the failing MCP probe step. Null when the probe succeeded. - `http_response: BetaManagedAgentsRefreshHTTPResponse` The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS). - `body: String` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: bool` Whether `body` was truncated. - `content_type: String` Value of the `Content-Type` response header. - `status_code: Integer` HTTP status code. format: int32 - `method_: String` The MCP method that failed (for example `initialize` or `tools/list`). - `refresh: BetaManagedAgentsRefreshObject` Details of the refresh-token exchange attempted on a 401. Null when no refresh was attempted. - `http_response: BetaManagedAgentsRefreshHTTPResponse` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `status: :succeeded | :failed | :connect_error | :no_refresh_token` Outcome of the refresh attempt. - `:succeeded` The token endpoint returned a new access token. - `:failed` The token endpoint returned an error response. See `http_response` for detail. - `:connect_error` The token endpoint could not be reached (DNS, TLS, or connection error). - `:no_refresh_token` No refresh token is stored for the credential, so no exchange was attempted. - `status: BetaManagedAgentsCredentialValidationStatus` Overall verdict of the validation probe. - `:valid` The credential successfully authenticated against its MCP server. - `:invalid` The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it. - `:unknown` The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed. - `validated_at: Time` When the validation probe was performed. format: date-time - `vault_id: String` Identifier of the vault containing the credential. ### Beta Managed Agents Credential Validation Status - `type BetaManagedAgentsCredentialValidationStatus = :valid | :invalid | :unknown` Overall verdict of a credential validation probe. - `:valid` The credential successfully authenticated against its MCP server. - `:invalid` The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it. - `:unknown` The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed. ### Beta Managed Agents Deleted Credential - `class BetaManagedAgentsDeletedCredential` Confirmation of a deleted credential. - `type: :vault_credential_deleted` - `id: String` Unique identifier of the deleted credential. ### Beta Managed Agents Environment Variable Auth Response - `class BetaManagedAgentsEnvironmentVariableAuthResponse` Environment variable credential details. The secret value is never returned. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse | BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. - `secret_name: String` Name of the environment variable. ### Beta Managed Agents Environment Variable Create Params - `class BetaManagedAgentsEnvironmentVariableCreateParams` Parameters for creating an environment variable credential. - `type: :environment_variable` - `networking: BetaManagedAgentsCredentialNetworkingParams` Outbound hosts the secret value is substituted on. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingParams` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingParams` Substitute the secret only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries. - `secret_name: String` Name of the environment variable. Immutable after create. minLength: 1, maxLength: 255 - `secret_value: String` Secret value. Write-only; never returned in responses. minLength: 1, maxLength: 4096 - `injection_location: BetaManagedAgentsInjectionLocationParams` Where in the outbound request the secret value may be substituted. - `body: bool` Substitute when the placeholder appears in the request body. - `header: bool` Substitute when the placeholder appears in a request header value. ### Beta Managed Agents Environment Variable Update Params - `class BetaManagedAgentsEnvironmentVariableUpdateParams` Parameters for updating an environment variable credential. `secret_name` is immutable. - `type: :environment_variable` - `injection_location: BetaManagedAgentsInjectionLocationUpdateParams` Updated injection location. - `body: bool` Substitute when the placeholder appears in the request body. - `header: bool` Substitute when the placeholder appears in a request header value. - `networking: BetaManagedAgentsCredentialNetworkingParams` Updated networking scope. Full replacement. - `class BetaManagedAgentsUnrestrictedCredentialNetworkingParams` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: :unrestricted` - `class BetaManagedAgentsLimitedCredentialNetworkingParams` Substitute the secret only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries. - `secret_value: String` Updated secret value. minLength: 1, maxLength: 4096 ### Beta Managed Agents Injection Location Params - `class BetaManagedAgentsInjectionLocationParams` Where in the outbound request the secret value may be substituted. - `body: bool` Substitute when the placeholder appears in the request body. - `header: bool` Substitute when the placeholder appears in a request header value. ### Beta Managed Agents Injection Location Response - `class BetaManagedAgentsInjectionLocationResponse` Where in the outbound request the secret value is substituted. - `body: bool` Whether the placeholder is substituted in the request body. - `header: bool` Whether the placeholder is substituted in request header values. ### Beta Managed Agents Injection Location Update Params - `class BetaManagedAgentsInjectionLocationUpdateParams` Updated injection location. - `body: bool` Substitute when the placeholder appears in the request body. - `header: bool` Substitute when the placeholder appears in a request header value. ### Beta Managed Agents Limited Credential Networking Params - `class BetaManagedAgentsLimitedCredentialNetworkingParams` Substitute the secret only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries. ### Beta Managed Agents Limited Credential Networking Response - `class BetaManagedAgentsLimitedCredentialNetworkingResponse` The secret is substituted only on requests to the listed hosts. - `type: :limited` - `allowed_hosts: Array[String]` Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself. ### Beta Managed Agents MCP OAuth Auth Response - `class BetaManagedAgentsMCPOAuthAuthResponse` OAuth credential details for an MCP server. - `type: :mcp_oauth` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshResponse` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. ### Beta Managed Agents MCP OAuth Create Params - `class BetaManagedAgentsMCPOAuthCreateParams` Parameters for creating an MCP OAuth credential. - `type: :mcp_oauth` - `access_token: String` OAuth access token. minLength: 1, maxLength: 8192 - `mcp_server_url: String` URL of the MCP server this credential authenticates against. minLength: 1, maxLength: 2047 - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshParams` Refresh token configuration, if the credential supports token refresh. - `client_id: String` OAuth client ID. minLength: 1, maxLength: 1024 - `refresh_token: String` OAuth refresh token. minLength: 1, maxLength: 8192 - `token_endpoint: String` Token endpoint URL used to refresh the access token. minLength: 1, maxLength: 2047 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam | BetaManagedAgentsTokenEndpointAuthBasicParam | BetaManagedAgentsTokenEndpointAuthPostParam` - `class BetaManagedAgentsTokenEndpointAuthNoneParam` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicParam` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsTokenEndpointAuthPostParam` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 - `resource: String` OAuth resource indicator. minLength: 1, maxLength: 2047 - `scope: String` OAuth scope for the refresh request. minLength: 1, maxLength: 8192 ### Beta Managed Agents MCP OAuth Refresh Params - `class BetaManagedAgentsMCPOAuthRefreshParams` OAuth refresh token parameters for creating a credential with refresh support. - `client_id: String` OAuth client ID. minLength: 1, maxLength: 1024 - `refresh_token: String` OAuth refresh token. minLength: 1, maxLength: 8192 - `token_endpoint: String` Token endpoint URL used to refresh the access token. minLength: 1, maxLength: 2047 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam | BetaManagedAgentsTokenEndpointAuthBasicParam | BetaManagedAgentsTokenEndpointAuthPostParam` - `class BetaManagedAgentsTokenEndpointAuthNoneParam` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicParam` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsTokenEndpointAuthPostParam` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 - `resource: String` OAuth resource indicator. minLength: 1, maxLength: 2047 - `scope: String` OAuth scope for the refresh request. minLength: 1, maxLength: 8192 ### Beta Managed Agents MCP OAuth Refresh Response - `class BetaManagedAgentsMCPOAuthRefreshResponse` OAuth refresh token configuration returned in credential responses. - `client_id: String` OAuth client ID. - `token_endpoint: String` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse | BetaManagedAgentsTokenEndpointAuthBasicResponse | BetaManagedAgentsTokenEndpointAuthPostResponse` - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `resource: String` OAuth resource indicator. - `scope: String` OAuth scope for the refresh request. ### Beta Managed Agents MCP OAuth Refresh Update Params - `class BetaManagedAgentsMCPOAuthRefreshUpdateParams` Parameters for updating OAuth refresh token configuration. - `refresh_token: String` Updated OAuth refresh token. minLength: 1, maxLength: 8192 - `scope: String` Updated OAuth scope for the refresh request. maxLength: 8192 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthBasicUpdateParam | BetaManagedAgentsTokenEndpointAuthPostUpdateParam` - `class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam` Updated HTTP Basic authentication parameters for the token endpoint. - `type: :client_secret_basic` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsTokenEndpointAuthPostUpdateParam` Updated POST body authentication parameters for the token endpoint. - `type: :client_secret_post` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 ### Beta Managed Agents MCP OAuth Update Params - `class BetaManagedAgentsMCPOAuthUpdateParams` Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable. - `type: :mcp_oauth` - `access_token: String` Updated OAuth access token. minLength: 1, maxLength: 8192 - `expires_at: Time` A timestamp in RFC 3339 format format: date-time - `refresh: BetaManagedAgentsMCPOAuthRefreshUpdateParams` Updated refresh token configuration. - `refresh_token: String` Updated OAuth refresh token. minLength: 1, maxLength: 8192 - `scope: String` Updated OAuth scope for the refresh request. maxLength: 8192 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthBasicUpdateParam | BetaManagedAgentsTokenEndpointAuthPostUpdateParam` - `class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam` Updated HTTP Basic authentication parameters for the token endpoint. - `type: :client_secret_basic` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 - `class BetaManagedAgentsTokenEndpointAuthPostUpdateParam` Updated POST body authentication parameters for the token endpoint. - `type: :client_secret_post` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 ### Beta Managed Agents MCP Probe - `class BetaManagedAgentsMCPProbe` The failing step of an MCP validation probe. - `http_response: BetaManagedAgentsRefreshHTTPResponse` The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS). - `body: String` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: bool` Whether `body` was truncated. - `content_type: String` Value of the `Content-Type` response header. - `status_code: Integer` HTTP status code. format: int32 - `method_: String` The MCP method that failed (for example `initialize` or `tools/list`). ### Beta Managed Agents Refresh HTTP Response - `class BetaManagedAgentsRefreshHTTPResponse` An HTTP response captured during a credential validation probe. - `body: String` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: bool` Whether `body` was truncated. - `content_type: String` Value of the `Content-Type` response header. - `status_code: Integer` HTTP status code. format: int32 ### Beta Managed Agents Refresh Object - `class BetaManagedAgentsRefreshObject` Outcome of a refresh-token exchange attempted during credential validation. - `http_response: BetaManagedAgentsRefreshHTTPResponse` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `body: String` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: bool` Whether `body` was truncated. - `content_type: String` Value of the `Content-Type` response header. - `status_code: Integer` HTTP status code. format: int32 - `status: :succeeded | :failed | :connect_error | :no_refresh_token` Outcome of the refresh attempt. - `:succeeded` The token endpoint returned a new access token. - `:failed` The token endpoint returned an error response. See `http_response` for detail. - `:connect_error` The token endpoint could not be reached (DNS, TLS, or connection error). - `:no_refresh_token` No refresh token is stored for the credential, so no exchange was attempted. ### Beta Managed Agents Static Bearer Auth Response - `class BetaManagedAgentsStaticBearerAuthResponse` Static bearer token credential details for an MCP server. - `type: :static_bearer` - `mcp_server_url: String` URL of the MCP server this credential authenticates against. ### Beta Managed Agents Static Bearer Create Params - `class BetaManagedAgentsStaticBearerCreateParams` Parameters for creating a static bearer token credential. - `type: :static_bearer` - `token: String` Static bearer token value. minLength: 1, maxLength: 8192 - `mcp_server_url: String` URL of the MCP server this credential authenticates against. minLength: 1, maxLength: 2047 ### Beta Managed Agents Static Bearer Update Params - `class BetaManagedAgentsStaticBearerUpdateParams` Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable. - `type: :static_bearer` - `token: String` Updated static bearer token value. minLength: 1, maxLength: 8192 ### Beta Managed Agents Token Endpoint Auth Basic Param - `class BetaManagedAgentsTokenEndpointAuthBasicParam` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 ### Beta Managed Agents Token Endpoint Auth Basic Response - `class BetaManagedAgentsTokenEndpointAuthBasicResponse` Token endpoint uses HTTP Basic authentication with client credentials. - `type: :client_secret_basic` ### Beta Managed Agents Token Endpoint Auth Basic Update Param - `class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam` Updated HTTP Basic authentication parameters for the token endpoint. - `type: :client_secret_basic` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 ### Beta Managed Agents Token Endpoint Auth None Param - `class BetaManagedAgentsTokenEndpointAuthNoneParam` Token endpoint requires no client authentication. - `type: :none` ### Beta Managed Agents Token Endpoint Auth None Response - `class BetaManagedAgentsTokenEndpointAuthNoneResponse` Token endpoint requires no client authentication. - `type: :none` ### Beta Managed Agents Token Endpoint Auth Post Param - `class BetaManagedAgentsTokenEndpointAuthPostParam` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` - `client_secret: String` OAuth client secret. minLength: 1, maxLength: 512 ### Beta Managed Agents Token Endpoint Auth Post Response - `class BetaManagedAgentsTokenEndpointAuthPostResponse` Token endpoint uses POST body authentication with client credentials. - `type: :client_secret_post` ### Beta Managed Agents Token Endpoint Auth Post Update Param - `class BetaManagedAgentsTokenEndpointAuthPostUpdateParam` Updated POST body authentication parameters for the token endpoint. - `type: :client_secret_post` - `client_secret: String` Updated OAuth client secret. minLength: 1, maxLength: 512 ### Beta Managed Agents Unrestricted Credential Networking Params - `class BetaManagedAgentsUnrestrictedCredentialNetworkingParams` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: :unrestricted` ### Beta Managed Agents Unrestricted Credential Networking Response - `class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: :unrestricted`