Claude Platform Docs

Учётные данные

Создать учётные данные
beta.vaults.credentials.create(vault_id, **kwargs) -> BetaManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials
Список учётных данных
beta.vaults.credentials.list(vault_id, **kwargs) -> SyncPageCursor[BetaManagedAgentsCredential]
GET/v1/vaults/{vault_id}/credentials
Получить учётные данные
beta.vaults.credentials.retrieve(credential_id, **kwargs) -> BetaManagedAgentsCredential
GET/v1/vaults/{vault_id}/credentials/{credential_id}
Обновить учётные данные
beta.vaults.credentials.update(credential_id, **kwargs) -> BetaManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}
Удалить учётные данные
beta.vaults.credentials.delete(credential_id, **kwargs) -> BetaManagedAgentsDeletedCredential
DELETE/v1/vaults/{vault_id}/credentials/{credential_id}
Архивировать учётные данные
beta.vaults.credentials.archive(credential_id, **kwargs) -> BetaManagedAgentsCredential
POST/v1/vaults/{vault_id}/credentials/{credential_id}/archive
Проверить учётные данные
beta.vaults.credentials.mcp_oauth_validate(credential_id, **kwargs) -> BetaManagedAgentsCredentialValidation
POST/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate
Models
class BetaManagedAgentsCredential: type: "vault_credential"; id; archived_at; ... # 6 more

A credential stored in a vault. Sensitive fields are never returned in responses.

type BetaManagedAgentsCredentialNetworkingParams = ...
One of the following:
class BetaManagedAgentsUnrestrictedCredentialNetworkingParams: type: "unrestricted"

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

type: Literal["unrestricted"]
class BetaManagedAgentsLimitedCredentialNetworkingParams: type: "limited"; allowed_hosts

Substitute the secret only on requests to the listed hosts.

type: Literal["limited"]
allowed_hosts: List[str]

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

class BetaManagedAgentsCredentialValidation: type: "vault_credential_validation"; credential_id; has_refresh_token; ... # 5 more

Result of live-probing a credential against its configured MCP server.

type BetaManagedAgentsCredentialValidationStatus = Literal["valid", "invalid", "unknown"]

Overall verdict of a credential validation probe.

One of the following:
"valid"

The credential successfully authenticated against its MCP server.

"invalid"

The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.

"unknown"

The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.

class BetaManagedAgentsDeletedCredential: type: "vault_credential_deleted"; id

Confirmation of a deleted credential.

type: Literal["vault_credential_deleted"]
id: str

Unique identifier of the deleted credential.

class BetaManagedAgentsEnvironmentVariableAuthResponse: type: "environment_variable"; injection_location; networking; secret_name

Environment variable credential details. The secret value is never returned.

class BetaManagedAgentsEnvironmentVariableCreateParams: type: "environment_variable"; networking; secret_name; ... # 2 more

Parameters for creating an environment variable credential.

class BetaManagedAgentsEnvironmentVariableUpdateParams: type: "environment_variable"; injection_location; networking; secret_value

Parameters for updating an environment variable credential. secret_name is immutable.

class BetaManagedAgentsInjectionLocationParams: body; header

Where in the outbound request the secret value may be substituted.

body: Optional[bool]

Substitute when the placeholder appears in the request body.

header: Optional[bool]

Substitute when the placeholder appears in a request header value.

class BetaManagedAgentsInjectionLocationResponse: body; header

Where in the outbound request the secret value is substituted.

body: bool

Whether the placeholder is substituted in the request body.

header: bool

Whether the placeholder is substituted in request header values.

class BetaManagedAgentsInjectionLocationUpdateParams: body; header

Updated injection location.

body: Optional[bool]

Substitute when the placeholder appears in the request body.

header: Optional[bool]

Substitute when the placeholder appears in a request header value.

class BetaManagedAgentsLimitedCredentialNetworkingParams: type: "limited"; allowed_hosts

Substitute the secret only on requests to the listed hosts.

type: Literal["limited"]
allowed_hosts: List[str]

Hostnames on which the secret will be substituted. Each entry is a bare hostname (api.example.com), an IPv4 address (192.0.2.1), or a *.-prefixed wildcard (*.example.com). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

class BetaManagedAgentsLimitedCredentialNetworkingResponse: type: "limited"; allowed_hosts

The secret is substituted only on requests to the listed hosts.

type: Literal["limited"]
allowed_hosts: List[str]

Hostnames on which the secret will be substituted. An entry matches the request host exactly; a *.-prefixed entry matches any subdomain of the named domain but not the domain itself.

class BetaManagedAgentsMCPOAuthAuthResponse: type: "mcp_oauth"; mcp_server_url; expires_at; refresh

OAuth credential details for an MCP server.

type: Literal["mcp_oauth"]
mcp_server_url: str

URL of the MCP server this credential authenticates against.

expires_at: Optional[datetime]

A timestamp in RFC 3339 format

formatdate-time
refresh: Optional[BetaManagedAgentsMCPOAuthRefreshResponse]

Refresh token configuration, if the credential supports token refresh.

class BetaManagedAgentsMCPOAuthCreateParams: type: "mcp_oauth"; access_token; mcp_server_url; ... # 2 more

Parameters for creating an MCP OAuth credential.

type: Literal["mcp_oauth"]
access_token: str

OAuth access token.

minLength1
maxLength8192
mcp_server_url: str

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
expires_at: Optional[datetime]

A timestamp in RFC 3339 format

formatdate-time
refresh: Optional[BetaManagedAgentsMCPOAuthRefreshParams]

Refresh token configuration, if the credential supports token refresh.

class BetaManagedAgentsMCPOAuthRefreshParams: client_id; refresh_token; token_endpoint; ... # 3 more

OAuth refresh token parameters for creating a credential with refresh support.

class BetaManagedAgentsMCPOAuthRefreshResponse: client_id; token_endpoint; token_endpoint_auth; ... # 2 more

OAuth refresh token configuration returned in credential responses.

class BetaManagedAgentsMCPOAuthRefreshUpdateParams: refresh_token; scope; token_endpoint_auth

Parameters for updating OAuth refresh token configuration.

class BetaManagedAgentsMCPOAuthUpdateParams: type: "mcp_oauth"; access_token; expires_at; refresh

Parameters for updating an MCP OAuth credential. The mcp_server_url is immutable.

type: Literal["mcp_oauth"]
access_token: Optional[str]

Updated OAuth access token.

minLength1
maxLength8192
expires_at: Optional[datetime]

A timestamp in RFC 3339 format

formatdate-time
refresh: Optional[BetaManagedAgentsMCPOAuthRefreshUpdateParams]

Updated refresh token configuration.

class BetaManagedAgentsMCPProbe: http_response; method

The failing step of an MCP validation probe.

http_response: Optional[BetaManagedAgentsRefreshHTTPResponse]

The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).

body: str

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: str

Value of the Content-Type response header.

status_code: int

HTTP status code.

formatint32
method: str

The MCP method that failed (for example initialize or tools/list).

class BetaManagedAgentsRefreshHTTPResponse: body; body_truncated; content_type; status_code

An HTTP response captured during a credential validation probe.

body: str

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: str

Value of the Content-Type response header.

status_code: int

HTTP status code.

formatint32
class BetaManagedAgentsRefreshObject: http_response; status

Outcome of a refresh-token exchange attempted during credential validation.

http_response: Optional[BetaManagedAgentsRefreshHTTPResponse]

The captured HTTP error response from the token endpoint. Populated only when status is failed.

body: str

Response body. May be truncated and has sensitive values scrubbed.

body_truncated: bool

Whether body was truncated.

content_type: str

Value of the Content-Type response header.

status_code: int

HTTP status code.

formatint32
status: Literal["succeeded", "failed", "connect_error", "no_refresh_token"]

Outcome of the refresh attempt.

One of the following:
"succeeded"

The token endpoint returned a new access token.

"failed"

The token endpoint returned an error response. See http_response for detail.

"connect_error"

The token endpoint could not be reached (DNS, TLS, or connection error).

"no_refresh_token"

No refresh token is stored for the credential, so no exchange was attempted.

class BetaManagedAgentsStaticBearerAuthResponse: type: "static_bearer"; mcp_server_url

Static bearer token credential details for an MCP server.

type: Literal["static_bearer"]
mcp_server_url: str

URL of the MCP server this credential authenticates against.

class BetaManagedAgentsStaticBearerCreateParams: type: "static_bearer"; token; mcp_server_url

Parameters for creating a static bearer token credential.

type: Literal["static_bearer"]
token: str

Static bearer token value.

minLength1
maxLength8192
mcp_server_url: str

URL of the MCP server this credential authenticates against.

minLength1
maxLength2047
class BetaManagedAgentsStaticBearerUpdateParams: type: "static_bearer"; token

Parameters for updating a static bearer token credential. The mcp_server_url is immutable.

type: Literal["static_bearer"]
token: Optional[str]

Updated static bearer token value.

minLength1
maxLength8192
class BetaManagedAgentsTokenEndpointAuthBasicParam: type: "client_secret_basic"; client_secret

Token endpoint uses HTTP Basic authentication with client credentials.

type: Literal["client_secret_basic"]
client_secret: str

OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsTokenEndpointAuthBasicResponse: type: "client_secret_basic"

Token endpoint uses HTTP Basic authentication with client credentials.

type: Literal["client_secret_basic"]
class BetaManagedAgentsTokenEndpointAuthBasicUpdateParam: type: "client_secret_basic"; client_secret

Updated HTTP Basic authentication parameters for the token endpoint.

type: Literal["client_secret_basic"]
client_secret: Optional[str]

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsTokenEndpointAuthNoneParam: type: "none"

Token endpoint requires no client authentication.

type: Literal["none"]
class BetaManagedAgentsTokenEndpointAuthNoneResponse: type: "none"

Token endpoint requires no client authentication.

type: Literal["none"]
class BetaManagedAgentsTokenEndpointAuthPostParam: type: "client_secret_post"; client_secret

Token endpoint uses POST body authentication with client credentials.

type: Literal["client_secret_post"]
client_secret: str

OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsTokenEndpointAuthPostResponse: type: "client_secret_post"

Token endpoint uses POST body authentication with client credentials.

type: Literal["client_secret_post"]
class BetaManagedAgentsTokenEndpointAuthPostUpdateParam: type: "client_secret_post"; client_secret

Updated POST body authentication parameters for the token endpoint.

type: Literal["client_secret_post"]
client_secret: Optional[str]

Updated OAuth client secret.

minLength1
maxLength512
class BetaManagedAgentsUnrestrictedCredentialNetworkingParams: type: "unrestricted"

Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

type: Literal["unrestricted"]
class BetaManagedAgentsUnrestrictedCredentialNetworkingResponse: type: "unrestricted"

The secret is substituted on any host the session's Environment network policy permits egress to.

type: Literal["unrestricted"]