Home Docs Claude Developer Platform

One capture · api

One read of Claude Developer Platformapi-20260825T033708Z

377 pages moved out of 612 read.

Pages moved 377 significant first

Pages read 612 in this capture

Captured 25 Aug 2026 03:37 UTC

Corpus hash 7d98cae5bb87 corpus-hash

What this read moved

251-275 of 377, page 11 of 16

This capture is too large to show at once. Changes 251-275 of 377 are below, significant first; the rest are on the following screens.

api/beta/tunnels/certificates/archive Changed · +15 / -16 lines

# Archive Tunnel Certificate ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Archive Tunnel Certificate

3url: https://platform.claude.com/docs/en/api/beta/tunnels/certificates/archive

4---

1# Archive Tunnel Certificate

6## Archive Tunnel Certificate

3**POST** `/v1/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

8**post** `/v1/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`

105The Tunnels API is in research preview. It requires the `anthropic-beta: mcp-tunnels-2026-06-22` header and may change without a deprecation period. It supersedes the Admin API endpoints at `/v1/organizations/tunnels`, which remain available during a migration window.

116

127Archives a tunnel certificate, removing it from the set Anthropic trusts for the tunnel. The certificate record is retained. Archiving the last non-archived certificate is permitted; the tunnel rejects MCP traffic until a new certificate is added.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

1813- `certificate_id: string`

1914

20### Header Parameters

15## Headers

2116

2217- `"anthropic-beta": optional array of AnthropicBeta`

2318

from line 90

9590

9691 - `"mid-conversation-tool-changes-2026-07-01"`

9792

98### Returns

93## Returns

9994

100- `BetaTunnelCertificate object { id, archived_at, created_at, 4 more }`

95- `BetaTunnelCertificate object`

10196

10297 A CA certificate attached to a tunnel.

10398

from line 104

109104

110105 A timestamp in RFC 3339 format

111106

107 format: date-time

108

112109 - `created_at: string`

113110

114111 A timestamp in RFC 3339 format

115112

113 format: date-time

114

116115 - `expires_at: string or null`

117116

118117 A timestamp in RFC 3339 format

119118

119 format: date-time

120

120121 - `fingerprint: string`

121122

122123 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

from line 128

127128

128129 - `type: "tunnel_certificate"`

129130

130 - `"tunnel_certificate"`

131## Example

131132

132### Example

133

134```http

133```bash

135134curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

136135 -X POST \

137136 -H 'anthropic-version: 2023-06-01' \

from line 138

139138 -H "X-Api-Key: $ANTHROPIC_API_KEY"

140139```

141140

142#### Response

141### Response (200)

143142

144143```json

145144{

api/beta/tunnels/certificates/create Changed · +18 / -17 lines

# Create Tunnel Certificate ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Tunnel Certificate ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Tunnel Certificate

3url: https://platform.claude.com/docs/en/api/beta/tunnels/certificates/create

4---

1# Create Tunnel Certificate

6## Create Tunnel Certificate

3**POST** `/v1/tunnels/{tunnel_id}/certificates`

8**post** `/v1/tunnels/{tunnel_id}/certificates`

116

127Registers a public CA certificate on a tunnel. Anthropic verifies the gateway's server certificate against this CA when it terminates the inner TLS session. A tunnel holds at most two non-archived certificates.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Body Parameters

91## Body parameters

9792

9893- `ca_certificate_pem: string`

9994

10095 PEM-encoded X.509 CA certificate. Must contain exactly one certificate and no private-key material. Maximum 8KB.

10196

102### Returns

97 maxLength: 8192

10398

104- `BetaTunnelCertificate object { id, archived_at, created_at, 4 more }`

99## Returns

105100

101- `BetaTunnelCertificate object`

102

106103 A CA certificate attached to a tunnel.

107104

108105 - `id: string`

from line 110

113110

114111 A timestamp in RFC 3339 format

115112

113 format: date-time

114

116115 - `created_at: string`

117116

118117 A timestamp in RFC 3339 format

119118

119 format: date-time

120

120121 - `expires_at: string or null`

121122

122123 A timestamp in RFC 3339 format

123124

125 format: date-time

126

124127 - `fingerprint: string`

125128

126129 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

from line 134

131134

132135 - `type: "tunnel_certificate"`

133136

134 - `"tunnel_certificate"`

137## Example

135138

136### Example

137

138```http

139```bash

139140curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \

140141 -H 'Content-Type: application/json' \

141142 -H 'anthropic-version: 2023-06-01' \

from line 147

146147 }'

147148```

148149

149#### Response

150### Response (200)

150151

151152```json

152153{

api/beta/tunnels/certificates/list Changed · +17 / -16 lines

# List Tunnel Certificates ## Path parameters ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Tunnel Certificates ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Tunnel Certificates

3url: https://platform.claude.com/docs/en/api/beta/tunnels/certificates/list

4---

1# List Tunnel Certificates

6## List Tunnel Certificates

3**GET** `/v1/tunnels/{tunnel_id}/certificates`

8**get** `/v1/tunnels/{tunnel_id}/certificates`

116

127Lists the certificates registered on a tunnel. Archived certificates are excluded unless include_archived is set.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

18### Query Parameters

13## Query parameters

1914

2015- `include_archived: optional boolean`

2116

from line 20

2520

2621 Maximum number of certificates to return per page. Defaults to 20, maximum 1000.

2722

23 format: int32

2825- `page: optional string`

2926

3027 Opaque pagination cursor from a previous `list_tunnel_certificates` response.

3128

32### Header Parameters

29## Headers

3330

3431- `"anthropic-beta": optional array of AnthropicBeta`

3532

from line 104

107104

108105 - `"mid-conversation-tool-changes-2026-07-01"`

109106

110### Returns

107## Returns

111108

112109- `data: array of BetaTunnelCertificate`

113110

from line 118

121118

122119 A timestamp in RFC 3339 format

123120

121 format: date-time

122

124123 - `created_at: string`

125124

126125 A timestamp in RFC 3339 format

127126

127 format: date-time

128

128129 - `expires_at: string or null`

129130

130131 A timestamp in RFC 3339 format

131132

133 format: date-time

134

132135 - `fingerprint: string`

133136

134137 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

from line 142

139142

140143 - `type: "tunnel_certificate"`

141144

142 - `"tunnel_certificate"`

143

144145- `next_page: string or null`

145146

146147 Pagination cursor for the next page, or null if no more results.

147148

148### Example

149## Example

149150

150```http

151```bash

151152curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates \

152153 -H 'anthropic-version: 2023-06-01' \

153154 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

from line 155

154155 -H "X-Api-Key: $ANTHROPIC_API_KEY"

155156```

156157

157#### Response

158### Response (200)

158159

159160```json

160161{

api/beta/tunnels/certificates/retrieve Changed · +15 / -16 lines

# Get Tunnel Certificate ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Tunnel Certificate ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get Tunnel Certificate

3url: https://platform.claude.com/docs/en/api/beta/tunnels/certificates/retrieve

4---

1# Get Tunnel Certificate

6## Get Tunnel Certificate

3**GET** `/v1/tunnels/{tunnel_id}/certificates/{certificate_id}`

8**get** `/v1/tunnels/{tunnel_id}/certificates/{certificate_id}`

116

127Fetches a tunnel certificate by ID.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

1813- `certificate_id: string`

1914

20### Header Parameters

15## Headers

2116

2217- `"anthropic-beta": optional array of AnthropicBeta`

2318

from line 90

9590

9691 - `"mid-conversation-tool-changes-2026-07-01"`

9792

98### Returns

93## Returns

9994

100- `BetaTunnelCertificate object { id, archived_at, created_at, 4 more }`

95- `BetaTunnelCertificate object`

10196

10297 A CA certificate attached to a tunnel.

10398

from line 104

109104

110105 A timestamp in RFC 3339 format

111106

107 format: date-time

108

112109 - `created_at: string`

113110

114111 A timestamp in RFC 3339 format

115112

113 format: date-time

114

116115 - `expires_at: string or null`

117116

118117 A timestamp in RFC 3339 format

119118

119 format: date-time

120

120121 - `fingerprint: string`

121122

122123 Lowercase hex SHA-256 fingerprint of the certificate's DER encoding.

from line 128

127128

128129 - `type: "tunnel_certificate"`

129130

130 - `"tunnel_certificate"`

131## Example

131132

132### Example

133

134```http

133```bash

135134curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

136135 -H 'anthropic-version: 2023-06-01' \

137136 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

from line 137

138137 -H "X-Api-Key: $ANTHROPIC_API_KEY"

139138```

140139

141#### Response

140### Response (200)

142141

143142```json

144143{

api/beta/tunnels/create Changed · +15 / -16 lines

# Create Tunnel ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Tunnel ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Tunnel

3url: https://platform.claude.com/docs/en/api/beta/tunnels/create

4---

1# Create Tunnel

6## Create Tunnel

3**POST** `/v1/tunnels`

8**post** `/v1/tunnels`

116

127Creates a tunnel. Creation allocates a fresh hostname and provisions the tunnel; it is not idempotent. The new tunnel rejects MCP traffic until at least one CA certificate is added.

138

14### Header Parameters

9## Headers

1510

1611- `"anthropic-beta": optional array of AnthropicBeta`

1712

from line 84

8984

9085 - `"mid-conversation-tool-changes-2026-07-01"`

9186

92### Body Parameters

87## Body parameters

9388

9489- `display_name: optional string or null`

9590

9691 Optional human-readable name for the tunnel (1-255 characters).

9792

98### Returns

93 minLength: 1, maxLength: 255

9994

100- `BetaTunnel object { id, archived_at, created_at, 3 more }`

95## Returns

10196

97- `BetaTunnel object`

10299 An MCP tunnel.

103100

104101 - `id: string`

from line 106

109106

110107 A timestamp in RFC 3339 format

111108

109 format: date-time

110

112111 - `created_at: string`

113112

114113 A timestamp in RFC 3339 format

115114

115 format: date-time

116

116117 - `display_name: string or null`

117118

118119 Human-readable name for the tunnel (1-255 characters). Null if unset.

from line 124

123124

124125 - `type: "tunnel"`

125126

126 - `"tunnel"`

127## Example

127128

128### Example

129

130```http

129```bash

131130curl https://api.anthropic.com/v1/tunnels \

132131 -H 'Content-Type: application/json' \

133132 -H 'anthropic-version: 2023-06-01' \

from line 135

136135 -d '{}'

137136```

138137

139#### Response

138### Response (200)

140139

141140```json

142141{

api/beta/tunnels/list Changed · +14 / -15 lines

# List Tunnels ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Tunnels ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Tunnels

3url: https://platform.claude.com/docs/en/api/beta/tunnels/list

4---

1# List Tunnels

6## List Tunnels

3**GET** `/v1/tunnels`

8**get** `/v1/tunnels`

116

127Lists tunnels. Results are ordered by creation time, newest first; archived tunnels are excluded unless include_archived is set.

138

14### Query Parameters

9## Query parameters

1510

1611- `include_archived: optional boolean`

1712

from line 16

2116

2217 Maximum number of tunnels to return per page. Defaults to 20, maximum 1000.

2318

19 format: int32

2421- `page: optional string`

2522

2623 Opaque pagination cursor from a previous `list_tunnels` response.

2724

28### Header Parameters

25## Headers

2926

3027- `"anthropic-beta": optional array of AnthropicBeta`

3128

from line 100

103100

104101 - `"mid-conversation-tool-changes-2026-07-01"`

105102

106### Returns

103## Returns

107104

108105- `data: array of BetaTunnel`

109106

from line 114

117114

118115 A timestamp in RFC 3339 format

119116

117 format: date-time

118

120119 - `created_at: string`

121120

122121 A timestamp in RFC 3339 format

123122

123 format: date-time

124

124125 - `display_name: string or null`

125126

126127 Human-readable name for the tunnel (1-255 characters). Null if unset.

from line 132

131132

132133 - `type: "tunnel"`

133134

134 - `"tunnel"`

135

136135- `next_page: string or null`

137136

138137 Pagination cursor for the next page, or null if no more results.

139138

140### Example

139## Example

141140

142```http

141```bash

143142curl https://api.anthropic.com/v1/tunnels \

144143 -H 'anthropic-version: 2023-06-01' \

145144 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

from line 145

146145 -H "X-Api-Key: $ANTHROPIC_API_KEY"

147146```

148147

149#### Response

148### Response (200)

150149

151150```json

152151{

api/beta/tunnels/retrieve Changed · +13 / -16 lines

# Get Tunnel ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Tunnel ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get Tunnel

3url: https://platform.claude.com/docs/en/api/beta/tunnels/retrieve

4---

1# Get Tunnel

6## Get Tunnel

3**GET** `/v1/tunnels/{tunnel_id}`

8**get** `/v1/tunnels/{tunnel_id}`

116

127Fetches a tunnel by ID.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Returns

91## Returns

9792

98- `BetaTunnel object { id, archived_at, created_at, 3 more }`

93- `BetaTunnel object`

9994

10095 An MCP tunnel.

10196

from line 102

107102

108103 A timestamp in RFC 3339 format

109104

105 format: date-time

106

110107 - `created_at: string`

111108

112109 A timestamp in RFC 3339 format

113110

111 format: date-time

112

114113 - `display_name: string or null`

115114

116115 Human-readable name for the tunnel (1-255 characters). Null if unset.

from line 120

121120

122121 - `type: "tunnel"`

123122

124 - `"tunnel"`

123## Example

125124

126### Example

127

128```http

125```bash

129126curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID \

130127 -H 'anthropic-version: 2023-06-01' \

131128 -H 'anthropic-beta: mcp-tunnels-2026-06-22' \

from line 129

132129 -H "X-Api-Key: $ANTHROPIC_API_KEY"

133130```

134131

135#### Response

132### Response (200)

136133

137134```json

138135{

api/beta/tunnels/reveal_token Changed · +9 / -16 lines

# Reveal Tunnel Token ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Reveal Tunnel Token ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Reveal Tunnel Token

3url: https://platform.claude.com/docs/en/api/beta/tunnels/reveal_token

4---

1# Reveal Tunnel Token

6## Reveal Tunnel Token

3**POST** `/v1/tunnels/{tunnel_id}/reveal_token`

8**post** `/v1/tunnels/{tunnel_id}/reveal_token`

116

127Reveals a tunnel's connector token. The value is fetched live on each call; Anthropic does not store it. Repeated calls return the same value until the token is rotated. Exposed as POST so the token does not appear in intermediary access logs.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Returns

91## Returns

9792

98- `BetaTunnelToken object { id, tunnel_token, type }`

93- `BetaTunnelToken object`

9994

10095 A tunnel's connector token.

10196

from line 104

109104

110105 - `type: "tunnel_token"`

111106

112 - `"tunnel_token"`

107## Example

113108

114### Example

115

116```http

109```bash

117110curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/reveal_token \

118111 -X POST \

119112 -H 'anthropic-version: 2023-06-01' \

from line 114

121114 -H "X-Api-Key: $ANTHROPIC_API_KEY"

122115```

123116

124#### Response

117### Response (200)

125118

126119```json

127120{

api/beta/tunnels/rotate_token Changed · +12 / -17 lines

# Rotate Tunnel Token ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Rotate Tunnel Token ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Rotate Tunnel Token

3url: https://platform.claude.com/docs/en/api/beta/tunnels/rotate_token

4---

1# Rotate Tunnel Token

6## Rotate Tunnel Token

3**POST** `/v1/tunnels/{tunnel_id}/rotate_token`

8**post** `/v1/tunnels/{tunnel_id}/rotate_token`

116

127Rotates a tunnel's connector token. Rotation invalidates the current token for new connections and returns a fresh value; established connections are not severed. A connector restarted after rotation must use the new value.

138

14### Path Parameters

9## Path parameters

1510

1611- `tunnel_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Body Parameters

91## Body parameters

9792

9893- `reason: optional string or null`

9994

10095 Optional free-text reason for the rotation, recorded for audit.

10196

102### Returns

97 maxLength: 1024

10398

104- `BetaTunnelToken object { id, tunnel_token, type }`

99## Returns

105100

101- `BetaTunnelToken object`

102

106103 A tunnel's connector token.

107104

108105 - `id: string`

from line 112

115112

116113 - `type: "tunnel_token"`

117114

118 - `"tunnel_token"`

115## Example

119116

120### Example

121

122```http

117```bash

123118curl https://api.anthropic.com/v1/tunnels/$TUNNEL_ID/rotate_token \

124119 -H 'Content-Type: application/json' \

125120 -H 'anthropic-version: 2023-06-01' \

from line 123

128123 -d '{}'

129124```

130125

131#### Response

126### Response (200)

132127

133128```json

134129{

api/beta/user_profiles Changed · +68 / -53 lines

from line 1

1---

2title: User Profiles

3url: https://platform.claude.com/docs/en/api/beta/user_profiles

4---

61# User Profiles

83## Create User Profile

10**post** `/v1/user_profiles`

5**POST** `/v1/user_profiles`

116

127Create User Profile

138

14### Header Parameters

9### Headers

1510

1611- `"anthropic-beta": optional array of AnthropicBeta`

1712

from line 84

8984

9085 - `"mid-conversation-tool-changes-2026-07-01"`

9186

92### Body Parameters

87### Body parameters

9388

9489- `access_type: optional "application" or "passthrough"`

9590

from line 98

10398

10499 Platform's own identifier for this user. Not enforced unique. Maximum 255 characters.

105100

101 minLength: 1, maxLength: 255

102

106103- `metadata: optional map[string]`

107104

108105 Free-form key-value data to attach to this user profile. Maximum 16 keys, with keys up to 64 characters and values up to 512 characters. Values must be non-empty strings.

from line 108

111108

112109 Optional for all profiles. Real-world name of the entity this profile represents (company or individual); for a resold-to company (`relationship` `resold` / `access_type` `passthrough`), that company's name where known. Maximum 255 characters.

113110

111 minLength: 1, maxLength: 255

112

114113- `relationship: optional "external" or "resold" or "internal"`

115114

116115 How the entity behind a user profile relates to the platform that owns the API key. `external`: an individual end-user of the platform. `resold`: a company the platform resells Claude access to. `internal`: the platform's own usage.

from line 122

123122

124123### Returns

125124

126- `BetaUserProfile object { id, created_at, metadata, 7 more }`

125- `BetaUserProfile object`

127126

128127 - `id: string`

129128

from line 132

133132

134133 A timestamp in RFC 3339 format

135134

135 format: date-time

136

136137 - `metadata: map[string]`

137138

138139 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 156

155156

156157 Object type. Always `user_profile`.

157158

158 - `"user_profile"`

159

160159 - `updated_at: string`

161160

162161 A timestamp in RFC 3339 format

163162

163 format: date-time

164

164165 - `access_type: optional "application" or "passthrough"`

165166

166167 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 190

189190

190191### Example

191192

192```http

193```bash

193194curl https://api.anthropic.com/v1/user_profiles \

194195 -H 'Content-Type: application/json' \

195196 -H 'anthropic-version: 2023-06-01' \

from line 202

201202 }'

202203```

203204

204#### Response

205#### Response (200)

205206

206207```json

207208{

from line 225

224225

225226## List User Profiles

226227

227**get** `/v1/user_profiles`

228**GET** `/v1/user_profiles`

228229

229230List User Profiles

230231

231### Query Parameters

232### Query parameters

232233

233234- `limit: optional number`

234235

235236 Query parameter for limit

236237

238 format: int32

239

237240- `order: optional "asc" or "desc"`

238241

239242 Query parameter for order

from line 249

246249

247250 Query parameter for page

248251

249### Header Parameters

252### Headers

250253

251254- `"anthropic-beta": optional array of AnthropicBeta`

252255

from line 341

338341

339342 A timestamp in RFC 3339 format

340343

344 format: date-time

345

341346 - `metadata: map[string]`

342347

343348 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 365

360365

361366 Object type. Always `user_profile`.

362367

363 - `"user_profile"`

364

365368 - `updated_at: string`

366369

367370 A timestamp in RFC 3339 format

368371

372 format: date-time

373

369374 - `access_type: optional "application" or "passthrough"`

370375

371376 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 403

398403

399404### Example

400405

401```http

406```bash

402407curl https://api.anthropic.com/v1/user_profiles \

403408 -H 'anthropic-version: 2023-06-01' \

404409 -H 'anthropic-beta: user-profiles-2026-08-18' \

from line 410

405410 -H "X-Api-Key: $ANTHROPIC_API_KEY"

406411```

407412

408#### Response

413#### Response (200)

409414

410415```json

411416{

from line 438

433438

434439## Get User Profile

435440

436**get** `/v1/user_profiles/{user_profile_id}`

441**GET** `/v1/user_profiles/{user_profile_id}`

437442

438443Get User Profile

439444

440### Path Parameters

445### Path parameters

441446

442447- `user_profile_id: string`

443448

444### Header Parameters

449### Headers

445450

446451- `"anthropic-beta": optional array of AnthropicBeta`

447452

from line 526

521526

522527### Returns

523528

524- `BetaUserProfile object { id, created_at, metadata, 7 more }`

529- `BetaUserProfile object`

525530

526531 - `id: string`

527532

from line 536

531536

532537 A timestamp in RFC 3339 format

533538

539 format: date-time

540

534541 - `metadata: map[string]`

535542

536543 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 560

553560

554561 Object type. Always `user_profile`.

555562

556 - `"user_profile"`

557

558563 - `updated_at: string`

559564

560565 A timestamp in RFC 3339 format

561566

567 format: date-time

568

562569 - `access_type: optional "application" or "passthrough"`

563570

564571 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 594

587594

588595### Example

589596

590```http

597```bash

591598curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

592599 -H 'anthropic-version: 2023-06-01' \

593600 -H 'anthropic-beta: user-profiles-2026-08-18' \

from line 601

594601 -H "X-Api-Key: $ANTHROPIC_API_KEY"

595602```

596603

597#### Response

604#### Response (200)

598605

599606```json

600607{

from line 624

617624

618625## Update User Profile

619626

620**post** `/v1/user_profiles/{user_profile_id}`

627**POST** `/v1/user_profiles/{user_profile_id}`

621628

622629Update User Profile

623630

624### Path Parameters

631### Path parameters

625632

626633- `user_profile_id: string`

627634

628### Header Parameters

635### Headers

629636

630637- `"anthropic-beta": optional array of AnthropicBeta`

631638

from line 710

703710

704711 - `"mid-conversation-tool-changes-2026-07-01"`

705712

706### Body Parameters

713### Body parameters

707714

708715- `access_type: optional "application" or "passthrough" or null`

709716

from line 724

717724

718725 If present, replaces the stored external_id. Omit to leave unchanged. Maximum 255 characters.

719726

727 minLength: 1, maxLength: 255

728

720729- `metadata: optional map[string]`

721730

722731 Key-value pairs to merge into the stored metadata. Keys provided overwrite existing values. To remove a key, set its value to an empty string. Keys not provided are left unchanged. Maximum 16 keys, with keys up to 64 characters and values up to 512 characters.

from line 734

725734

726735 If present, replaces the stored name. Omit to leave unchanged. Maximum 255 characters.

727736

737 minLength: 1, maxLength: 255

738

728739- `relationship: optional "external" or "resold" or "internal" or null`

729740

730741 How the entity behind a user profile relates to the platform that owns the API key. `external`: an individual end-user of the platform. `resold`: a company the platform resells Claude access to. `internal`: the platform's own usage.

from line 748

737748

738749### Returns

739750

740- `BetaUserProfile object { id, created_at, metadata, 7 more }`

751- `BetaUserProfile object`

741752

742753 - `id: string`

743754

from line 758

747758

748759 A timestamp in RFC 3339 format

749760

761 format: date-time

762

750763 - `metadata: map[string]`

751764

752765 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 782

769782

770783 Object type. Always `user_profile`.

771784

772 - `"user_profile"`

773

774785 - `updated_at: string`

775786

776787 A timestamp in RFC 3339 format

777788

789 format: date-time

790

778791 - `access_type: optional "application" or "passthrough"`

779792

780793 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 816

803816

804817### Example

805818

806```http

819```bash

807820curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

808821 -H 'Content-Type: application/json' \

809822 -H 'anthropic-version: 2023-06-01' \

from line 827

814827 }'

815828```

816829

817#### Response

830#### Response (200)

818831

819832```json

820833{

from line 850

837850

838851## Create Enrollment URL

839852

840**post** `/v1/user_profiles/{user_profile_id}/enrollment_url`

853**POST** `/v1/user_profiles/{user_profile_id}/enrollment_url`

841854

842855Create Enrollment URL

843856

844### Path Parameters

857### Path parameters

845858

846859- `user_profile_id: string`

847860

848### Header Parameters

861### Headers

849862

850863- `"anthropic-beta": optional array of AnthropicBeta`

851864

from line 938

925938

926939### Returns

927940

928- `BetaUserProfileEnrollmentURL object { expires_at, type, url }`

941- `BetaUserProfileEnrollmentURL object`

929942

930943 - `expires_at: string`

931944

932945 A timestamp in RFC 3339 format

933946

947 format: date-time

948

934949 - `type: "enrollment_url"`

935950

936951 Object type. Always `enrollment_url`.

937952

938 - `"enrollment_url"`

939

940953 - `url: string`

941954

942955 Enrollment URL to send to the end user. Valid until `expires_at`.

from line 956

943956

944957### Example

945958

946```http

959```bash

947960curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID/enrollment_url \

948961 -X POST \

949962 -H 'anthropic-version: 2023-06-01' \

from line 964

951964 -H "X-Api-Key: $ANTHROPIC_API_KEY"

952965```

953966

954#### Response

967#### Response (200)

955968

956969```json

957970{

from line 974

961974}

962975```

963976

964## Domain Types

977## Domain types

965978

966979### Beta User Profile

967980

968- `BetaUserProfile object { id, created_at, metadata, 7 more }`

981- `BetaUserProfile object`

969982

970983 - `id: string`

971984

from line 988

975988

976989 A timestamp in RFC 3339 format

977990

991 format: date-time

992

978993 - `metadata: map[string]`

979994

980995 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 1012

9971012

9981013 Object type. Always `user_profile`.

9991014

1000 - `"user_profile"`

1001

10021015 - `updated_at: string`

10031016

10041017 A timestamp in RFC 3339 format

10051018

1019 format: date-time

1020

10061021 - `access_type: optional "application" or "passthrough"`

10071022

10081023 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 1046

10311046

10321047### Beta User Profile Enrollment URL

10331048

1034- `BetaUserProfileEnrollmentURL object { expires_at, type, url }`

1049- `BetaUserProfileEnrollmentURL object`

10351050

10361051 - `expires_at: string`

10371052

10381053 A timestamp in RFC 3339 format

10391054

1055 format: date-time

1056

10401057 - `type: "enrollment_url"`

10411058

10421059 Object type. Always `enrollment_url`.

10431060

1044 - `"enrollment_url"`

1045

10461061 - `url: string`

10471062

10481063 Enrollment URL to send to the end user. Valid until `expires_at`.

from line 1064

10491064

10501065### Beta User Profile Trust Grant

10511066

1052- `BetaUserProfileTrustGrant object { status }`

1067- `BetaUserProfileTrustGrant object`

10531068

10541069 - `status: "active" or "pending" or "rejected"`

10551070

api/beta/user_profiles/create Changed · +20 / -19 lines

# Create User Profile ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create User Profile ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create User Profile

3url: https://platform.claude.com/docs/en/api/beta/user_profiles/create

4---

1# Create User Profile

6## Create User Profile

3**POST** `/v1/user_profiles`

8**post** `/v1/user_profiles`

105Create User Profile

116

12### Header Parameters

7## Headers

138

149- `"anthropic-beta": optional array of AnthropicBeta`

1510

from line 82

8782

8883 - `"mid-conversation-tool-changes-2026-07-01"`

8984

90### Body Parameters

85## Body parameters

9186

9287- `access_type: optional "application" or "passthrough"`

9388

from line 96

10196

10297 Platform's own identifier for this user. Not enforced unique. Maximum 255 characters.

10398

99 minLength: 1, maxLength: 255

100

104101- `metadata: optional map[string]`

105102

106103 Free-form key-value data to attach to this user profile. Maximum 16 keys, with keys up to 64 characters and values up to 512 characters. Values must be non-empty strings.

from line 106

109106

110107 Optional for all profiles. Real-world name of the entity this profile represents (company or individual); for a resold-to company (`relationship` `resold` / `access_type` `passthrough`), that company's name where known. Maximum 255 characters.

111108

109 minLength: 1, maxLength: 255

110

112111- `relationship: optional "external" or "resold" or "internal"`

113112

114113 How the entity behind a user profile relates to the platform that owns the API key. `external`: an individual end-user of the platform. `resold`: a company the platform resells Claude access to. `internal`: the platform's own usage.

from line 118

119118

120119 - `"internal"`

121120

122### Returns

121## Returns

123122

124- `BetaUserProfile object { id, created_at, metadata, 7 more }`

123- `BetaUserProfile object`

125124

126125 - `id: string`

127126

from line 130

131130

132131 A timestamp in RFC 3339 format

133132

133 format: date-time

134

134135 - `metadata: map[string]`

135136

136137 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 154

153154

154155 Object type. Always `user_profile`.

155156

156 - `"user_profile"`

157

158157 - `updated_at: string`

159158

160159 A timestamp in RFC 3339 format

161160

161 format: date-time

162

162163 - `access_type: optional "application" or "passthrough"`

163164

164165 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 186

185186

186187 - `"internal"`

187188

188### Example

189## Example

189190

190```http

191```bash

191192curl https://api.anthropic.com/v1/user_profiles \

192193 -H 'Content-Type: application/json' \

193194 -H 'anthropic-version: 2023-06-01' \

from line 200

199200 }'

200201```

201202

202#### Response

203### Response (200)

203204

204205```json

205206{

api/beta/user_profiles/create_enrollment_url Changed · +11 / -16 lines

# Create Enrollment URL ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Create Enrollment URL ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Enrollment URL

3url: https://platform.claude.com/docs/en/api/beta/user_profiles/create_enrollment_url

4---

1# Create Enrollment URL

6## Create Enrollment URL

3**POST** `/v1/user_profiles/{user_profile_id}/enrollment_url`

8**post** `/v1/user_profiles/{user_profile_id}/enrollment_url`

105Create Enrollment URL

116

12### Path Parameters

7## Path parameters

138

149- `user_profile_id: string`

1510

16### Header Parameters

11## Headers

1712

1813- `"anthropic-beta": optional array of AnthropicBeta`

1914

from line 86

9186

9287 - `"mid-conversation-tool-changes-2026-07-01"`

9388

94### Returns

89## Returns

9590

96- `BetaUserProfileEnrollmentURL object { expires_at, type, url }`

91- `BetaUserProfileEnrollmentURL object`

9792

9893 - `expires_at: string`

9994

10095 A timestamp in RFC 3339 format

10196

97 format: date-time

10299 - `type: "enrollment_url"`

103100

104101 Object type. Always `enrollment_url`.

105102

106 - `"enrollment_url"`

107

108103 - `url: string`

109104

110105 Enrollment URL to send to the end user. Valid until `expires_at`.

111106

112### Example

107## Example

113108

114```http

109```bash

115110curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID/enrollment_url \

116111 -X POST \

117112 -H 'anthropic-version: 2023-06-01' \

from line 114

119114 -H "X-Api-Key: $ANTHROPIC_API_KEY"

120115```

121116

122#### Response

117### Response (200)

123118

124119```json

125120{

api/beta/user_profiles/list Changed · +16 / -17 lines

# List User Profiles ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List User Profiles ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List User Profiles

3url: https://platform.claude.com/docs/en/api/beta/user_profiles/list

4---

1# List User Profiles

6## List User Profiles

3**GET** `/v1/user_profiles`

8**get** `/v1/user_profiles`

105List User Profiles

116

12### Query Parameters

7## Query parameters

138

149- `limit: optional number`

1510

1611 Query parameter for limit

1712

13 format: int32

1815- `order: optional "asc" or "desc"`

1916

2017 Query parameter for order

from line 24

2724

2825 Query parameter for page

2926

30### Header Parameters

27## Headers

3128

3229- `"anthropic-beta": optional array of AnthropicBeta`

3330

from line 102

105102

106103 - `"mid-conversation-tool-changes-2026-07-01"`

107104

108### Returns

105## Returns

109106

110107- `data: array of BetaUserProfile`

111108

from line 116

119116

120117 A timestamp in RFC 3339 format

121118

119 format: date-time

120

122121 - `metadata: map[string]`

123122

124123 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 140

141140

142141 Object type. Always `user_profile`.

143142

144 - `"user_profile"`

145

146143 - `updated_at: string`

147144

148145 A timestamp in RFC 3339 format

149146

147 format: date-time

148

150149 - `access_type: optional "application" or "passthrough"`

151150

152151 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 176

177176

178177 Cursor for the next page, or `null` when there are no more results.

179178

180### Example

179## Example

181180

182```http

181```bash

183182curl https://api.anthropic.com/v1/user_profiles \

184183 -H 'anthropic-version: 2023-06-01' \

185184 -H 'anthropic-beta: user-profiles-2026-08-18' \

from line 185

186185 -H "X-Api-Key: $ANTHROPIC_API_KEY"

187186```

188187

189#### Response

188### Response (200)

190189

191190```json

192191{

api/beta/user_profiles/retrieve Changed · +13 / -16 lines

# Get User Profile ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get User Profile ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get User Profile

3url: https://platform.claude.com/docs/en/api/beta/user_profiles/retrieve

4---

1# Get User Profile

6## Get User Profile

3**GET** `/v1/user_profiles/{user_profile_id}`

8**get** `/v1/user_profiles/{user_profile_id}`

105Get User Profile

116

12### Path Parameters

7## Path parameters

138

149- `user_profile_id: string`

1510

16### Header Parameters

11## Headers

1712

1813- `"anthropic-beta": optional array of AnthropicBeta`

1914

from line 86

9186

9287 - `"mid-conversation-tool-changes-2026-07-01"`

9388

94### Returns

89## Returns

9590

96- `BetaUserProfile object { id, created_at, metadata, 7 more }`

91- `BetaUserProfile object`

9792

9893 - `id: string`

9994

from line 98

10398

10499 A timestamp in RFC 3339 format

105100

101 format: date-time

102

106103 - `metadata: map[string]`

107104

108105 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 122

125122

126123 Object type. Always `user_profile`.

127124

128 - `"user_profile"`

129

130125 - `updated_at: string`

131126

132127 A timestamp in RFC 3339 format

133128

129 format: date-time

130

134131 - `access_type: optional "application" or "passthrough"`

135132

136133 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 154

157154

158155 - `"internal"`

159156

160### Example

157## Example

161158

162```http

159```bash

163160curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

164161 -H 'anthropic-version: 2023-06-01' \

165162 -H 'anthropic-beta: user-profiles-2026-08-18' \

from line 163

166163 -H "X-Api-Key: $ANTHROPIC_API_KEY"

167164```

168165

169#### Response

166### Response (200)

170167

171168```json

172169{

api/beta/user_profiles/update Changed · +21 / -20 lines

# Update User Profile ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Update User Profile ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Update User Profile

3url: https://platform.claude.com/docs/en/api/beta/user_profiles/update

4---

1# Update User Profile

6## Update User Profile

3**POST** `/v1/user_profiles/{user_profile_id}`

8**post** `/v1/user_profiles/{user_profile_id}`

105Update User Profile

116

12### Path Parameters

7## Path parameters

138

149- `user_profile_id: string`

1510

16### Header Parameters

11## Headers

1712

1813- `"anthropic-beta": optional array of AnthropicBeta`

1914

from line 86

9186

9287 - `"mid-conversation-tool-changes-2026-07-01"`

9388

94### Body Parameters

89## Body parameters

9590

9691- `access_type: optional "application" or "passthrough" or null`

9792

from line 100

105100

106101 If present, replaces the stored external_id. Omit to leave unchanged. Maximum 255 characters.

107102

103 minLength: 1, maxLength: 255

104

108105- `metadata: optional map[string]`

109106

110107 Key-value pairs to merge into the stored metadata. Keys provided overwrite existing values. To remove a key, set its value to an empty string. Keys not provided are left unchanged. Maximum 16 keys, with keys up to 64 characters and values up to 512 characters.

from line 110

113110

114111 If present, replaces the stored name. Omit to leave unchanged. Maximum 255 characters.

115112

113 minLength: 1, maxLength: 255

114

116115- `relationship: optional "external" or "resold" or "internal" or null`

117116

118117 How the entity behind a user profile relates to the platform that owns the API key. `external`: an individual end-user of the platform. `resold`: a company the platform resells Claude access to. `internal`: the platform's own usage.

from line 122

123122

124123 - `"internal"`

125124

126### Returns

125## Returns

127126

128- `BetaUserProfile object { id, created_at, metadata, 7 more }`

127- `BetaUserProfile object`

129128

130129 - `id: string`

131130

from line 134

135134

136135 A timestamp in RFC 3339 format

137136

137 format: date-time

138

138139 - `metadata: map[string]`

139140

140141 Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

from line 158

157158

158159 Object type. Always `user_profile`.

159160

160 - `"user_profile"`

161

162161 - `updated_at: string`

163162

164163 A timestamp in RFC 3339 format

165164

165 format: date-time

166

166167 - `access_type: optional "application" or "passthrough"`

167168

168169 How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.

from line 190

189190

190191 - `"internal"`

191192

192### Example

193## Example

193194

194```http

195```bash

195196curl https://api.anthropic.com/v1/user_profiles/$USER_PROFILE_ID \

196197 -H 'Content-Type: application/json' \

197198 -H 'anthropic-version: 2023-06-01' \

from line 203

202203 }'

203204```

204205

205#### Response

206### Response (200)

206207

207208```json

208209{

api/beta/vaults Changed · +317 / -1466 lines

### Headers ### Body parameters #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## Vaults › Credentials ### Create Credential #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Credentials #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Credential #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Delete Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Archive Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Validate Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Header Parameters ### Body Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Credentials ## Create Credential ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## List Credentials ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Get Credential ### Path Parameters ### Header Parameters #### Response ## Update Credential ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Delete Credential ### Path Parameters ### Header Parameters #### Response ## Archive Credential ### Path Parameters ### Header Parameters #### Response ## Validate Credential ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Beta Managed Agents Credential ### Beta Managed Agents Credential Networking Params ### Beta Managed Agents Credential Validation ### Beta Managed Agents Credential Validation Status ### Beta Managed Agents Deleted Credential ### Beta Managed Agents Environment Variable Auth Response ### Beta Managed Agents Environment Variable Create Params ### Beta Managed Agents Environment Variable Update Params ### Beta Managed Agents Injection Location Params ### Beta Managed Agents Injection Location Response ### Beta Managed Agents Injection Location Update Params ### Beta Managed Agents Limited Credential Networking Params ### Beta Managed Agents Limited Credential Networking Response ### Beta Managed Agents MCP OAuth Auth Response ### Beta Managed Agents MCP OAuth Create Params ### Beta Managed Agents MCP OAuth Refresh Params ### Beta Managed Agents MCP OAuth Refresh Response ### Beta Managed Agents MCP OAuth Refresh Update Params ### Beta Managed Agents MCP OAuth Update Params ### Beta Managed Agents MCP Probe ### Beta Managed Agents Refresh HTTP Response ### Beta Managed Agents Refresh Object ### Beta Managed Agents Static Bearer Auth Response ### Beta Managed Agents Static Bearer Create Params ### Beta Managed Agents Static Bearer Update Params ### Beta Managed Agents Token Endpoint Auth Basic Param ### Beta Managed Agents Token Endpoint Auth Basic Response ### Beta Managed Agents Token Endpoint Auth Basic Update Param ### Beta Managed Agents Token Endpoint Auth None Param ### Beta Managed Agents Token Endpoint Auth None Response ### Beta Managed Agents Token Endpoint Auth Post Param ### Beta Managed Agents Token Endpoint Auth Post Response ### Beta Managed Agents Token Endpoint Auth Post Update Param ### Beta Managed Agents Unrestricted Credential Networking Params ### Beta Managed Agents Unrestricted Credential Networking Response

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 1

1---

2title: Vaults

3url: https://platform.claude.com/docs/en/api/beta/vaults

4---

61# Vaults

83## Create Vault

10**post** `/v1/vaults`

5**POST** `/v1/vaults`

116

127Create Vault

138

14### Header Parameters

9### Headers

1510

1611- `"anthropic-beta": optional array of AnthropicBeta`

1712

from line 84

8984

9085 - `"mid-conversation-tool-changes-2026-07-01"`

9186

92### Body Parameters

87### Body parameters

9388

9489- `display_name: string`

9590

9691 Human-readable name for the vault. 1-255 characters.

9792

93 minLength: 1, maxLength: 255

9895- `metadata: optional map[string]`

9996

10097 Arbitrary key-value metadata to attach to the vault. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

10198

10299### Returns

103100

104- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

101- `BetaManagedAgentsVault object`

105102

106103 A vault that stores credentials for use by agents during sessions.

107104

from line 110

113110

114111 A timestamp in RFC 3339 format

115112

113 format: date-time

114

116115 - `created_at: string`

117116

118117 A timestamp in RFC 3339 format

119118

119 format: date-time

120

120121 - `display_name: string`

121122

122123 Human-readable name for the vault.

from line 128

127128

128129 - `type: "vault"`

129130

130 - `"vault"`

131

132131 - `updated_at: string`

133132

134133 A timestamp in RFC 3339 format

135134

135 format: date-time

136

136137### Example

137138

138```http

139```bash

139140curl https://api.anthropic.com/v1/vaults \

140141 -H 'Content-Type: application/json' \

141142 -H 'anthropic-version: 2023-06-01' \

from line 150

149150 }'

150151```

151152

152#### Response

153#### Response (200)

153154

154155```json

155156{

from line 168

167168

168169## List Vaults

169170

170**get** `/v1/vaults`

171**GET** `/v1/vaults`

171172

172173List Vaults

173174

174### Query Parameters

175### Query parameters

175176

176177- `include_archived: optional boolean`

177178

from line 182

181182

182183 Maximum number of vaults to return per page. Defaults to 20, maximum 100.

183184

185 format: int32

186

184187- `page: optional string`

185188

186189 Opaque pagination token from a previous `list_vaults` response.

187190

188### Header Parameters

191### Headers

189192

190193- `"anthropic-beta": optional array of AnthropicBeta`

191194

from line 280

277280

278281 A timestamp in RFC 3339 format

279282

283 format: date-time

284

280285 - `created_at: string`

281286

282287 A timestamp in RFC 3339 format

283288

289 format: date-time

290

284291 - `display_name: string`

285292

286293 Human-readable name for the vault.

from line 298

291298

292299 - `type: "vault"`

293300

294 - `"vault"`

295

296301 - `updated_at: string`

297302

298303 A timestamp in RFC 3339 format

299304

305 format: date-time

306

300307- `next_page: optional string or null`

301308

302309 Pagination token for the next page, or null if no more results.

303310

304311### Example

305312

306```http

313```bash

307314curl https://api.anthropic.com/v1/vaults \

308315 -H 'anthropic-version: 2023-06-01' \

309316 -H 'anthropic-beta: managed-agents-2026-04-01' \

310317 -H "X-Api-Key: $ANTHROPIC_API_KEY"

311318```

312319

313#### Response

320#### Response (200)

314321

315322```json

316323{

from line 340

333340

334341## Get Vault

335342

336**get** `/v1/vaults/{vault_id}`

343**GET** `/v1/vaults/{vault_id}`

337344

338345Get Vault

339346

340### Path Parameters

347### Path parameters

341348

342349- `vault_id: string`

343350

344### Header Parameters

351### Headers

345352

346353- `"anthropic-beta": optional array of AnthropicBeta`

347354

from line 428

421428

422429### Returns

423430

424- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

431- `BetaManagedAgentsVault object`

425432

426433 A vault that stores credentials for use by agents during sessions.

427434

from line 440

433440

434441 A timestamp in RFC 3339 format

435442

443 format: date-time

444

436445 - `created_at: string`

437446

438447 A timestamp in RFC 3339 format

439448

449 format: date-time

450

440451 - `display_name: string`

441452

442453 Human-readable name for the vault.

from line 458

447458

448459 - `type: "vault"`

449460

450 - `"vault"`

451

452461 - `updated_at: string`

453462

454463 A timestamp in RFC 3339 format

455464

465 format: date-time

466

456467### Example

457468

458```http

469```bash

459470curl https://api.anthropic.com/v1/vaults/$VAULT_ID \

460471 -H 'anthropic-version: 2023-06-01' \

461472 -H 'anthropic-beta: managed-agents-2026-04-01' \

462473 -H "X-Api-Key: $ANTHROPIC_API_KEY"

463474```

464475

465#### Response

476#### Response (200)

466477

467478```json

468479{

from line 491

480491

481492## Update Vault

482493

483**post** `/v1/vaults/{vault_id}`

494**POST** `/v1/vaults/{vault_id}`

484495

485496Update Vault

486497

487### Path Parameters

498### Path parameters

488499

489500- `vault_id: string`

490501

491### Header Parameters

502### Headers

492503

493504- `"anthropic-beta": optional array of AnthropicBeta`

494505

from line 577

566577

567578 - `"mid-conversation-tool-changes-2026-07-01"`

568579

569### Body Parameters

580### Body parameters

570581

571582- `display_name: optional string or null`

572583

573584 Updated human-readable name for the vault. 1-255 characters.

574585

586 minLength: 1, maxLength: 255

587

575588- `metadata: optional map[string] or null`

576589

577590 Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.

578591

579592### Returns

580593

581- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

594- `BetaManagedAgentsVault object`

582595

583596 A vault that stores credentials for use by agents during sessions.

584597

from line 603

590603

591604 A timestamp in RFC 3339 format

592605

606 format: date-time

607

593608 - `created_at: string`

594609

595610 A timestamp in RFC 3339 format

596611

612 format: date-time

613

597614 - `display_name: string`

598615

599616 Human-readable name for the vault.

from line 621

604621

605622 - `type: "vault"`

606623

607 - `"vault"`

608

609624 - `updated_at: string`

610625

611626 A timestamp in RFC 3339 format

612627

628 format: date-time

629

613630### Example

614631

615```http

632```bash

616633curl https://api.anthropic.com/v1/vaults/$VAULT_ID \

617634 -H 'Content-Type: application/json' \

618635 -H 'anthropic-version: 2023-06-01' \

from line 643

626643 }'

627644```

628645

629#### Response

646#### Response (200)

630647

631648```json

632649{

from line 661

644661

645662## Delete Vault

646663

647**delete** `/v1/vaults/{vault_id}`

664**DELETE** `/v1/vaults/{vault_id}`

648665

649666Delete Vault

650667

651### Path Parameters

668### Path parameters

652669

653670- `vault_id: string`

654671

655### Header Parameters

672### Headers

656673

657674- `"anthropic-beta": optional array of AnthropicBeta`

658675

from line 749

732749

733750### Returns

734751

735- `BetaManagedAgentsDeletedVault object { id, type }`

752- `BetaManagedAgentsDeletedVault object`

736753

737754 Confirmation of a deleted vault.

738755

from line 759

742759

743760 - `type: "vault_deleted"`

744761

745 - `"vault_deleted"`

746

747762### Example

748763

749```http

764```bash

750765curl https://api.anthropic.com/v1/vaults/$VAULT_ID \

751766 -X DELETE \

752767 -H 'anthropic-version: 2023-06-01' \

from line 769

754769 -H "X-Api-Key: $ANTHROPIC_API_KEY"

755770```

756771

757#### Response

772#### Response (200)

758773

759774```json

760775{

from line 780

765780

766781## Archive Vault

767782

768**post** `/v1/vaults/{vault_id}/archive`

783**POST** `/v1/vaults/{vault_id}/archive`

769784

770785Archive Vault

771786

772### Path Parameters

787### Path parameters

773788

774789- `vault_id: string`

775790

776### Header Parameters

791### Headers

777792

778793- `"anthropic-beta": optional array of AnthropicBeta`

779794

from line 868

853868

854869### Returns

855870

856- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

871- `BetaManagedAgentsVault object`

857872

858873 A vault that stores credentials for use by agents during sessions.

859874

from line 880

865880

866881 A timestamp in RFC 3339 format

867882

883 format: date-time

884

868885 - `created_at: string`

869886

870887 A timestamp in RFC 3339 format

871888

889 format: date-time

890

872891 - `display_name: string`

873892

874893 Human-readable name for the vault.

from line 898

879898

880899 - `type: "vault"`

881900

882 - `"vault"`

883

884901 - `updated_at: string`

885902

886903 A timestamp in RFC 3339 format

887904

905 format: date-time

906

888907### Example

889908

890```http

909```bash

891910curl https://api.anthropic.com/v1/vaults/$VAULT_ID/archive \

892911 -X POST \

893912 -H 'anthropic-version: 2023-06-01' \

from line 914

895914 -H "X-Api-Key: $ANTHROPIC_API_KEY"

896915```

897916

898#### Response

917#### Response (200)

899918

900919```json

901920{

from line 930

911930}

912931```

913932

914## Domain Types

933## Domain types

915934

916935### Beta Managed Agents Deleted Vault

917936

918- `BetaManagedAgentsDeletedVault object { id, type }`

937- `BetaManagedAgentsDeletedVault object`

919938

920939 Confirmation of a deleted vault.

921940

from line 944

925944

926945 - `type: "vault_deleted"`

927946

928 - `"vault_deleted"`

929

930947### Beta Managed Agents Vault

931948

932- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

949- `BetaManagedAgentsVault object`

933950

934951 A vault that stores credentials for use by agents during sessions.

935952

from line 958

941958

942959 A timestamp in RFC 3339 format

943960

961 format: date-time

962

944963 - `created_at: string`

945964

946965 A timestamp in RFC 3339 format

947966

967 format: date-time

968

948969 - `display_name: string`

949970

950971 Human-readable name for the vault.

from line 976

955976

956977 - `type: "vault"`

957978

958 - `"vault"`

959

960979 - `updated_at: string`

961980

962981 A timestamp in RFC 3339 format

963982

964# Credentials

965

966## Create Credential

967

968**post** `/v1/vaults/{vault_id}/credentials`

983 format: date-time

984

985## Vaults › Credentials

986

987### Create Credential

988

989**POST** `/v1/vaults/{vault_id}/credentials`

969990

970991Create Credential

971992

972### Path Parameters

993#### Path parameters

973994

974995- `vault_id: string`

975996

976### Header Parameters

997#### Headers

977998

978999- `"anthropic-beta": optional array of AnthropicBeta`

9791000

from line 1072

10511072

10521073 - `"mid-conversation-tool-changes-2026-07-01"`

10531074

1054### Body Parameters

1075#### Body parameters

10551076

10561077- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`

10571078

10581079 Authentication details for creating a credential.

10591080

1060 - `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`

1081 - `BetaManagedAgentsMCPOAuthCreateParams object`

10611082

10621083 Parameters for creating an MCP OAuth credential.

10631084

from line 1086

10651086

10661087 OAuth access token.

10671088

1089 minLength: 1, maxLength: 8192

1090

10681091 - `mcp_server_url: string`

10691092

10701093 URL of the MCP server this credential authenticates against.

10711094

1095 minLength: 1, maxLength: 2047

1096

10721097 - `type: "mcp_oauth"`

10731098

1074 - `"mcp_oauth"`

1075

10761099 - `expires_at: optional string or null`

10771100

10781101 A timestamp in RFC 3339 format

10791102

1103 format: date-time

1104

10801105 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`

10811106

10821107 OAuth refresh token parameters for creating a credential with refresh support.

from line 1110

10851110

10861111 OAuth client ID.

10871112

1113 minLength: 1, maxLength: 1024

1114

10881115 - `refresh_token: string`

10891116

10901117 OAuth refresh token.

10911118

1119 minLength: 1, maxLength: 4096

1120

10921121 - `token_endpoint: string`

10931122

10941123 Token endpoint URL used to refresh the access token.

10951124

1125 minLength: 1, maxLength: 2047

1126

10961127 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

10971128

10981129 Token endpoint requires no client authentication.

10991130

1100 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

1131 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`

11011132

11021133 Token endpoint requires no client authentication.

11031134

11041135 - `type: "none"`

11051136

1106 - `"none"`

1107

1108 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

1137 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`

11091138

11101139 Token endpoint uses HTTP Basic authentication with client credentials.

11111140

from line 1142

11131142

11141143 OAuth client secret.

11151144

1145 minLength: 1, maxLength: 512

1146

11161147 - `type: "client_secret_basic"`

11171148

1118 - `"client_secret_basic"`

1119

1120 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

1149 - `BetaManagedAgentsTokenEndpointAuthPostParam object`

11211150

11221151 Token endpoint uses POST body authentication with client credentials.

11231152

from line 1154

11251154

11261155 OAuth client secret.

11271156

1157 minLength: 1, maxLength: 512

1158

11281159 - `type: "client_secret_post"`

11291160

1130 - `"client_secret_post"`

1131

11321161 - `resource: optional string or null`

11331162

11341163 OAuth resource indicator.

11351164

1165 minLength: 1, maxLength: 2047

1166

11361167 - `scope: optional string or null`

11371168

11381169 OAuth scope for the refresh request.

11391170

1140 - `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`

1171 minLength: 1, maxLength: 8192

1172

1173 - `BetaManagedAgentsStaticBearerCreateParams object`

11411174

11421175 Parameters for creating a static bearer token credential.

11431176

from line 1178

11451178

11461179 Static bearer token value.

11471180

1181 minLength: 1, maxLength: 8192

1182

11481183 - `mcp_server_url: string`

11491184

11501185 URL of the MCP server this credential authenticates against.

11511186

1187 minLength: 1, maxLength: 2047

1188

11521189 - `type: "static_bearer"`

11531190

1154 - `"static_bearer"`

1155

1156 - `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`

1191 - `BetaManagedAgentsEnvironmentVariableCreateParams object`

11571192

11581193 Parameters for creating an environment variable credential.

11591194

from line 1196

11611196

11621197 Outbound hosts the secret value is substituted on.

11631198

1164 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

1199 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

11651200

11661201 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

11671202

11681203 - `type: "unrestricted"`

11691204

1170 - `"unrestricted"`

1171

1172 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

1205 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

11731206

11741207 Substitute the secret only on requests to the listed hosts.

11751208

from line 1212

11791212

11801213 - `type: "limited"`

11811214

1182 - `"limited"`

1183

11841215 - `secret_name: string`

11851216

11861217 Name of the environment variable. Immutable after create.

11871218

1219 minLength: 1, maxLength: 255

1220

11881221 - `secret_value: string`

11891222

11901223 Secret value. Write-only; never returned in responses.

11911224

1225 minLength: 1, maxLength: 4096

1226

11921227 - `type: "environment_variable"`

11931228

1194 - `"environment_variable"`

1195

11961229 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`

11971230

11981231 Where in the outbound request the secret value may be substituted.

from line 1242

12091242

12101243 Human-readable name for the credential. Up to 255 characters.

12111244

1245 maxLength: 255

1246

12121247- `metadata: optional map[string]`

12131248

12141249 Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

12151250

1216### Returns

1217

1218- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

1251#### Returns

1252

1253- `BetaManagedAgentsCredential object`

12191254

12201255 A credential stored in a vault. Sensitive fields are never returned in responses.

12211256

from line 1262

12271262

12281263 A timestamp in RFC 3339 format

12291264

1265 format: date-time

1266

12301267 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

12311268

12321269 Authentication details for a credential.

12331270

1234 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

1271 - `BetaManagedAgentsMCPOAuthAuthResponse object`

12351272

12361273 OAuth credential details for an MCP server.

12371274

from line 1278

12411278

12421279 - `type: "mcp_oauth"`

12431280

1244 - `"mcp_oauth"`

1245

12461281 - `expires_at: optional string or null`

12471282

12481283 A timestamp in RFC 3339 format

12491284

1285 format: date-time

1286

12501287 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

12511288

12521289 OAuth refresh token configuration returned in credential responses.

from line 1300

12631300

12641301 Token endpoint requires no client authentication.

12651302

1266 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

1303 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

12671304

12681305 Token endpoint requires no client authentication.

12691306

12701307 - `type: "none"`

12711308

1272 - `"none"`

1273

1274 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

1309 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

12751310

12761311 Token endpoint uses HTTP Basic authentication with client credentials.

12771312

12781313 - `type: "client_secret_basic"`

12791314

1280 - `"client_secret_basic"`

1281

1282 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

1315 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

12831316

12841317 Token endpoint uses POST body authentication with client credentials.

12851318

12861319 - `type: "client_secret_post"`

12871320

1288 - `"client_secret_post"`

1289

12901321 - `resource: optional string or null`

12911322

12921323 OAuth resource indicator.

from line 1326

12951326

12961327 OAuth scope for the refresh request.

12971328

1298 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

1329 - `BetaManagedAgentsStaticBearerAuthResponse object`

12991330

13001331 Static bearer token credential details for an MCP server.

13011332

from line 1336

13051336

13061337 - `type: "static_bearer"`

13071338

1308 - `"static_bearer"`

1309

1310 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

1339 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

13111340

13121341 Environment variable credential details. The secret value is never returned.

13131342

from line 1356

13271356

13281357 Outbound hosts the secret value is substituted on.

13291358

1330 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

1359 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

13311360

13321361 The secret is substituted on any host the session's Environment network policy permits egress to.

13331362

13341363 - `type: "unrestricted"`

13351364

1336 - `"unrestricted"`

1337

1338 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

1365 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

13391366

13401367 The secret is substituted only on requests to the listed hosts.

13411368

from line 1372

13451372

13461373 - `type: "limited"`

13471374

1348 - `"limited"`

1349

13501375 - `secret_name: string`

13511376

13521377 Name of the environment variable.

13531378

13541379 - `type: "environment_variable"`

13551380

1356 - `"environment_variable"`

1357

13581381 - `created_at: string`

13591382

13601383 A timestamp in RFC 3339 format

13611384

1385 format: date-time

1386

13621387 - `metadata: map[string]`

13631388

13641389 Arbitrary key-value metadata attached to the credential.

13651390

13661391 - `type: "vault_credential"`

13671392

1368 - `"vault_credential"`

1369

13701393 - `updated_at: string`

13711394

13721395 A timestamp in RFC 3339 format

13731396

1397 format: date-time

1398

13741399 - `vault_id: string`

13751400

13761401 Identifier of the vault this credential belongs to.

from line 1404

13791404

13801405 Human-readable name for the credential.

13811406

1382### Example

1383

1384```http

1407#### Example

1408

1409```bash

13851410curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

13861411 -H 'Content-Type: application/json' \

13871412 -H 'anthropic-version: 2023-06-01' \

from line 1425

14001425 }'

14011426```

14021427

1403#### Response

1428##### Response (200)

14041429

14051430```json

14061431{

from line 1446

14211446}

14221447```

14231448

1424## List Credentials

1425

1426**get** `/v1/vaults/{vault_id}/credentials`

1449### List Credentials

1450

1451**GET** `/v1/vaults/{vault_id}/credentials`

14271452

14281453List Credentials

14291454

1430### Path Parameters

1455#### Path parameters

14311456

14321457- `vault_id: string`

14331458

1434### Query Parameters

1459#### Query parameters

14351460

14361461- `include_archived: optional boolean`

14371462

from line 1466

14411466

14421467 Maximum number of credentials to return per page. Defaults to 20, maximum 100.

14431468

1469 format: int32

1470

14441471- `page: optional string`

14451472

14461473 Opaque pagination token from a previous `list_credentials` response.

14471474

1448### Header Parameters

1475#### Headers

14491476

14501477- `"anthropic-beta": optional array of AnthropicBeta`

14511478

from line 1550

15231550

15241551 - `"mid-conversation-tool-changes-2026-07-01"`

15251552

1526### Returns

1553#### Returns

15271554

15281555- `data: optional array of BetaManagedAgentsCredential`

15291556

from line 1564

15371564

15381565 A timestamp in RFC 3339 format

15391566

1567 format: date-time

1568

15401569 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

15411570

15421571 Authentication details for a credential.

15431572

1544 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

1573 - `BetaManagedAgentsMCPOAuthAuthResponse object`

15451574

15461575 OAuth credential details for an MCP server.

15471576

from line 1580

15511580

15521581 - `type: "mcp_oauth"`

15531582

1554 - `"mcp_oauth"`

1555

15561583 - `expires_at: optional string or null`

15571584

15581585 A timestamp in RFC 3339 format

15591586

1587 format: date-time

1588

15601589 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

15611590

15621591 OAuth refresh token configuration returned in credential responses.

from line 1602

15731602

15741603 Token endpoint requires no client authentication.

15751604

1576 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

1605 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

15771606

15781607 Token endpoint requires no client authentication.

15791608

15801609 - `type: "none"`

15811610

1582 - `"none"`

1583

1584 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

1611 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

15851612

15861613 Token endpoint uses HTTP Basic authentication with client credentials.

15871614

15881615 - `type: "client_secret_basic"`

15891616

1590 - `"client_secret_basic"`

1591

1592 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

1617 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

15931618

15941619 Token endpoint uses POST body authentication with client credentials.

15951620

15961621 - `type: "client_secret_post"`

15971622

1598 - `"client_secret_post"`

1599

16001623 - `resource: optional string or null`

16011624

16021625 OAuth resource indicator.

from line 1628

16051628

16061629 OAuth scope for the refresh request.

16071630

1608 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

1631 - `BetaManagedAgentsStaticBearerAuthResponse object`

16091632

16101633 Static bearer token credential details for an MCP server.

16111634

from line 1638

16151638

16161639 - `type: "static_bearer"`

16171640

1618 - `"static_bearer"`

1619

1620 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

1641 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

16211642

16221643 Environment variable credential details. The secret value is never returned.

16231644

from line 1658

16371658

16381659 Outbound hosts the secret value is substituted on.

16391660

1640 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

1661 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

16411662

16421663 The secret is substituted on any host the session's Environment network policy permits egress to.

16431664

16441665 - `type: "unrestricted"`

16451666

1646 - `"unrestricted"`

1647

1648 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

1667 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

16491668

16501669 The secret is substituted only on requests to the listed hosts.

16511670

from line 1674

16551674

16561675 - `type: "limited"`

16571676

1658 - `"limited"`

1659

16601677 - `secret_name: string`

16611678

16621679 Name of the environment variable.

16631680

16641681 - `type: "environment_variable"`

16651682

1666 - `"environment_variable"`

1667

16681683 - `created_at: string`

16691684

16701685 A timestamp in RFC 3339 format

16711686

1687 format: date-time

1688

16721689 - `metadata: map[string]`

16731690

16741691 Arbitrary key-value metadata attached to the credential.

16751692

16761693 - `type: "vault_credential"`

16771694

1678 - `"vault_credential"`

1679

16801695 - `updated_at: string`

16811696

16821697 A timestamp in RFC 3339 format

16831698

1699 format: date-time

1700

16841701 - `vault_id: string`

16851702

16861703 Identifier of the vault this credential belongs to.

from line 1710

16931710

16941711 Pagination token for the next page, or null if no more results.

16951712

1696### Example

1697

1698```http

1713#### Example

1714

1715```bash

16991716curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

17001717 -H 'anthropic-version: 2023-06-01' \

17011718 -H 'anthropic-beta: managed-agents-2026-04-01' \

17021719 -H "X-Api-Key: $ANTHROPIC_API_KEY"

17031720```

17041721

1705#### Response

1722##### Response (200)

17061723

17071724```json

17081725{

from line 1745

17281745}

17291746```

17301747

1731## Get Credential

1732

1733**get** `/v1/vaults/{vault_id}/credentials/{credential_id}`

1748### Get Credential

1749

1750**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`

17341751

17351752Get Credential

17361753

1737### Path Parameters

1754#### Path parameters

17381755

17391756- `vault_id: string`

17401757

17411758- `credential_id: string`

17421759

1743### Header Parameters

1760#### Headers

17441761

17451762- `"anthropic-beta": optional array of AnthropicBeta`

17461763

from line 1835

18181835

18191836 - `"mid-conversation-tool-changes-2026-07-01"`

18201837

1821### Returns

1822

1823- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

1838#### Returns

1839

1840- `BetaManagedAgentsCredential object`

18241841

18251842 A credential stored in a vault. Sensitive fields are never returned in responses.

18261843

from line 1849

18321849

18331850 A timestamp in RFC 3339 format

18341851

1852 format: date-time

1853

18351854 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

18361855

18371856 Authentication details for a credential.

18381857

1839 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

1858 - `BetaManagedAgentsMCPOAuthAuthResponse object`

18401859

18411860 OAuth credential details for an MCP server.

18421861

from line 1865

18461865

18471866 - `type: "mcp_oauth"`

18481867

1849 - `"mcp_oauth"`

1850

18511868 - `expires_at: optional string or null`

18521869

18531870 A timestamp in RFC 3339 format

18541871

1872 format: date-time

1873

18551874 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

18561875

18571876 OAuth refresh token configuration returned in credential responses.

from line 1887

18681887

18691888 Token endpoint requires no client authentication.

18701889

1871 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

1890 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

18721891

18731892 Token endpoint requires no client authentication.

18741893

18751894 - `type: "none"`

18761895

1877 - `"none"`

1878

1879 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

1896 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

18801897

18811898 Token endpoint uses HTTP Basic authentication with client credentials.

18821899

18831900 - `type: "client_secret_basic"`

18841901

1885 - `"client_secret_basic"`

1886

1887 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

1902 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

18881903

18891904 Token endpoint uses POST body authentication with client credentials.

18901905

18911906 - `type: "client_secret_post"`

18921907

1893 - `"client_secret_post"`

1894

18951908 - `resource: optional string or null`

18961909

18971910 OAuth resource indicator.

from line 1913

19001913

19011914 OAuth scope for the refresh request.

19021915

1903 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

1916 - `BetaManagedAgentsStaticBearerAuthResponse object`

19041917

19051918 Static bearer token credential details for an MCP server.

19061919

from line 1923

19101923

19111924 - `type: "static_bearer"`

19121925

1913 - `"static_bearer"`

1914

1915 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

1926 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

19161927

19171928 Environment variable credential details. The secret value is never returned.

19181929

from line 1943

19321943

19331944 Outbound hosts the secret value is substituted on.

19341945

1935 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

1946 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

19361947

19371948 The secret is substituted on any host the session's Environment network policy permits egress to.

19381949

19391950 - `type: "unrestricted"`

19401951

1941 - `"unrestricted"`

1942

1943 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

1952 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

19441953

19451954 The secret is substituted only on requests to the listed hosts.

19461955

from line 1959

19501959

19511960 - `type: "limited"`

19521961

1953 - `"limited"`

1954

19551962 - `secret_name: string`

19561963

19571964 Name of the environment variable.

19581965

19591966 - `type: "environment_variable"`

19601967

1961 - `"environment_variable"`

1962

19631968 - `created_at: string`

19641969

19651970 A timestamp in RFC 3339 format

19661971

1972 format: date-time

1973

19671974 - `metadata: map[string]`

19681975

19691976 Arbitrary key-value metadata attached to the credential.

19701977

19711978 - `type: "vault_credential"`

19721979

1973 - `"vault_credential"`

1974

19751980 - `updated_at: string`

19761981

19771982 A timestamp in RFC 3339 format

19781983

1984 format: date-time

1985

19791986 - `vault_id: string`

19801987

19811988 Identifier of the vault this credential belongs to.

from line 1991

19841991

19851992 Human-readable name for the credential.

19861993

1987### Example

1988

1989```http

1994#### Example

1995

1996```bash

19901997curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

19911998 -H 'anthropic-version: 2023-06-01' \

19921999 -H 'anthropic-beta: managed-agents-2026-04-01' \

19932000 -H "X-Api-Key: $ANTHROPIC_API_KEY"

19942001```

19952002

1996#### Response

2003##### Response (200)

19972004

19982005```json

19992006{

from line 2021

20142021}

20152022```

20162023

2017## Update Credential

2018

2019**post** `/v1/vaults/{vault_id}/credentials/{credential_id}`

2024### Update Credential

2025

2026**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`

20202027

20212028Update Credential

20222029

2023### Path Parameters

2030#### Path parameters

20242031

20252032- `vault_id: string`

20262033

20272034- `credential_id: string`

20282035

2029### Header Parameters

2036#### Headers

20302037

20312038- `"anthropic-beta": optional array of AnthropicBeta`

20322039

from line 2111

21042111

21052112 - `"mid-conversation-tool-changes-2026-07-01"`

21062113

2107### Body Parameters

2114#### Body parameters

21082115

21092116- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`

21102117

21112118 Updated authentication details for a credential.

21122119

2113 - `BetaManagedAgentsMCPOAuthUpdateParams object { type, access_token, expires_at, refresh }`

2120 - `BetaManagedAgentsMCPOAuthUpdateParams object`

21142121

21152122 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.

21162123

21172124 - `type: "mcp_oauth"`

21182125

2119 - `"mcp_oauth"`

2120

21212126 - `access_token: optional string or null`

21222127

21232128 Updated OAuth access token.

21242129

2130 minLength: 1, maxLength: 8192

2131

21252132 - `expires_at: optional string or null`

21262133

21272134 A timestamp in RFC 3339 format

21282135

2136 format: date-time

2137

21292138 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`

21302139

21312140 Parameters for updating OAuth refresh token configuration.

from line 2143

21342143

21352144 Updated OAuth refresh token.

21362145

2146 minLength: 1, maxLength: 4096

2147

21372148 - `scope: optional string or null`

21382149

21392150 Updated OAuth scope for the refresh request.

21402151

2152 maxLength: 8192

2153

21412154 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`

21422155

21432156 Updated HTTP Basic authentication parameters for the token endpoint.

21442157

2145 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

2158 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`

21462159

21472160 Updated HTTP Basic authentication parameters for the token endpoint.

21482161

21492162 - `type: "client_secret_basic"`

21502163

2151 - `"client_secret_basic"`

2152

21532164 - `client_secret: optional string or null`

21542165

21552166 Updated OAuth client secret.

21562167

2157 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

2168 minLength: 1, maxLength: 512

2169

2170 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`

21582171

21592172 Updated POST body authentication parameters for the token endpoint.

21602173

21612174 - `type: "client_secret_post"`

21622175

2163 - `"client_secret_post"`

2164

21652176 - `client_secret: optional string or null`

21662177

21672178 Updated OAuth client secret.

21682179

2169 - `BetaManagedAgentsStaticBearerUpdateParams object { type, token }`

2180 minLength: 1, maxLength: 512

2181

2182 - `BetaManagedAgentsStaticBearerUpdateParams object`

21702183

21712184 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.

21722185

21732186 - `type: "static_bearer"`

21742187

2175 - `"static_bearer"`

2176

21772188 - `token: optional string or null`

21782189

21792190 Updated static bearer token value.

21802191

2181 - `BetaManagedAgentsEnvironmentVariableUpdateParams object { type, injection_location, networking, secret_value }`

2192 minLength: 1, maxLength: 8192

2193

2194 - `BetaManagedAgentsEnvironmentVariableUpdateParams object`

21822195

21832196 Parameters for updating an environment variable credential. `secret_name` is immutable.

21842197

21852198 - `type: "environment_variable"`

21862199

2187 - `"environment_variable"`

2188

21892200 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`

21902201

21912202 Updated injection location.

from line 2213

22022213

22032214 Updated networking scope. Full replacement.

22042215

2205 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

2216 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

22062217

22072218 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

22082219

22092220 - `type: "unrestricted"`

22102221

2211 - `"unrestricted"`

2212

2213 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

2222 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

22142223

22152224 Substitute the secret only on requests to the listed hosts.

22162225

from line 2229

22202229

22212230 - `type: "limited"`

22222231

2223 - `"limited"`

2224

22252232 - `secret_value: optional string or null`

22262233

22272234 Updated secret value.

22282235

2236 minLength: 1, maxLength: 4096

2237

22292238- `display_name: optional string or null`

22302239

22312240 Updated human-readable name for the credential. 1-255 characters.

22322241

2242 minLength: 1, maxLength: 255

2243

22332244- `metadata: optional map[string] or null`

22342245

22352246 Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.

22362247

2237### Returns

2238

2239- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

2248#### Returns

2249

2250- `BetaManagedAgentsCredential object`

22402251

22412252 A credential stored in a vault. Sensitive fields are never returned in responses.

22422253

from line 2259

22482259

22492260 A timestamp in RFC 3339 format

22502261

2262 format: date-time

2263

22512264 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

22522265

22532266 Authentication details for a credential.

22542267

2255 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

2268 - `BetaManagedAgentsMCPOAuthAuthResponse object`

22562269

22572270 OAuth credential details for an MCP server.

22582271

from line 2275

22622275

22632276 - `type: "mcp_oauth"`

22642277

2265 - `"mcp_oauth"`

2266

22672278 - `expires_at: optional string or null`

22682279

22692280 A timestamp in RFC 3339 format

22702281

2282 format: date-time

2283

22712284 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

22722285

22732286 OAuth refresh token configuration returned in credential responses.

from line 2297

22842297

22852298 Token endpoint requires no client authentication.

22862299

2287 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

2300 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

22882301

22892302 Token endpoint requires no client authentication.

22902303

22912304 - `type: "none"`

22922305

2293 - `"none"`

2294

2295 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

2306 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

22962307

22972308 Token endpoint uses HTTP Basic authentication with client credentials.

22982309

22992310 - `type: "client_secret_basic"`

23002311

2301 - `"client_secret_basic"`

2302

2303 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

2312 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

23042313

23052314 Token endpoint uses POST body authentication with client credentials.

23062315

23072316 - `type: "client_secret_post"`

23082317

2309 - `"client_secret_post"`

2310

23112318 - `resource: optional string or null`

23122319

23132320 OAuth resource indicator.

from line 2323

23162323

23172324 OAuth scope for the refresh request.

23182325

2319 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

2326 - `BetaManagedAgentsStaticBearerAuthResponse object`

23202327

23212328 Static bearer token credential details for an MCP server.

23222329

from line 2333

23262333

23272334 - `type: "static_bearer"`

23282335

2329 - `"static_bearer"`

2330

2331 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

2336 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

23322337

23332338 Environment variable credential details. The secret value is never returned.

23342339

from line 2353

23482353

23492354 Outbound hosts the secret value is substituted on.

23502355

2351 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

2356 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

23522357

23532358 The secret is substituted on any host the session's Environment network policy permits egress to.

23542359

23552360 - `type: "unrestricted"`

23562361

2357 - `"unrestricted"`

2358

2359 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

2362 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

23602363

23612364 The secret is substituted only on requests to the listed hosts.

23622365

from line 2369

23662369

23672370 - `type: "limited"`

23682371

2369 - `"limited"`

2370

23712372 - `secret_name: string`

23722373

23732374 Name of the environment variable.

23742375

23752376 - `type: "environment_variable"`

23762377

2377 - `"environment_variable"`

2378

23792378 - `created_at: string`

23802379

23812380 A timestamp in RFC 3339 format

23822381

2382 format: date-time

2383

23832384 - `metadata: map[string]`

23842385

23852386 Arbitrary key-value metadata attached to the credential.

23862387

23872388 - `type: "vault_credential"`

23882389

2389 - `"vault_credential"`

2390

23912390 - `updated_at: string`

23922391

23932392 A timestamp in RFC 3339 format

23942393

2394 format: date-time

2395

23952396 - `vault_id: string`

23962397

23972398 Identifier of the vault this credential belongs to.

from line 2401

24002401

24012402 Human-readable name for the credential.

24022403

2403### Example

2404

2405```http

2404#### Example

2405

2406```bash

24062407curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

24072408 -H 'Content-Type: application/json' \

24082409 -H 'anthropic-version: 2023-06-01' \

from line 2417

24162417 }'

24172418```

24182419

2419#### Response

2420##### Response (200)

24202421

24212422```json

24222423{

from line 2438

24372438}

24382439```

24392440

2440## Delete Credential

2441

2442**delete** `/v1/vaults/{vault_id}/credentials/{credential_id}`

2441### Delete Credential

2442

2443**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`

24432444

24442445Delete Credential

24452446

2446### Path Parameters

2447#### Path parameters

24472448

24482449- `vault_id: string`

24492450

24502451- `credential_id: string`

24512452

2452### Header Parameters

2453#### Headers

24532454

24542455- `"anthropic-beta": optional array of AnthropicBeta`

24552456

from line 2528

25272528

25282529 - `"mid-conversation-tool-changes-2026-07-01"`

25292530

2530### Returns

2531

2532- `BetaManagedAgentsDeletedCredential object { id, type }`

2531#### Returns

2532

2533- `BetaManagedAgentsDeletedCredential object`

25332534

25342535 Confirmation of a deleted credential.

25352536

from line 2540

25392540

25402541 - `type: "vault_credential_deleted"`

25412542

2542 - `"vault_credential_deleted"`

2543

2544### Example

2545

2546```http

2543#### Example

2544

2545```bash

25472546curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

25482547 -X DELETE \

25492548 -H 'anthropic-version: 2023-06-01' \

from line 2550

25512550 -H "X-Api-Key: $ANTHROPIC_API_KEY"

25522551```

25532552

2554#### Response

2553##### Response (200)

25552554

25562555```json

25572556{

from line 2559

25602559}

25612560```

25622561

2563## Archive Credential

2564

2565**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`

2562### Archive Credential

2563

2564**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`

25662565

25672566Archive Credential

25682567

2569### Path Parameters

2568#### Path parameters

25702569

25712570- `vault_id: string`

25722571

25732572- `credential_id: string`

25742573

2575### Header Parameters

2574#### Headers

25762575

25772576- `"anthropic-beta": optional array of AnthropicBeta`

25782577

from line 2649

26502649

26512650 - `"mid-conversation-tool-changes-2026-07-01"`

26522651

2653### Returns

2654

2655- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

2652#### Returns

2653

2654- `BetaManagedAgentsCredential object`

26562655

26572656 A credential stored in a vault. Sensitive fields are never returned in responses.

26582657

from line 2663

26642663

26652664 A timestamp in RFC 3339 format

26662665

2666 format: date-time

2667

26672668 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

26682669

26692670 Authentication details for a credential.

26702671

2671 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

2672 - `BetaManagedAgentsMCPOAuthAuthResponse object`

26722673

26732674 OAuth credential details for an MCP server.

26742675

from line 2679

26782679

26792680 - `type: "mcp_oauth"`

26802681

2681 - `"mcp_oauth"`

2682

26832682 - `expires_at: optional string or null`

26842683

26852684 A timestamp in RFC 3339 format

26862685

2686 format: date-time

2687

26872688 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

26882689

26892690 OAuth refresh token configuration returned in credential responses.

from line 2701

27002701

27012702 Token endpoint requires no client authentication.

27022703

2703 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

2704 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

27042705

27052706 Token endpoint requires no client authentication.

27062707

27072708 - `type: "none"`

27082709

2709 - `"none"`

2710

2711 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

2710 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

27122711

27132712 Token endpoint uses HTTP Basic authentication with client credentials.

27142713

27152714 - `type: "client_secret_basic"`

27162715

2717 - `"client_secret_basic"`

2718

2719 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

2716 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

27202717

27212718 Token endpoint uses POST body authentication with client credentials.

27222719

27232720 - `type: "client_secret_post"`

27242721

2725 - `"client_secret_post"`

2726

27272722 - `resource: optional string or null`

27282723

27292724 OAuth resource indicator.

from line 2727

27322727

27332728 OAuth scope for the refresh request.

27342729

2735 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

2730 - `BetaManagedAgentsStaticBearerAuthResponse object`

27362731

27372732 Static bearer token credential details for an MCP server.

27382733

from line 2737

27422737

27432738 - `type: "static_bearer"`

27442739

2745 - `"static_bearer"`

2746

2747 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

2740 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

27482741

27492742 Environment variable credential details. The secret value is never returned.

27502743

from line 2757

27642757

27652758 Outbound hosts the secret value is substituted on.

27662759

2767 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

2760 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

27682761

27692762 The secret is substituted on any host the session's Environment network policy permits egress to.

27702763

27712764 - `type: "unrestricted"`

27722765

2773 - `"unrestricted"`

2774

2775 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

2766 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

27762767

27772768 The secret is substituted only on requests to the listed hosts.

27782769

from line 2773

27822773

27832774 - `type: "limited"`

27842775

2785 - `"limited"`

2786

27872776 - `secret_name: string`

27882777

27892778 Name of the environment variable.

27902779

27912780 - `type: "environment_variable"`

27922781

2793 - `"environment_variable"`

2794

27952782 - `created_at: string`

27962783

27972784 A timestamp in RFC 3339 format

27982785

2786 format: date-time

2787

27992788 - `metadata: map[string]`

28002789

28012790 Arbitrary key-value metadata attached to the credential.

28022791

28032792 - `type: "vault_credential"`

28042793

2805 - `"vault_credential"`

2806

28072794 - `updated_at: string`

28082795

28092796 A timestamp in RFC 3339 format

28102797

2798 format: date-time

2799

28112800 - `vault_id: string`

28122801

28132802 Identifier of the vault this credential belongs to.

from line 2805

28162805

28172806 Human-readable name for the credential.

28182807

2819### Example

2820

2821```http

2808#### Example

2809

2810```bash

28222811curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \

28232812 -X POST \

28242813 -H 'anthropic-version: 2023-06-01' \

from line 2815

28262815 -H "X-Api-Key: $ANTHROPIC_API_KEY"

28272816```

28282817

2829#### Response

2818##### Response (200)

28302819

28312820```json

28322821{

from line 2836

28472836}

28482837```

28492838

2850## Validate Credential

2851

2852**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`

2839### Validate Credential

2840

2841**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`

28532842

28542843Validate Credential

28552844

2856### Path Parameters

2845#### Path parameters

28572846

28582847- `vault_id: string`

28592848

28602849- `credential_id: string`

28612850

2862### Header Parameters

2851#### Headers

28632852

28642853- `"anthropic-beta": optional array of AnthropicBeta`

28652854

from line 2926

29372926

29382927 - `"mid-conversation-tool-changes-2026-07-01"`

29392928

2940### Returns

2941

2942- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`

2929#### Returns

2930

2931- `BetaManagedAgentsCredentialValidation object`

29432932

29442933 Result of live-probing a credential against its configured MCP server.

29452934

from line 2964

29752964

29762965 HTTP status code.

29772966

2967 format: int32

2968

29782969 - `method: string`

29792970

29802971 The MCP method that failed (for example `initialize` or `tools/list`).

from line 3002

30113002

30123003 - `type: "vault_credential_validation"`

30133004

3014 - `"vault_credential_validation"`

3015

30163005 - `validated_at: string`

30173006

30183007 A timestamp in RFC 3339 format

30193008

3009 format: date-time

3010

30203011 - `vault_id: string`

30213012

30223013 Identifier of the vault containing the credential.

30233014

3024### Example

3025

3026```http

3015#### Example

3016

3017```bash

30273018curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \

30283019 -X POST \

30293020 -H 'anthropic-version: 2023-06-01' \

from line 3022

30313022 -H "X-Api-Key: $ANTHROPIC_API_KEY"

30323023```

30333024

3034#### Response

3025##### Response (200)

30353026

30363027```json

30373028{

from line 3052

30613052 "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv"

30623053}

30633054```

3064

3065## Domain Types

3066

3067### Beta Managed Agents Credential

3068

3069- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

3070

3071 A credential stored in a vault. Sensitive fields are never returned in responses.

3072

3073 - `id: string`

3074

3075 Unique identifier for the credential.

3076

3077 - `archived_at: string or null`

3078

3079 A timestamp in RFC 3339 format

3080

3081 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

3082

3083 Authentication details for a credential.

3084

3085 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

3086

3087 OAuth credential details for an MCP server.

3088

3089 - `mcp_server_url: string`

3090

3091 URL of the MCP server this credential authenticates against.

3092

3093 - `type: "mcp_oauth"`

3094

3095 - `"mcp_oauth"`

3096

3097 - `expires_at: optional string or null`

3098

3099 A timestamp in RFC 3339 format

3100

3101 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

3102

3103 OAuth refresh token configuration returned in credential responses.

3104

3105 - `client_id: string`

3106

3107 OAuth client ID.

3108

3109 - `token_endpoint: string`

3110

3111 Token endpoint URL used to refresh the access token.

3112

3113 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`

3114

3115 Token endpoint requires no client authentication.

3116

3117 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

3118

3119 Token endpoint requires no client authentication.

3120

3121 - `type: "none"`

3122

3123 - `"none"`

3124

3125 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

3126

3127 Token endpoint uses HTTP Basic authentication with client credentials.

3128

3129 - `type: "client_secret_basic"`

3130

3131 - `"client_secret_basic"`

3132

3133 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

3134

3135 Token endpoint uses POST body authentication with client credentials.

3136

3137 - `type: "client_secret_post"`

3138

3139 - `"client_secret_post"`

3140

3141 - `resource: optional string or null`

3142

3143 OAuth resource indicator.

3144

3145 - `scope: optional string or null`

3146

3147 OAuth scope for the refresh request.

3148

3149 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

3150

3151 Static bearer token credential details for an MCP server.

3152

3153 - `mcp_server_url: string`

3154

3155 URL of the MCP server this credential authenticates against.

3156

3157 - `type: "static_bearer"`

3158

3159 - `"static_bearer"`

3160

3161 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

3162

3163 Environment variable credential details. The secret value is never returned.

3164

3165 - `injection_location: BetaManagedAgentsInjectionLocationResponse`

3166

3167 Where in the outbound request the secret value is substituted.

3168

3169 - `body: boolean`

3170

3171 Whether the placeholder is substituted in the request body.

3172

3173 - `header: boolean`

3174

3175 Whether the placeholder is substituted in request header values.

3176

3177 - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`

3178

3179 Outbound hosts the secret value is substituted on.

3180

3181 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

3182

3183 The secret is substituted on any host the session's Environment network policy permits egress to.

3184

3185 - `type: "unrestricted"`

3186

3187 - `"unrestricted"`

3188

3189 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

3190

3191 The secret is substituted only on requests to the listed hosts.

3192

3193 - `allowed_hosts: array of string`

3194

3195 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.

3196

3197 - `type: "limited"`

3198

3199 - `"limited"`

3200

3201 - `secret_name: string`

3202

3203 Name of the environment variable.

3204

3205 - `type: "environment_variable"`

3206

3207 - `"environment_variable"`

3208

3209 - `created_at: string`

3210

3211 A timestamp in RFC 3339 format

3212

3213 - `metadata: map[string]`

3214

3215 Arbitrary key-value metadata attached to the credential.

3216

3217 - `type: "vault_credential"`

3218

3219 - `"vault_credential"`

3220

3221 - `updated_at: string`

3222

3223 A timestamp in RFC 3339 format

3224

3225 - `vault_id: string`

3226

3227 Identifier of the vault this credential belongs to.

3228

3229 - `display_name: optional string or null`

3230

3231 Human-readable name for the credential.

3232

3233### Beta Managed Agents Credential Networking Params

3234

3235- `BetaManagedAgentsCredentialNetworkingParams = BetaManagedAgentsUnrestrictedCredentialNetworkingParams or BetaManagedAgentsLimitedCredentialNetworkingParams`

3236

3237 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

3238

3239 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

3240

3241 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

3242

3243 - `type: "unrestricted"`

3244

3245 - `"unrestricted"`

3246

3247 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

3248

3249 Substitute the secret only on requests to the listed hosts.

3250

3251 - `allowed_hosts: array of string`

3252

3253 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

3254

3255 - `type: "limited"`

3256

3257 - `"limited"`

3258

3259### Beta Managed Agents Credential Validation

3260

3261- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`

3262

3263 Result of live-probing a credential against its configured MCP server.

3264

3265 - `credential_id: string`

3266

3267 Unique identifier of the credential that was validated.

3268

3269 - `has_refresh_token: boolean`

3270

3271 Whether the credential has a refresh token configured.

3272

3273 - `mcp_probe: BetaManagedAgentsMCPProbe or null`

3274

3275 The failing step of an MCP validation probe.

3276

3277 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`

3278

3279 An HTTP response captured during a credential validation probe.

3280

3281 - `body: string`

3282

3283 Response body. May be truncated and has sensitive values scrubbed.

3284

3285 - `body_truncated: boolean`

3286

3287 Whether `body` was truncated.

3288

3289 - `content_type: string`

3290

3291 Value of the `Content-Type` response header.

3292

3293 - `status_code: number`

3294

3295 HTTP status code.

3296

3297 - `method: string`

3298

3299 The MCP method that failed (for example `initialize` or `tools/list`).

3300

3301 - `refresh: BetaManagedAgentsRefreshObject or null`

3302

3303 Outcome of a refresh-token exchange attempted during credential validation.

3304

3305 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`

3306

3307 An HTTP response captured during a credential validation probe.

3308

3309 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`

3310

3311 Outcome of a refresh-token exchange attempted during credential validation.

3312

3313 - `"succeeded"`

3314

3315 - `"failed"`

3316

3317 - `"connect_error"`

3318

3319 - `"no_refresh_token"`

3320

3321 - `status: BetaManagedAgentsCredentialValidationStatus`

3322

3323 Overall verdict of a credential validation probe.

3324

3325 - `"valid"`

3326

3327 - `"invalid"`

3328

3329 - `"unknown"`

3330

3331 - `type: "vault_credential_validation"`

3332

3333 - `"vault_credential_validation"`

3334

3335 - `validated_at: string`

3336

3337 A timestamp in RFC 3339 format

3338

3339 - `vault_id: string`

3340

3341 Identifier of the vault containing the credential.

3342

3343### Beta Managed Agents Credential Validation Status

3344

3345- `BetaManagedAgentsCredentialValidationStatus = "valid" or "invalid" or "unknown"`

3346

3347 Overall verdict of a credential validation probe.

3348

3349 - `"valid"`

3350

3351 - `"invalid"`

3352

3353 - `"unknown"`

3354

3355### Beta Managed Agents Deleted Credential

3356

3357- `BetaManagedAgentsDeletedCredential object { id, type }`

3358

3359 Confirmation of a deleted credential.

3360

3361 - `id: string`

3362

3363 Unique identifier of the deleted credential.

3364

3365 - `type: "vault_credential_deleted"`

3366

3367 - `"vault_credential_deleted"`

3368

3369### Beta Managed Agents Environment Variable Auth Response

3370

3371- `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

3372

3373 Environment variable credential details. The secret value is never returned.

3374

3375 - `injection_location: BetaManagedAgentsInjectionLocationResponse`

3376

3377 Where in the outbound request the secret value is substituted.

3378

3379 - `body: boolean`

3380

3381 Whether the placeholder is substituted in the request body.

3382

3383 - `header: boolean`

3384

3385 Whether the placeholder is substituted in request header values.

3386

3387 - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`

3388

3389 Outbound hosts the secret value is substituted on.

3390

3391 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

3392

3393 The secret is substituted on any host the session's Environment network policy permits egress to.

3394

3395 - `type: "unrestricted"`

3396

3397 - `"unrestricted"`

3398

3399 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

3400

3401 The secret is substituted only on requests to the listed hosts.

3402

3403 - `allowed_hosts: array of string`

3404

3405 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.

3406

3407 - `type: "limited"`

3408

3409 - `"limited"`

3410

3411 - `secret_name: string`

3412

3413 Name of the environment variable.

3414

3415 - `type: "environment_variable"`

3416

3417 - `"environment_variable"`

3418

3419### Beta Managed Agents Environment Variable Create Params

3420

3421- `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`

3422

3423 Parameters for creating an environment variable credential.

3424

3425 - `networking: BetaManagedAgentsCredentialNetworkingParams`

3426

3427 Outbound hosts the secret value is substituted on.

3428

3429 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

3430

3431 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

3432

3433 - `type: "unrestricted"`

3434

3435 - `"unrestricted"`

3436

3437 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

3438

3439 Substitute the secret only on requests to the listed hosts.

3440

3441 - `allowed_hosts: array of string`

3442

3443 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

3444

3445 - `type: "limited"`

3446

3447 - `"limited"`

3448

3449 - `secret_name: string`

3450

3451 Name of the environment variable. Immutable after create.

3452

3453 - `secret_value: string`

3454

3455 Secret value. Write-only; never returned in responses.

3456

3457 - `type: "environment_variable"`

3458

3459 - `"environment_variable"`

3460

3461 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`

3462

3463 Where in the outbound request the secret value may be substituted.

3464

3465 - `body: optional boolean`

3466

3467 Substitute when the placeholder appears in the request body.

3468

3469 - `header: optional boolean`

3470

3471 Substitute when the placeholder appears in a request header value.

3472

3473### Beta Managed Agents Environment Variable Update Params

3474

3475- `BetaManagedAgentsEnvironmentVariableUpdateParams object { type, injection_location, networking, secret_value }`

3476

3477 Parameters for updating an environment variable credential. `secret_name` is immutable.

3478

3479 - `type: "environment_variable"`

3480

3481 - `"environment_variable"`

3482

3483 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`

3484

3485 Updated injection location.

3486

3487 - `body: optional boolean`

3488

3489 Substitute when the placeholder appears in the request body.

3490

3491 - `header: optional boolean`

3492

3493 Substitute when the placeholder appears in a request header value.

3494

3495 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`

3496

3497 Updated networking scope. Full replacement.

3498

3499 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

3500

3501 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

3502

3503 - `type: "unrestricted"`

3504

3505 - `"unrestricted"`

3506

3507 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

3508

3509 Substitute the secret only on requests to the listed hosts.

3510

3511 - `allowed_hosts: array of string`

3512

3513 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

3514

3515 - `type: "limited"`

3516

3517 - `"limited"`

3518

3519 - `secret_value: optional string or null`

3520

3521 Updated secret value.

3522

3523### Beta Managed Agents Injection Location Params

3524

3525- `BetaManagedAgentsInjectionLocationParams object { body, header }`

3526

3527 Where in the outbound request the secret value may be substituted.

3528

3529 - `body: optional boolean`

3530

3531 Substitute when the placeholder appears in the request body.

3532

3533 - `header: optional boolean`

3534

3535 Substitute when the placeholder appears in a request header value.

3536

3537### Beta Managed Agents Injection Location Response

3538

3539- `BetaManagedAgentsInjectionLocationResponse object { body, header }`

3540

3541 Where in the outbound request the secret value is substituted.

3542

3543 - `body: boolean`

3544

3545 Whether the placeholder is substituted in the request body.

3546

3547 - `header: boolean`

3548

3549 Whether the placeholder is substituted in request header values.

3550

3551### Beta Managed Agents Injection Location Update Params

3552

3553- `BetaManagedAgentsInjectionLocationUpdateParams object { body, header }`

3554

3555 Updated injection location.

3556

3557 - `body: optional boolean`

3558

3559 Substitute when the placeholder appears in the request body.

3560

3561 - `header: optional boolean`

3562

3563 Substitute when the placeholder appears in a request header value.

3564

3565### Beta Managed Agents Limited Credential Networking Params

3566

3567- `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

3568

3569 Substitute the secret only on requests to the listed hosts.

3570

3571 - `allowed_hosts: array of string`

3572

3573 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.

3574

3575 - `type: "limited"`

3576

3577 - `"limited"`

3578

3579### Beta Managed Agents Limited Credential Networking Response

3580

3581- `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

3582

3583 The secret is substituted only on requests to the listed hosts.

3584

3585 - `allowed_hosts: array of string`

3586

3587 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.

3588

3589 - `type: "limited"`

3590

3591 - `"limited"`

3592

3593### Beta Managed Agents MCP OAuth Auth Response

3594

3595- `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

3596

3597 OAuth credential details for an MCP server.

3598

3599 - `mcp_server_url: string`

3600

3601 URL of the MCP server this credential authenticates against.

3602

3603 - `type: "mcp_oauth"`

3604

3605 - `"mcp_oauth"`

3606

3607 - `expires_at: optional string or null`

3608

3609 A timestamp in RFC 3339 format

3610

3611 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

3612

3613 OAuth refresh token configuration returned in credential responses.

3614

3615 - `client_id: string`

3616

3617 OAuth client ID.

3618

3619 - `token_endpoint: string`

3620

3621 Token endpoint URL used to refresh the access token.

3622

3623 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`

3624

3625 Token endpoint requires no client authentication.

3626

3627 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

3628

3629 Token endpoint requires no client authentication.

3630

3631 - `type: "none"`

3632

3633 - `"none"`

3634

3635 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

3636

3637 Token endpoint uses HTTP Basic authentication with client credentials.

3638

3639 - `type: "client_secret_basic"`

3640

3641 - `"client_secret_basic"`

3642

3643 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

3644

3645 Token endpoint uses POST body authentication with client credentials.

3646

3647 - `type: "client_secret_post"`

3648

3649 - `"client_secret_post"`

3650

3651 - `resource: optional string or null`

3652

3653 OAuth resource indicator.

3654

3655 - `scope: optional string or null`

3656

3657 OAuth scope for the refresh request.

3658

3659### Beta Managed Agents MCP OAuth Create Params

3660

3661- `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`

3662

3663 Parameters for creating an MCP OAuth credential.

3664

3665 - `access_token: string`

3666

3667 OAuth access token.

3668

3669 - `mcp_server_url: string`

3670

3671 URL of the MCP server this credential authenticates against.

3672

3673 - `type: "mcp_oauth"`

3674

3675 - `"mcp_oauth"`

3676

3677 - `expires_at: optional string or null`

3678

3679 A timestamp in RFC 3339 format

3680

3681 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`

3682

3683 OAuth refresh token parameters for creating a credential with refresh support.

3684

3685 - `client_id: string`

3686

3687 OAuth client ID.

3688

3689 - `refresh_token: string`

3690

3691 OAuth refresh token.

3692

3693 - `token_endpoint: string`

3694

3695 Token endpoint URL used to refresh the access token.

3696

3697 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

3698

3699 Token endpoint requires no client authentication.

3700

3701 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

3702

3703 Token endpoint requires no client authentication.

3704

3705 - `type: "none"`

3706

3707 - `"none"`

3708

3709 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

3710

3711 Token endpoint uses HTTP Basic authentication with client credentials.

3712

3713 - `client_secret: string`

3714

3715 OAuth client secret.

3716

3717 - `type: "client_secret_basic"`

3718

3719 - `"client_secret_basic"`

3720

3721 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

3722

3723 Token endpoint uses POST body authentication with client credentials.

3724

3725 - `client_secret: string`

3726

3727 OAuth client secret.

3728

3729 - `type: "client_secret_post"`

3730

3731 - `"client_secret_post"`

3732

3733 - `resource: optional string or null`

3734

3735 OAuth resource indicator.

3736

3737 - `scope: optional string or null`

3738

3739 OAuth scope for the refresh request.

3740

3741### Beta Managed Agents MCP OAuth Refresh Params

3742

3743- `BetaManagedAgentsMCPOAuthRefreshParams object { client_id, refresh_token, token_endpoint, 3 more }`

3744

3745 OAuth refresh token parameters for creating a credential with refresh support.

3746

3747 - `client_id: string`

3748

3749 OAuth client ID.

3750

3751 - `refresh_token: string`

3752

3753 OAuth refresh token.

3754

3755 - `token_endpoint: string`

3756

3757 Token endpoint URL used to refresh the access token.

3758

3759 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

3760

3761 Token endpoint requires no client authentication.

3762

3763 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

3764

3765 Token endpoint requires no client authentication.

3766

3767 - `type: "none"`

3768

3769 - `"none"`

3770

3771 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

3772

3773 Token endpoint uses HTTP Basic authentication with client credentials.

3774

3775 - `client_secret: string`

3776

3777 OAuth client secret.

3778

3779 - `type: "client_secret_basic"`

3780

3781 - `"client_secret_basic"`

3782

3783 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

3784

3785 Token endpoint uses POST body authentication with client credentials.

3786

3787 - `client_secret: string`

3788

3789 OAuth client secret.

3790

3791 - `type: "client_secret_post"`

3792

3793 - `"client_secret_post"`

3794

3795 - `resource: optional string or null`

3796

3797 OAuth resource indicator.

3798

3799 - `scope: optional string or null`

3800

3801 OAuth scope for the refresh request.

3802

3803### Beta Managed Agents MCP OAuth Refresh Response

3804

3805- `BetaManagedAgentsMCPOAuthRefreshResponse object { client_id, token_endpoint, token_endpoint_auth, 2 more }`

3806

3807 OAuth refresh token configuration returned in credential responses.

3808

3809 - `client_id: string`

3810

3811 OAuth client ID.

3812

3813 - `token_endpoint: string`

3814

3815 Token endpoint URL used to refresh the access token.

3816

3817 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`

3818

3819 Token endpoint requires no client authentication.

3820

3821 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

3822

3823 Token endpoint requires no client authentication.

3824

3825 - `type: "none"`

3826

3827 - `"none"`

3828

3829 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

3830

3831 Token endpoint uses HTTP Basic authentication with client credentials.

3832

3833 - `type: "client_secret_basic"`

3834

3835 - `"client_secret_basic"`

3836

3837 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

3838

3839 Token endpoint uses POST body authentication with client credentials.

3840

3841 - `type: "client_secret_post"`

3842

3843 - `"client_secret_post"`

3844

3845 - `resource: optional string or null`

3846

3847 OAuth resource indicator.

3848

3849 - `scope: optional string or null`

3850

3851 OAuth scope for the refresh request.

3852

3853### Beta Managed Agents MCP OAuth Refresh Update Params

3854

3855- `BetaManagedAgentsMCPOAuthRefreshUpdateParams object { refresh_token, scope, token_endpoint_auth }`

3856

3857 Parameters for updating OAuth refresh token configuration.

3858

3859 - `refresh_token: optional string or null`

3860

3861 Updated OAuth refresh token.

3862

3863 - `scope: optional string or null`

3864

3865 Updated OAuth scope for the refresh request.

3866

3867 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`

3868

3869 Updated HTTP Basic authentication parameters for the token endpoint.

3870

3871 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

3872

3873 Updated HTTP Basic authentication parameters for the token endpoint.

3874

3875 - `type: "client_secret_basic"`

3876

3877 - `"client_secret_basic"`

3878

3879 - `client_secret: optional string or null`

3880

3881 Updated OAuth client secret.

3882

3883 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

3884

3885 Updated POST body authentication parameters for the token endpoint.

3886

3887 - `type: "client_secret_post"`

3888

3889 - `"client_secret_post"`

3890

3891 - `client_secret: optional string or null`

3892

3893 Updated OAuth client secret.

3894

3895### Beta Managed Agents MCP OAuth Update Params

3896

3897- `BetaManagedAgentsMCPOAuthUpdateParams object { type, access_token, expires_at, refresh }`

3898

3899 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.

3900

3901 - `type: "mcp_oauth"`

3902

3903 - `"mcp_oauth"`

3904

3905 - `access_token: optional string or null`

3906

3907 Updated OAuth access token.

3908

3909 - `expires_at: optional string or null`

3910

3911 A timestamp in RFC 3339 format

3912

3913 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`

3914

3915 Parameters for updating OAuth refresh token configuration.

3916

3917 - `refresh_token: optional string or null`

3918

3919 Updated OAuth refresh token.

3920

3921 - `scope: optional string or null`

3922

3923 Updated OAuth scope for the refresh request.

3924

3925 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`

3926

3927 Updated HTTP Basic authentication parameters for the token endpoint.

3928

3929 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

3930

3931 Updated HTTP Basic authentication parameters for the token endpoint.

3932

3933 - `type: "client_secret_basic"`

3934

3935 - `"client_secret_basic"`

3936

3937 - `client_secret: optional string or null`

3938

3939 Updated OAuth client secret.

3940

3941 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

3942

3943 Updated POST body authentication parameters for the token endpoint.

3944

3945 - `type: "client_secret_post"`

3946

3947 - `"client_secret_post"`

3948

3949 - `client_secret: optional string or null`

3950

3951 Updated OAuth client secret.

3952

3953### Beta Managed Agents MCP Probe

3954

3955- `BetaManagedAgentsMCPProbe object { http_response, method }`

3956

3957 The failing step of an MCP validation probe.

3958

3959 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`

3960

3961 An HTTP response captured during a credential validation probe.

3962

3963 - `body: string`

3964

3965 Response body. May be truncated and has sensitive values scrubbed.

3966

3967 - `body_truncated: boolean`

3968

3969 Whether `body` was truncated.

3970

3971 - `content_type: string`

3972

3973 Value of the `Content-Type` response header.

3974

3975 - `status_code: number`

3976

3977 HTTP status code.

3978

3979 - `method: string`

3980

3981 The MCP method that failed (for example `initialize` or `tools/list`).

3982

3983### Beta Managed Agents Refresh HTTP Response

3984

3985- `BetaManagedAgentsRefreshHTTPResponse object { body, body_truncated, content_type, status_code }`

3986

3987 An HTTP response captured during a credential validation probe.

3988

3989 - `body: string`

3990

3991 Response body. May be truncated and has sensitive values scrubbed.

3992

3993 - `body_truncated: boolean`

3994

3995 Whether `body` was truncated.

3996

3997 - `content_type: string`

3998

3999 Value of the `Content-Type` response header.

4000

4001 - `status_code: number`

4002

4003 HTTP status code.

4004

4005### Beta Managed Agents Refresh Object

4006

4007- `BetaManagedAgentsRefreshObject object { http_response, status }`

4008

4009 Outcome of a refresh-token exchange attempted during credential validation.

4010

4011 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`

4012

4013 An HTTP response captured during a credential validation probe.

4014

4015 - `body: string`

4016

4017 Response body. May be truncated and has sensitive values scrubbed.

4018

4019 - `body_truncated: boolean`

4020

4021 Whether `body` was truncated.

4022

4023 - `content_type: string`

4024

4025 Value of the `Content-Type` response header.

4026

4027 - `status_code: number`

4028

4029 HTTP status code.

4030

4031 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`

4032

4033 Outcome of a refresh-token exchange attempted during credential validation.

4034

4035 - `"succeeded"`

4036

4037 - `"failed"`

4038

4039 - `"connect_error"`

4040

4041 - `"no_refresh_token"`

4042

4043### Beta Managed Agents Static Bearer Auth Response

4044

4045- `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

4046

4047 Static bearer token credential details for an MCP server.

4048

4049 - `mcp_server_url: string`

4050

4051 URL of the MCP server this credential authenticates against.

4052

4053 - `type: "static_bearer"`

4054

4055 - `"static_bearer"`

4056

4057### Beta Managed Agents Static Bearer Create Params

4058

4059- `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`

4060

4061 Parameters for creating a static bearer token credential.

4062

4063 - `token: string`

4064

4065 Static bearer token value.

4066

4067 - `mcp_server_url: string`

4068

4069 URL of the MCP server this credential authenticates against.

4070

4071 - `type: "static_bearer"`

4072

4073 - `"static_bearer"`

4074

4075### Beta Managed Agents Static Bearer Update Params

4076

4077- `BetaManagedAgentsStaticBearerUpdateParams object { type, token }`

4078

4079 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.

4080

4081 - `type: "static_bearer"`

4082

4083 - `"static_bearer"`

4084

4085 - `token: optional string or null`

4086

4087 Updated static bearer token value.

4088

4089### Beta Managed Agents Token Endpoint Auth Basic Param

4090

4091- `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

4092

4093 Token endpoint uses HTTP Basic authentication with client credentials.

4094

4095 - `client_secret: string`

4096

4097 OAuth client secret.

4098

4099 - `type: "client_secret_basic"`

4100

4101 - `"client_secret_basic"`

4102

4103### Beta Managed Agents Token Endpoint Auth Basic Response

4104

4105- `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

4106

4107 Token endpoint uses HTTP Basic authentication with client credentials.

4108

4109 - `type: "client_secret_basic"`

4110

4111 - `"client_secret_basic"`

4112

4113### Beta Managed Agents Token Endpoint Auth Basic Update Param

4114

4115- `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

4116

4117 Updated HTTP Basic authentication parameters for the token endpoint.

4118

4119 - `type: "client_secret_basic"`

4120

4121 - `"client_secret_basic"`

4122

4123 - `client_secret: optional string or null`

4124

4125 Updated OAuth client secret.

4126

4127### Beta Managed Agents Token Endpoint Auth None Param

4128

4129- `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

4130

4131 Token endpoint requires no client authentication.

4132

4133 - `type: "none"`

4134

4135 - `"none"`

4136

4137### Beta Managed Agents Token Endpoint Auth None Response

4138

4139- `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

4140

4141 Token endpoint requires no client authentication.

4142

4143 - `type: "none"`

4144

4145 - `"none"`

4146

4147### Beta Managed Agents Token Endpoint Auth Post Param

4148

4149- `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

4150

4151 Token endpoint uses POST body authentication with client credentials.

4152

4153 - `client_secret: string`

4154

4155 OAuth client secret.

4156

4157 - `type: "client_secret_post"`

4158

4159 - `"client_secret_post"`

4160

4161### Beta Managed Agents Token Endpoint Auth Post Response

4162

4163- `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

4164

4165 Token endpoint uses POST body authentication with client credentials.

4166

4167 - `type: "client_secret_post"`

4168

4169 - `"client_secret_post"`

4170

4171### Beta Managed Agents Token Endpoint Auth Post Update Param

4172

4173- `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

4174

4175 Updated POST body authentication parameters for the token endpoint.

4176

4177 - `type: "client_secret_post"`

4178

4179 - `"client_secret_post"`

4180

4181 - `client_secret: optional string or null`

4182

4183 Updated OAuth client secret.

4184

4185### Beta Managed Agents Unrestricted Credential Networking Params

4186

4187- `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

4188

4189 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

4190

4191 - `type: "unrestricted"`

4192

4193 - `"unrestricted"`

4194

4195### Beta Managed Agents Unrestricted Credential Networking Response

4196

4197- `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

4198

4199 The secret is substituted on any host the session's Environment network policy permits egress to.

4200

4201 - `type: "unrestricted"`

4202

4203 - `"unrestricted"`

42043055

api/beta/vaults/archive Changed · +15 / -16 lines

# Archive Vault ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Vault ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Archive Vault

3url: https://platform.claude.com/docs/en/api/beta/vaults/archive

4---

1# Archive Vault

6## Archive Vault

3**POST** `/v1/vaults/{vault_id}/archive`

8**post** `/v1/vaults/{vault_id}/archive`

105Archive Vault

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

16### Header Parameters

11## Headers

1712

1813- `"anthropic-beta": optional array of AnthropicBeta`

1914

from line 86

9186

9287 - `"mid-conversation-tool-changes-2026-07-01"`

9388

94### Returns

89## Returns

9590

96- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

91- `BetaManagedAgentsVault object`

9792

9893 A vault that stores credentials for use by agents during sessions.

9994

from line 100

105100

106101 A timestamp in RFC 3339 format

107102

103 format: date-time

104

108105 - `created_at: string`

109106

110107 A timestamp in RFC 3339 format

111108

109 format: date-time

110

112111 - `display_name: string`

113112

114113 Human-readable name for the vault.

from line 118

119118

120119 - `type: "vault"`

121120

122 - `"vault"`

123

124121 - `updated_at: string`

125122

126123 A timestamp in RFC 3339 format

127124

128### Example

125 format: date-time

129126

130```http

127## Example

128

129```bash

131130curl https://api.anthropic.com/v1/vaults/$VAULT_ID/archive \

132131 -X POST \

133132 -H 'anthropic-version: 2023-06-01' \

from line 134

135134 -H "X-Api-Key: $ANTHROPIC_API_KEY"

136135```

137136

138#### Response

137### Response (200)

139138

140139```json

141140{

api/beta/vaults/create Changed · +17 / -16 lines

# Create Vault ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Vault ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Vault

3url: https://platform.claude.com/docs/en/api/beta/vaults/create

4---

1# Create Vault

6## Create Vault

3**POST** `/v1/vaults`

8**post** `/v1/vaults`

105Create Vault

116

12### Header Parameters

7## Headers

138

149- `"anthropic-beta": optional array of AnthropicBeta`

1510

from line 82

8782

8883 - `"mid-conversation-tool-changes-2026-07-01"`

8984

90### Body Parameters

85## Body parameters

9186

9287- `display_name: string`

9388

9489 Human-readable name for the vault. 1-255 characters.

9590

91 minLength: 1, maxLength: 255

9693- `metadata: optional map[string]`

9794

9895 Arbitrary key-value metadata to attach to the vault. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

9996

100### Returns

97## Returns

10198

102- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`

99- `BetaManagedAgentsVault object`

103100

104101 A vault that stores credentials for use by agents during sessions.

105102

from line 108

111108

112109 A timestamp in RFC 3339 format

113110

111 format: date-time

112

114113 - `created_at: string`

115114

116115 A timestamp in RFC 3339 format

117116

117 format: date-time

118

118119 - `display_name: string`

119120

120121 Human-readable name for the vault.

from line 126

125126

126127 - `type: "vault"`

127128

128 - `"vault"`

129

130129 - `updated_at: string`

131130

132131 A timestamp in RFC 3339 format

133132

134### Example

133 format: date-time

135134

136```http

135## Example

136

137```bash

137138curl https://api.anthropic.com/v1/vaults \

138139 -H 'Content-Type: application/json' \

139140 -H 'anthropic-version: 2023-06-01' \

from line 148

147148 }'

148149```

149150

150#### Response

151### Response (200)

151152

152153```json

153154{

api/beta/vaults/credentials Changed · +353 / -406 lines

### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 1

1---

2title: Credentials

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials

4---

61# Credentials

83## Create Credential

10**post** `/v1/vaults/{vault_id}/credentials`

5**POST** `/v1/vaults/{vault_id}/credentials`

116

127Create Credential

138

14### Path Parameters

9### Path parameters

1510

1611- `vault_id: string`

1712

18### Header Parameters

13### Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Body Parameters

91### Body parameters

9792

9893- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`

9994

10095 Authentication details for creating a credential.

10196

102 - `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`

97 - `BetaManagedAgentsMCPOAuthCreateParams object`

10398

10499 Parameters for creating an MCP OAuth credential.

105100

from line 102

107102

108103 OAuth access token.

109104

105 minLength: 1, maxLength: 8192

106

110107 - `mcp_server_url: string`

111108

112109 URL of the MCP server this credential authenticates against.

113110

111 minLength: 1, maxLength: 2047

112

114113 - `type: "mcp_oauth"`

115114

116 - `"mcp_oauth"`

117

118115 - `expires_at: optional string or null`

119116

120117 A timestamp in RFC 3339 format

121118

119 format: date-time

120

122121 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`

123122

124123 OAuth refresh token parameters for creating a credential with refresh support.

from line 126

127126

128127 OAuth client ID.

129128

129 minLength: 1, maxLength: 1024

130

130131 - `refresh_token: string`

131132

132133 OAuth refresh token.

133134

135 minLength: 1, maxLength: 4096

136

134137 - `token_endpoint: string`

135138

136139 Token endpoint URL used to refresh the access token.

137140

141 minLength: 1, maxLength: 2047

142

138143 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

139144

140145 Token endpoint requires no client authentication.

141146

142 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

147 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`

143148

144149 Token endpoint requires no client authentication.

145150

146151 - `type: "none"`

147152

148 - `"none"`

149

150 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

153 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`

151154

152155 Token endpoint uses HTTP Basic authentication with client credentials.

153156

from line 158

155158

156159 OAuth client secret.

157160

161 minLength: 1, maxLength: 512

162

158163 - `type: "client_secret_basic"`

159164

160 - `"client_secret_basic"`

161

162 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

165 - `BetaManagedAgentsTokenEndpointAuthPostParam object`

163166

164167 Token endpoint uses POST body authentication with client credentials.

165168

from line 170

167170

168171 OAuth client secret.

169172

173 minLength: 1, maxLength: 512

174

170175 - `type: "client_secret_post"`

171176

172 - `"client_secret_post"`

173

174177 - `resource: optional string or null`

175178

176179 OAuth resource indicator.

177180

181 minLength: 1, maxLength: 2047

182

178183 - `scope: optional string or null`

179184

180185 OAuth scope for the refresh request.

181186

182 - `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`

187 minLength: 1, maxLength: 8192

188

189 - `BetaManagedAgentsStaticBearerCreateParams object`

183190

184191 Parameters for creating a static bearer token credential.

185192

from line 194

187194

188195 Static bearer token value.

189196

197 minLength: 1, maxLength: 8192

198

190199 - `mcp_server_url: string`

191200

192201 URL of the MCP server this credential authenticates against.

193202

203 minLength: 1, maxLength: 2047

204

194205 - `type: "static_bearer"`

195206

196 - `"static_bearer"`

197

198 - `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`

207 - `BetaManagedAgentsEnvironmentVariableCreateParams object`

199208

200209 Parameters for creating an environment variable credential.

201210

from line 212

203212

204213 Outbound hosts the secret value is substituted on.

205214

206 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

215 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

207216

208217 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

209218

210219 - `type: "unrestricted"`

211220

212 - `"unrestricted"`

213

214 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

221 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

215222

216223 Substitute the secret only on requests to the listed hosts.

217224

from line 228

221228

222229 - `type: "limited"`

223230

224 - `"limited"`

225

226231 - `secret_name: string`

227232

228233 Name of the environment variable. Immutable after create.

229234

235 minLength: 1, maxLength: 255

236

230237 - `secret_value: string`

231238

232239 Secret value. Write-only; never returned in responses.

233240

241 minLength: 1, maxLength: 4096

242

234243 - `type: "environment_variable"`

235244

236 - `"environment_variable"`

237

238245 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`

239246

240247 Where in the outbound request the secret value may be substituted.

from line 258

251258

252259 Human-readable name for the credential. Up to 255 characters.

253260

261 maxLength: 255

262

254263- `metadata: optional map[string]`

255264

256265 Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

257266

258267### Returns

259268

260- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

269- `BetaManagedAgentsCredential object`

261270

262271 A credential stored in a vault. Sensitive fields are never returned in responses.

263272

from line 278

269278

270279 A timestamp in RFC 3339 format

271280

281 format: date-time

282

272283 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

273284

274285 Authentication details for a credential.

275286

276 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

287 - `BetaManagedAgentsMCPOAuthAuthResponse object`

277288

278289 OAuth credential details for an MCP server.

279290

from line 294

283294

284295 - `type: "mcp_oauth"`

285296

286 - `"mcp_oauth"`

287

288297 - `expires_at: optional string or null`

289298

290299 A timestamp in RFC 3339 format

291300

301 format: date-time

302

292303 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

293304

294305 OAuth refresh token configuration returned in credential responses.

from line 316

305316

306317 Token endpoint requires no client authentication.

307318

308 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

319 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

309320

310321 Token endpoint requires no client authentication.

311322

312323 - `type: "none"`

313324

314 - `"none"`

315

316 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

325 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

317326

318327 Token endpoint uses HTTP Basic authentication with client credentials.

319328

320329 - `type: "client_secret_basic"`

321330

322 - `"client_secret_basic"`

323

324 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

331 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

325332

326333 Token endpoint uses POST body authentication with client credentials.

327334

328335 - `type: "client_secret_post"`

329336

330 - `"client_secret_post"`

331

332337 - `resource: optional string or null`

333338

334339 OAuth resource indicator.

from line 342

337342

338343 OAuth scope for the refresh request.

339344

340 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

345 - `BetaManagedAgentsStaticBearerAuthResponse object`

341346

342347 Static bearer token credential details for an MCP server.

343348

from line 352

347352

348353 - `type: "static_bearer"`

349354

350 - `"static_bearer"`

351

352 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

355 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

353356

354357 Environment variable credential details. The secret value is never returned.

355358

from line 372

369372

370373 Outbound hosts the secret value is substituted on.

371374

372 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

375 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

373376

374377 The secret is substituted on any host the session's Environment network policy permits egress to.

375378

376379 - `type: "unrestricted"`

377380

378 - `"unrestricted"`

379

380 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

381 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

381382

382383 The secret is substituted only on requests to the listed hosts.

383384

from line 388

387388

388389 - `type: "limited"`

389390

390 - `"limited"`

391

392391 - `secret_name: string`

393392

394393 Name of the environment variable.

395394

396395 - `type: "environment_variable"`

397396

398 - `"environment_variable"`

399

400397 - `created_at: string`

401398

402399 A timestamp in RFC 3339 format

403400

401 format: date-time

402

404403 - `metadata: map[string]`

405404

406405 Arbitrary key-value metadata attached to the credential.

407406

408407 - `type: "vault_credential"`

409408

410 - `"vault_credential"`

411

412409 - `updated_at: string`

413410

414411 A timestamp in RFC 3339 format

415412

413 format: date-time

414

416415 - `vault_id: string`

417416

418417 Identifier of the vault this credential belongs to.

from line 422

423422

424423### Example

425424

426```http

425```bash

427426curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

428427 -H 'Content-Type: application/json' \

429428 -H 'anthropic-version: 2023-06-01' \

from line 441

442441 }'

443442```

444443

445#### Response

444#### Response (200)

446445

447446```json

448447{

from line 464

465464

466465## List Credentials

467466

468**get** `/v1/vaults/{vault_id}/credentials`

467**GET** `/v1/vaults/{vault_id}/credentials`

469468

470469List Credentials

471470

472### Path Parameters

471### Path parameters

473472

474473- `vault_id: string`

475474

476### Query Parameters

475### Query parameters

477476

478477- `include_archived: optional boolean`

479478

from line 482

483482

484483 Maximum number of credentials to return per page. Defaults to 20, maximum 100.

485484

485 format: int32

486

486487- `page: optional string`

487488

488489 Opaque pagination token from a previous `list_credentials` response.

489490

490### Header Parameters

491### Headers

491492

492493- `"anthropic-beta": optional array of AnthropicBeta`

493494

from line 580

579580

580581 A timestamp in RFC 3339 format

581582

583 format: date-time

584

582585 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

583586

584587 Authentication details for a credential.

585588

586 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

589 - `BetaManagedAgentsMCPOAuthAuthResponse object`

587590

588591 OAuth credential details for an MCP server.

589592

from line 596

593596

594597 - `type: "mcp_oauth"`

595598

596 - `"mcp_oauth"`

597

598599 - `expires_at: optional string or null`

599600

600601 A timestamp in RFC 3339 format

601602

603 format: date-time

604

602605 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

603606

604607 OAuth refresh token configuration returned in credential responses.

from line 618

615618

616619 Token endpoint requires no client authentication.

617620

618 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

621 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

619622

620623 Token endpoint requires no client authentication.

621624

622625 - `type: "none"`

623626

624 - `"none"`

625

626 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

627 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

627628

628629 Token endpoint uses HTTP Basic authentication with client credentials.

629630

630631 - `type: "client_secret_basic"`

631632

632 - `"client_secret_basic"`

633

634 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

633 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

635634

636635 Token endpoint uses POST body authentication with client credentials.

637636

638637 - `type: "client_secret_post"`

639638

640 - `"client_secret_post"`

641

642639 - `resource: optional string or null`

643640

644641 OAuth resource indicator.

from line 644

647644

648645 OAuth scope for the refresh request.

649646

650 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

647 - `BetaManagedAgentsStaticBearerAuthResponse object`

651648

652649 Static bearer token credential details for an MCP server.

653650

from line 654

657654

658655 - `type: "static_bearer"`

659656

660 - `"static_bearer"`

661

662 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

657 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

663658

664659 Environment variable credential details. The secret value is never returned.

665660

from line 674

679674

680675 Outbound hosts the secret value is substituted on.

681676

682 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

677 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

683678

684679 The secret is substituted on any host the session's Environment network policy permits egress to.

685680

686681 - `type: "unrestricted"`

687682

688 - `"unrestricted"`

689

690 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

683 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

691684

692685 The secret is substituted only on requests to the listed hosts.

693686

from line 690

697690

698691 - `type: "limited"`

699692

700 - `"limited"`

701

702693 - `secret_name: string`

703694

704695 Name of the environment variable.

705696

706697 - `type: "environment_variable"`

707698

708 - `"environment_variable"`

709

710699 - `created_at: string`

711700

712701 A timestamp in RFC 3339 format

713702

703 format: date-time

704

714705 - `metadata: map[string]`

715706

716707 Arbitrary key-value metadata attached to the credential.

717708

718709 - `type: "vault_credential"`

719710

720 - `"vault_credential"`

721

722711 - `updated_at: string`

723712

724713 A timestamp in RFC 3339 format

725714

715 format: date-time

716

726717 - `vault_id: string`

727718

728719 Identifier of the vault this credential belongs to.

from line 728

737728

738729### Example

739730

740```http

731```bash

741732curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

742733 -H 'anthropic-version: 2023-06-01' \

743734 -H 'anthropic-beta: managed-agents-2026-04-01' \

744735 -H "X-Api-Key: $ANTHROPIC_API_KEY"

745736```

746737

747#### Response

738#### Response (200)

748739

749740```json

750741{

from line 763

772763

773764## Get Credential

774765

775**get** `/v1/vaults/{vault_id}/credentials/{credential_id}`

766**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`

776767

777768Get Credential

778769

779### Path Parameters

770### Path parameters

780771

781772- `vault_id: string`

782773

783774- `credential_id: string`

784775

785### Header Parameters

776### Headers

786777

787778- `"anthropic-beta": optional array of AnthropicBeta`

788779

from line 853

862853

863854### Returns

864855

865- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

856- `BetaManagedAgentsCredential object`

866857

867858 A credential stored in a vault. Sensitive fields are never returned in responses.

868859

from line 865

874865

875866 A timestamp in RFC 3339 format

876867

868 format: date-time

869

877870 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

878871

879872 Authentication details for a credential.

880873

881 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

874 - `BetaManagedAgentsMCPOAuthAuthResponse object`

882875

883876 OAuth credential details for an MCP server.

884877

from line 881

888881

889882 - `type: "mcp_oauth"`

890883

891 - `"mcp_oauth"`

892

893884 - `expires_at: optional string or null`

894885

895886 A timestamp in RFC 3339 format

896887

888 format: date-time

889

897890 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

898891

899892 OAuth refresh token configuration returned in credential responses.

from line 903

910903

911904 Token endpoint requires no client authentication.

912905

913 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

906 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

914907

915908 Token endpoint requires no client authentication.

916909

917910 - `type: "none"`

918911

919 - `"none"`

920

921 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

912 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

922913

923914 Token endpoint uses HTTP Basic authentication with client credentials.

924915

925916 - `type: "client_secret_basic"`

926917

927 - `"client_secret_basic"`

928

929 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

918 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

930919

931920 Token endpoint uses POST body authentication with client credentials.

932921

933922 - `type: "client_secret_post"`

934923

935 - `"client_secret_post"`

936

937924 - `resource: optional string or null`

938925

939926 OAuth resource indicator.

from line 929

942929

943930 OAuth scope for the refresh request.

944931

945 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

932 - `BetaManagedAgentsStaticBearerAuthResponse object`

946933

947934 Static bearer token credential details for an MCP server.

948935

from line 939

952939

953940 - `type: "static_bearer"`

954941

955 - `"static_bearer"`

956

957 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

942 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

958943

959944 Environment variable credential details. The secret value is never returned.

960945

from line 959

974959

975960 Outbound hosts the secret value is substituted on.

976961

977 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

962 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

978963

979964 The secret is substituted on any host the session's Environment network policy permits egress to.

980965

981966 - `type: "unrestricted"`

982967

983 - `"unrestricted"`

984

985 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

968 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

986969

987970 The secret is substituted only on requests to the listed hosts.

988971

from line 975

992975

993976 - `type: "limited"`

994977

995 - `"limited"`

996

997978 - `secret_name: string`

998979

999980 Name of the environment variable.

1000981

1001982 - `type: "environment_variable"`

1002983

1003 - `"environment_variable"`

1004

1005984 - `created_at: string`

1006985

1007986 A timestamp in RFC 3339 format

1008987

988 format: date-time

989

1009990 - `metadata: map[string]`

1010991

1011992 Arbitrary key-value metadata attached to the credential.

1012993

1013994 - `type: "vault_credential"`

1014995

1015 - `"vault_credential"`

1016

1017996 - `updated_at: string`

1018997

1019998 A timestamp in RFC 3339 format

1020999

1000 format: date-time

1001

10211002 - `vault_id: string`

10221003

10231004 Identifier of the vault this credential belongs to.

from line 1009

10281009

10291010### Example

10301011

1031```http

1012```bash

10321013curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

10331014 -H 'anthropic-version: 2023-06-01' \

10341015 -H 'anthropic-beta: managed-agents-2026-04-01' \

10351016 -H "X-Api-Key: $ANTHROPIC_API_KEY"

10361017```

10371018

1038#### Response

1019#### Response (200)

10391020

10401021```json

10411022{

from line 1039

10581039

10591040## Update Credential

10601041

1061**post** `/v1/vaults/{vault_id}/credentials/{credential_id}`

1042**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`

10621043

10631044Update Credential

10641045

1065### Path Parameters

1046### Path parameters

10661047

10671048- `vault_id: string`

10681049

10691050- `credential_id: string`

10701051

1071### Header Parameters

1052### Headers

10721053

10731054- `"anthropic-beta": optional array of AnthropicBeta`

10741055

from line 1127

11461127

11471128 - `"mid-conversation-tool-changes-2026-07-01"`

11481129

1149### Body Parameters

1130### Body parameters

11501131

11511132- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`

11521133

11531134 Updated authentication details for a credential.

11541135

1155 - `BetaManagedAgentsMCPOAuthUpdateParams object { type, access_token, expires_at, refresh }`

1136 - `BetaManagedAgentsMCPOAuthUpdateParams object`

11561137

11571138 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.

11581139

11591140 - `type: "mcp_oauth"`

11601141

1161 - `"mcp_oauth"`

1162

11631142 - `access_token: optional string or null`

11641143

11651144 Updated OAuth access token.

11661145

1146 minLength: 1, maxLength: 8192

1147

11671148 - `expires_at: optional string or null`

11681149

11691150 A timestamp in RFC 3339 format

11701151

1152 format: date-time

1153

11711154 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`

11721155

11731156 Parameters for updating OAuth refresh token configuration.

from line 1159

11761159

11771160 Updated OAuth refresh token.

11781161

1162 minLength: 1, maxLength: 4096

1163

11791164 - `scope: optional string or null`

11801165

11811166 Updated OAuth scope for the refresh request.

11821167

1168 maxLength: 8192

1169

11831170 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`

11841171

11851172 Updated HTTP Basic authentication parameters for the token endpoint.

11861173

1187 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

1174 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`

11881175

11891176 Updated HTTP Basic authentication parameters for the token endpoint.

11901177

11911178 - `type: "client_secret_basic"`

11921179

1193 - `"client_secret_basic"`

1194

11951180 - `client_secret: optional string or null`

11961181

11971182 Updated OAuth client secret.

11981183

1199 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

1184 minLength: 1, maxLength: 512

1185

1186 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`

12001187

12011188 Updated POST body authentication parameters for the token endpoint.

12021189

12031190 - `type: "client_secret_post"`

12041191

1205 - `"client_secret_post"`

1206

12071192 - `client_secret: optional string or null`

12081193

12091194 Updated OAuth client secret.

12101195

1211 - `BetaManagedAgentsStaticBearerUpdateParams object { type, token }`

1196 minLength: 1, maxLength: 512

1197

1198 - `BetaManagedAgentsStaticBearerUpdateParams object`

12121199

12131200 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.

12141201

12151202 - `type: "static_bearer"`

12161203

1217 - `"static_bearer"`

1218

12191204 - `token: optional string or null`

12201205

12211206 Updated static bearer token value.

12221207

1223 - `BetaManagedAgentsEnvironmentVariableUpdateParams object { type, injection_location, networking, secret_value }`

1208 minLength: 1, maxLength: 8192

1209

1210 - `BetaManagedAgentsEnvironmentVariableUpdateParams object`

12241211

12251212 Parameters for updating an environment variable credential. `secret_name` is immutable.

12261213

12271214 - `type: "environment_variable"`

12281215

1229 - `"environment_variable"`

1230

12311216 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`

12321217

12331218 Updated injection location.

from line 1229

12441229

12451230 Updated networking scope. Full replacement.

12461231

1247 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

1232 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

12481233

12491234 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

12501235

12511236 - `type: "unrestricted"`

12521237

1253 - `"unrestricted"`

1254

1255 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

1238 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

12561239

12571240 Substitute the secret only on requests to the listed hosts.

12581241

from line 1245

12621245

12631246 - `type: "limited"`

12641247

1265 - `"limited"`

1266

12671248 - `secret_value: optional string or null`

12681249

12691250 Updated secret value.

12701251

1252 minLength: 1, maxLength: 4096

1253

12711254- `display_name: optional string or null`

12721255

12731256 Updated human-readable name for the credential. 1-255 characters.

12741257

1258 minLength: 1, maxLength: 255

1259

12751260- `metadata: optional map[string] or null`

12761261

12771262 Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.

12781263

12791264### Returns

12801265

1281- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

1266- `BetaManagedAgentsCredential object`

12821267

12831268 A credential stored in a vault. Sensitive fields are never returned in responses.

12841269

from line 1275

12901275

12911276 A timestamp in RFC 3339 format

12921277

1278 format: date-time

1279

12931280 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

12941281

12951282 Authentication details for a credential.

12961283

1297 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

1284 - `BetaManagedAgentsMCPOAuthAuthResponse object`

12981285

12991286 OAuth credential details for an MCP server.

13001287

from line 1291

13041291

13051292 - `type: "mcp_oauth"`

13061293

1307 - `"mcp_oauth"`

1308

13091294 - `expires_at: optional string or null`

13101295

13111296 A timestamp in RFC 3339 format

13121297

1298 format: date-time

1299

13131300 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

13141301

13151302 OAuth refresh token configuration returned in credential responses.

from line 1313

13261313

13271314 Token endpoint requires no client authentication.

13281315

1329 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

1316 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

13301317

13311318 Token endpoint requires no client authentication.

13321319

13331320 - `type: "none"`

13341321

1335 - `"none"`

1336

1337 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

1322 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

13381323

13391324 Token endpoint uses HTTP Basic authentication with client credentials.

13401325

13411326 - `type: "client_secret_basic"`

13421327

1343 - `"client_secret_basic"`

1344

1345 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

1328 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

13461329

13471330 Token endpoint uses POST body authentication with client credentials.

13481331

13491332 - `type: "client_secret_post"`

13501333

1351 - `"client_secret_post"`

1352

13531334 - `resource: optional string or null`

13541335

13551336 OAuth resource indicator.

from line 1339

13581339

13591340 OAuth scope for the refresh request.

13601341

1361 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

1342 - `BetaManagedAgentsStaticBearerAuthResponse object`

13621343

13631344 Static bearer token credential details for an MCP server.

13641345

from line 1349

13681349

13691350 - `type: "static_bearer"`

13701351

1371 - `"static_bearer"`

1372

1373 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

1352 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

13741353

13751354 Environment variable credential details. The secret value is never returned.

13761355

from line 1369

13901369

13911370 Outbound hosts the secret value is substituted on.

13921371

1393 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

1372 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

13941373

13951374 The secret is substituted on any host the session's Environment network policy permits egress to.

13961375

13971376 - `type: "unrestricted"`

13981377

1399 - `"unrestricted"`

1400

1401 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

1378 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

14021379

14031380 The secret is substituted only on requests to the listed hosts.

14041381

from line 1385

14081385

14091386 - `type: "limited"`

14101387

1411 - `"limited"`

1412

14131388 - `secret_name: string`

14141389

14151390 Name of the environment variable.

14161391

14171392 - `type: "environment_variable"`

14181393

1419 - `"environment_variable"`

1420

14211394 - `created_at: string`

14221395

14231396 A timestamp in RFC 3339 format

14241397

1398 format: date-time

1399

14251400 - `metadata: map[string]`

14261401

14271402 Arbitrary key-value metadata attached to the credential.

14281403

14291404 - `type: "vault_credential"`

14301405

1431 - `"vault_credential"`

1432

14331406 - `updated_at: string`

14341407

14351408 A timestamp in RFC 3339 format

14361409

1410 format: date-time

1411

14371412 - `vault_id: string`

14381413

14391414 Identifier of the vault this credential belongs to.

from line 1419

14441419

14451420### Example

14461421

1447```http

1422```bash

14481423curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

14491424 -H 'Content-Type: application/json' \

14501425 -H 'anthropic-version: 2023-06-01' \

from line 1433

14581433 }'

14591434```

14601435

1461#### Response

1436#### Response (200)

14621437

14631438```json

14641439{

from line 1456

14811456

14821457## Delete Credential

14831458

1484**delete** `/v1/vaults/{vault_id}/credentials/{credential_id}`

1459**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`

14851460

14861461Delete Credential

14871462

1488### Path Parameters

1463### Path parameters

14891464

14901465- `vault_id: string`

14911466

14921467- `credential_id: string`

14931468

1494### Header Parameters

1469### Headers

14951470

14961471- `"anthropic-beta": optional array of AnthropicBeta`

14971472

from line 1546

15711546

15721547### Returns

15731548

1574- `BetaManagedAgentsDeletedCredential object { id, type }`

1549- `BetaManagedAgentsDeletedCredential object`

15751550

15761551 Confirmation of a deleted credential.

15771552

from line 1556

15811556

15821557 - `type: "vault_credential_deleted"`

15831558

1584 - `"vault_credential_deleted"`

1585

15861559### Example

15871560

1588```http

1561```bash

15891562curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

15901563 -X DELETE \

15911564 -H 'anthropic-version: 2023-06-01' \

from line 1566

15931566 -H "X-Api-Key: $ANTHROPIC_API_KEY"

15941567```

15951568

1596#### Response

1569#### Response (200)

15971570

15981571```json

15991572{

from line 1577

16041577

16051578## Archive Credential

16061579

1607**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`

1580**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`

16081581

16091582Archive Credential

16101583

1611### Path Parameters

1584### Path parameters

16121585

16131586- `vault_id: string`

16141587

16151588- `credential_id: string`

16161589

1617### Header Parameters

1590### Headers

16181591

16191592- `"anthropic-beta": optional array of AnthropicBeta`

16201593

from line 1667

16941667

16951668### Returns

16961669

1697- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

1670- `BetaManagedAgentsCredential object`

16981671

16991672 A credential stored in a vault. Sensitive fields are never returned in responses.

17001673

from line 1679

17061679

17071680 A timestamp in RFC 3339 format

17081681

1682 format: date-time

1683

17091684 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

17101685

17111686 Authentication details for a credential.

17121687

1713 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

1688 - `BetaManagedAgentsMCPOAuthAuthResponse object`

17141689

17151690 OAuth credential details for an MCP server.

17161691

from line 1695

17201695

17211696 - `type: "mcp_oauth"`

17221697

1723 - `"mcp_oauth"`

1724

17251698 - `expires_at: optional string or null`

17261699

17271700 A timestamp in RFC 3339 format

17281701

1702 format: date-time

1703

17291704 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

17301705

17311706 OAuth refresh token configuration returned in credential responses.

from line 1717

17421717

17431718 Token endpoint requires no client authentication.

17441719

1745 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

1720 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

17461721

17471722 Token endpoint requires no client authentication.

17481723

17491724 - `type: "none"`

17501725

1751 - `"none"`

1752

1753 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

1726 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

17541727

17551728 Token endpoint uses HTTP Basic authentication with client credentials.

17561729

17571730 - `type: "client_secret_basic"`

17581731

1759 - `"client_secret_basic"`

1760

1761 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

1732 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

17621733

17631734 Token endpoint uses POST body authentication with client credentials.

17641735

17651736 - `type: "client_secret_post"`

17661737

1767 - `"client_secret_post"`

1768

17691738 - `resource: optional string or null`

17701739

17711740 OAuth resource indicator.

from line 1743

17741743

17751744 OAuth scope for the refresh request.

17761745

1777 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

1746 - `BetaManagedAgentsStaticBearerAuthResponse object`

17781747

17791748 Static bearer token credential details for an MCP server.

17801749

from line 1753

17841753

17851754 - `type: "static_bearer"`

17861755

1787 - `"static_bearer"`

1788

1789 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

1756 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

17901757

17911758 Environment variable credential details. The secret value is never returned.

17921759

from line 1773

18061773

18071774 Outbound hosts the secret value is substituted on.

18081775

1809 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

1776 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

18101777

18111778 The secret is substituted on any host the session's Environment network policy permits egress to.

18121779

18131780 - `type: "unrestricted"`

18141781

1815 - `"unrestricted"`

1816

1817 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

1782 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

18181783

18191784 The secret is substituted only on requests to the listed hosts.

18201785

from line 1789

18241789

18251790 - `type: "limited"`

18261791

1827 - `"limited"`

1828

18291792 - `secret_name: string`

18301793

18311794 Name of the environment variable.

18321795

18331796 - `type: "environment_variable"`

18341797

1835 - `"environment_variable"`

1836

18371798 - `created_at: string`

18381799

18391800 A timestamp in RFC 3339 format

18401801

1802 format: date-time

1803

18411804 - `metadata: map[string]`

18421805

18431806 Arbitrary key-value metadata attached to the credential.

18441807

18451808 - `type: "vault_credential"`

18461809

1847 - `"vault_credential"`

1848

18491810 - `updated_at: string`

18501811

18511812 A timestamp in RFC 3339 format

18521813

1814 format: date-time

1815

18531816 - `vault_id: string`

18541817

18551818 Identifier of the vault this credential belongs to.

from line 1823

18601823

18611824### Example

18621825

1863```http

1826```bash

18641827curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \

18651828 -X POST \

18661829 -H 'anthropic-version: 2023-06-01' \

from line 1831

18681831 -H "X-Api-Key: $ANTHROPIC_API_KEY"

18691832```

18701833

1871#### Response

1834#### Response (200)

18721835

18731836```json

18741837{

from line 1854

18911854

18921855## Validate Credential

18931856

1894**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`

1857**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`

18951858

18961859Validate Credential

18971860

1898### Path Parameters

1861### Path parameters

18991862

19001863- `vault_id: string`

19011864

19021865- `credential_id: string`

19031866

1904### Header Parameters

1867### Headers

19051868

19061869- `"anthropic-beta": optional array of AnthropicBeta`

19071870

from line 1944

19811944

19821945### Returns

19831946

1984- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`

1947- `BetaManagedAgentsCredentialValidation object`

19851948

19861949 Result of live-probing a credential against its configured MCP server.

19871950

from line 1980

20171980

20181981 HTTP status code.

20191982

1983 format: int32

1984

20201985 - `method: string`

20211986

20221987 The MCP method that failed (for example `initialize` or `tools/list`).

from line 2018

20532018

20542019 - `type: "vault_credential_validation"`

20552020

2056 - `"vault_credential_validation"`

2057

20582021 - `validated_at: string`

20592022

20602023 A timestamp in RFC 3339 format

20612024

2025 format: date-time

2026

20622027 - `vault_id: string`

20632028

20642029 Identifier of the vault containing the credential.

20652030

20662031### Example

20672032

2068```http

2033```bash

20692034curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \

20702035 -X POST \

20712036 -H 'anthropic-version: 2023-06-01' \

from line 2038

20732038 -H "X-Api-Key: $ANTHROPIC_API_KEY"

20742039```

20752040

2076#### Response

2041#### Response (200)

20772042

20782043```json

20792044{

from line 2069

21042069}

21052070```

21062071

2107## Domain Types

2072## Domain types

21082073

21092074### Beta Managed Agents Credential

21102075

2111- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

2076- `BetaManagedAgentsCredential object`

21122077

21132078 A credential stored in a vault. Sensitive fields are never returned in responses.

21142079

from line 2085

21202085

21212086 A timestamp in RFC 3339 format

21222087

2088 format: date-time

2089

21232090 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

21242091

21252092 Authentication details for a credential.

21262093

2127 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

2094 - `BetaManagedAgentsMCPOAuthAuthResponse object`

21282095

21292096 OAuth credential details for an MCP server.

21302097

from line 2101

21342101

21352102 - `type: "mcp_oauth"`

21362103

2137 - `"mcp_oauth"`

2138

21392104 - `expires_at: optional string or null`

21402105

21412106 A timestamp in RFC 3339 format

21422107

2108 format: date-time

2109

21432110 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

21442111

21452112 OAuth refresh token configuration returned in credential responses.

from line 2123

21562123

21572124 Token endpoint requires no client authentication.

21582125

2159 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

2126 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

21602127

21612128 Token endpoint requires no client authentication.

21622129

21632130 - `type: "none"`

21642131

2165 - `"none"`

2166

2167 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

2132 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

21682133

21692134 Token endpoint uses HTTP Basic authentication with client credentials.

21702135

21712136 - `type: "client_secret_basic"`

21722137

2173 - `"client_secret_basic"`

2174

2175 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

2138 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

21762139

21772140 Token endpoint uses POST body authentication with client credentials.

21782141

21792142 - `type: "client_secret_post"`

21802143

2181 - `"client_secret_post"`

2182

21832144 - `resource: optional string or null`

21842145

21852146 OAuth resource indicator.

from line 2149

21882149

21892150 OAuth scope for the refresh request.

21902151

2191 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

2152 - `BetaManagedAgentsStaticBearerAuthResponse object`

21922153

21932154 Static bearer token credential details for an MCP server.

21942155

from line 2159

21982159

21992160 - `type: "static_bearer"`

22002161

2201 - `"static_bearer"`

2202

2203 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

2162 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

22042163

22052164 Environment variable credential details. The secret value is never returned.

22062165

from line 2179

22202179

22212180 Outbound hosts the secret value is substituted on.

22222181

2223 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

2182 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

22242183

22252184 The secret is substituted on any host the session's Environment network policy permits egress to.

22262185

22272186 - `type: "unrestricted"`

22282187

2229 - `"unrestricted"`

2230

2231 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

2188 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

22322189

22332190 The secret is substituted only on requests to the listed hosts.

22342191

from line 2195

22382195

22392196 - `type: "limited"`

22402197

2241 - `"limited"`

2242

22432198 - `secret_name: string`

22442199

22452200 Name of the environment variable.

22462201

22472202 - `type: "environment_variable"`

22482203

2249 - `"environment_variable"`

2250

22512204 - `created_at: string`

22522205

22532206 A timestamp in RFC 3339 format

22542207

2208 format: date-time

2209

22552210 - `metadata: map[string]`

22562211

22572212 Arbitrary key-value metadata attached to the credential.

22582213

22592214 - `type: "vault_credential"`

22602215

2261 - `"vault_credential"`

2262

22632216 - `updated_at: string`

22642217

22652218 A timestamp in RFC 3339 format

22662219

2220 format: date-time

2221

22672222 - `vault_id: string`

22682223

22692224 Identifier of the vault this credential belongs to.

from line 2233

22782233

22792234 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

22802235

2281 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

2236 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

22822237

22832238 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

22842239

22852240 - `type: "unrestricted"`

22862241

2287 - `"unrestricted"`

2288

2289 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

2242 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

22902243

22912244 Substitute the secret only on requests to the listed hosts.

22922245

from line 2249

22962249

22972250 - `type: "limited"`

22982251

2299 - `"limited"`

2300

23012252### Beta Managed Agents Credential Validation

23022253

2303- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`

2254- `BetaManagedAgentsCredentialValidation object`

23042255

23052256 Result of live-probing a credential against its configured MCP server.

23062257

from line 2287

23362287

23372288 HTTP status code.

23382289

2290 format: int32

2291

23392292 - `method: string`

23402293

23412294 The MCP method that failed (for example `initialize` or `tools/list`).

from line 2325

23722325

23732326 - `type: "vault_credential_validation"`

23742327

2375 - `"vault_credential_validation"`

2376

23772328 - `validated_at: string`

23782329

23792330 A timestamp in RFC 3339 format

23802331

2332 format: date-time

2333

23812334 - `vault_id: string`

23822335

23832336 Identifier of the vault containing the credential.

from line 2349

23962349

23972350### Beta Managed Agents Deleted Credential

23982351

2399- `BetaManagedAgentsDeletedCredential object { id, type }`

2352- `BetaManagedAgentsDeletedCredential object`

24002353

24012354 Confirmation of a deleted credential.

24022355

from line 2359

24062359

24072360 - `type: "vault_credential_deleted"`

24082361

2409 - `"vault_credential_deleted"`

2410

24112362### Beta Managed Agents Environment Variable Auth Response

24122363

2413- `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

2364- `BetaManagedAgentsEnvironmentVariableAuthResponse object`

24142365

24152366 Environment variable credential details. The secret value is never returned.

24162367

from line 2381

24302381

24312382 Outbound hosts the secret value is substituted on.

24322383

2433 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

2384 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

24342385

24352386 The secret is substituted on any host the session's Environment network policy permits egress to.

24362387

24372388 - `type: "unrestricted"`

24382389

2439 - `"unrestricted"`

2440

2441 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

2390 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

24422391

24432392 The secret is substituted only on requests to the listed hosts.

24442393

from line 2397

24482397

24492398 - `type: "limited"`

24502399

2451 - `"limited"`

2452

24532400 - `secret_name: string`

24542401

24552402 Name of the environment variable.

24562403

24572404 - `type: "environment_variable"`

24582405

2459 - `"environment_variable"`

2460

24612406### Beta Managed Agents Environment Variable Create Params

24622407

2463- `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`

2408- `BetaManagedAgentsEnvironmentVariableCreateParams object`

24642409

24652410 Parameters for creating an environment variable credential.

24662411

from line 2413

24682413

24692414 Outbound hosts the secret value is substituted on.

24702415

2471 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

2416 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

24722417

24732418 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

24742419

24752420 - `type: "unrestricted"`

24762421

2477 - `"unrestricted"`

2478

2479 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

2422 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

24802423

24812424 Substitute the secret only on requests to the listed hosts.

24822425

from line 2429

24862429

24872430 - `type: "limited"`

24882431

2489 - `"limited"`

2490

24912432 - `secret_name: string`

24922433

24932434 Name of the environment variable. Immutable after create.

24942435

2436 minLength: 1, maxLength: 255

2437

24952438 - `secret_value: string`

24962439

24972440 Secret value. Write-only; never returned in responses.

24982441

2442 minLength: 1, maxLength: 4096

2443

24992444 - `type: "environment_variable"`

25002445

2501 - `"environment_variable"`

2502

25032446 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`

25042447

25052448 Where in the outbound request the secret value may be substituted.

from line 2457

25142457

25152458### Beta Managed Agents Environment Variable Update Params

25162459

2517- `BetaManagedAgentsEnvironmentVariableUpdateParams object { type, injection_location, networking, secret_value }`

2460- `BetaManagedAgentsEnvironmentVariableUpdateParams object`

25182461

25192462 Parameters for updating an environment variable credential. `secret_name` is immutable.

25202463

25212464 - `type: "environment_variable"`

25222465

2523 - `"environment_variable"`

2524

25252466 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`

25262467

25272468 Updated injection location.

from line 2479

25382479

25392480 Updated networking scope. Full replacement.

25402481

2541 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

2482 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

25422483

25432484 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

25442485

25452486 - `type: "unrestricted"`

25462487

2547 - `"unrestricted"`

2548

2549 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

2488 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

25502489

25512490 Substitute the secret only on requests to the listed hosts.

25522491

from line 2495

25562495

25572496 - `type: "limited"`

25582497

2559 - `"limited"`

2560

25612498 - `secret_value: optional string or null`

25622499

25632500 Updated secret value.

25642501

2502 minLength: 1, maxLength: 4096

2503

25652504### Beta Managed Agents Injection Location Params

25662505

2567- `BetaManagedAgentsInjectionLocationParams object { body, header }`

2506- `BetaManagedAgentsInjectionLocationParams object`

25682507

25692508 Where in the outbound request the secret value may be substituted.

25702509

from line 2517

25782517

25792518### Beta Managed Agents Injection Location Response

25802519

2581- `BetaManagedAgentsInjectionLocationResponse object { body, header }`

2520- `BetaManagedAgentsInjectionLocationResponse object`

25822521

25832522 Where in the outbound request the secret value is substituted.

25842523

from line 2531

25922531

25932532### Beta Managed Agents Injection Location Update Params

25942533

2595- `BetaManagedAgentsInjectionLocationUpdateParams object { body, header }`

2534- `BetaManagedAgentsInjectionLocationUpdateParams object`

25962535

25972536 Updated injection location.

25982537

from line 2545

26062545

26072546### Beta Managed Agents Limited Credential Networking Params

26082547

2609- `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

2548- `BetaManagedAgentsLimitedCredentialNetworkingParams object`

26102549

26112550 Substitute the secret only on requests to the listed hosts.

26122551

from line 2555

26162555

26172556 - `type: "limited"`

26182557

2619 - `"limited"`

2620

26212558### Beta Managed Agents Limited Credential Networking Response

26222559

2623- `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

2560- `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

26242561

26252562 The secret is substituted only on requests to the listed hosts.

26262563

from line 2567

26302567

26312568 - `type: "limited"`

26322569

2633 - `"limited"`

2634

26352570### Beta Managed Agents MCP OAuth Auth Response

26362571

2637- `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

2572- `BetaManagedAgentsMCPOAuthAuthResponse object`

26382573

26392574 OAuth credential details for an MCP server.

26402575

from line 2579

26442579

26452580 - `type: "mcp_oauth"`

26462581

2647 - `"mcp_oauth"`

2648

26492582 - `expires_at: optional string or null`

26502583

26512584 A timestamp in RFC 3339 format

26522585

2586 format: date-time

2587

26532588 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

26542589

26552590 OAuth refresh token configuration returned in credential responses.

from line 2601

26662601

26672602 Token endpoint requires no client authentication.

26682603

2669 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

2604 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

26702605

26712606 Token endpoint requires no client authentication.

26722607

26732608 - `type: "none"`

26742609

2675 - `"none"`

2676

2677 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

2610 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

26782611

26792612 Token endpoint uses HTTP Basic authentication with client credentials.

26802613

26812614 - `type: "client_secret_basic"`

26822615

2683 - `"client_secret_basic"`

2684

2685 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

2616 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

26862617

26872618 Token endpoint uses POST body authentication with client credentials.

26882619

26892620 - `type: "client_secret_post"`

26902621

2691 - `"client_secret_post"`

2692

26932622 - `resource: optional string or null`

26942623

26952624 OAuth resource indicator.

from line 2629

27002629

27012630### Beta Managed Agents MCP OAuth Create Params

27022631

2703- `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`

2632- `BetaManagedAgentsMCPOAuthCreateParams object`

27042633

27052634 Parameters for creating an MCP OAuth credential.

27062635

from line 2637

27082637

27092638 OAuth access token.

27102639

2640 minLength: 1, maxLength: 8192

2641

27112642 - `mcp_server_url: string`

27122643

27132644 URL of the MCP server this credential authenticates against.

27142645

2646 minLength: 1, maxLength: 2047

2647

27152648 - `type: "mcp_oauth"`

27162649

2717 - `"mcp_oauth"`

2718

27192650 - `expires_at: optional string or null`

27202651

27212652 A timestamp in RFC 3339 format

27222653

2654 format: date-time

2655

27232656 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`

27242657

27252658 OAuth refresh token parameters for creating a credential with refresh support.

from line 2661

27282661

27292662 OAuth client ID.

27302663

2664 minLength: 1, maxLength: 1024

2665

27312666 - `refresh_token: string`

27322667

27332668 OAuth refresh token.

27342669

2670 minLength: 1, maxLength: 4096

2671

27352672 - `token_endpoint: string`

27362673

27372674 Token endpoint URL used to refresh the access token.

27382675

2676 minLength: 1, maxLength: 2047

2677

27392678 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

27402679

27412680 Token endpoint requires no client authentication.

27422681

2743 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

2682 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`

27442683

27452684 Token endpoint requires no client authentication.

27462685

27472686 - `type: "none"`

27482687

2749 - `"none"`

2750

2751 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

2688 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`

27522689

27532690 Token endpoint uses HTTP Basic authentication with client credentials.

27542691

from line 2693

27562693

27572694 OAuth client secret.

27582695

2696 minLength: 1, maxLength: 512

2697

27592698 - `type: "client_secret_basic"`

27602699

2761 - `"client_secret_basic"`

2762

2763 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

2700 - `BetaManagedAgentsTokenEndpointAuthPostParam object`

27642701

27652702 Token endpoint uses POST body authentication with client credentials.

27662703

from line 2705

27682705

27692706 OAuth client secret.

27702707

2708 minLength: 1, maxLength: 512

2709

27712710 - `type: "client_secret_post"`

27722711

2773 - `"client_secret_post"`

2774

27752712 - `resource: optional string or null`

27762713

27772714 OAuth resource indicator.

27782715

2716 minLength: 1, maxLength: 2047

2717

27792718 - `scope: optional string or null`

27802719

27812720 OAuth scope for the refresh request.

27822721

2722 minLength: 1, maxLength: 8192

2723

27832724### Beta Managed Agents MCP OAuth Refresh Params

27842725

2785- `BetaManagedAgentsMCPOAuthRefreshParams object { client_id, refresh_token, token_endpoint, 3 more }`

2726- `BetaManagedAgentsMCPOAuthRefreshParams object`

27862727

27872728 OAuth refresh token parameters for creating a credential with refresh support.

27882729

from line 2731

27902731

27912732 OAuth client ID.

27922733

2734 minLength: 1, maxLength: 1024

2735

27932736 - `refresh_token: string`

27942737

27952738 OAuth refresh token.

27962739

2740 minLength: 1, maxLength: 4096

2741

27972742 - `token_endpoint: string`

27982743

27992744 Token endpoint URL used to refresh the access token.

28002745

2746 minLength: 1, maxLength: 2047

2747

28012748 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

28022749

28032750 Token endpoint requires no client authentication.

28042751

2805 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

2752 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`

28062753

28072754 Token endpoint requires no client authentication.

28082755

28092756 - `type: "none"`

28102757

2811 - `"none"`

2812

2813 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

2758 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`

28142759

28152760 Token endpoint uses HTTP Basic authentication with client credentials.

28162761

from line 2763

28182763

28192764 OAuth client secret.

28202765

2766 minLength: 1, maxLength: 512

2767

28212768 - `type: "client_secret_basic"`

28222769

2823 - `"client_secret_basic"`

2824

2825 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

2770 - `BetaManagedAgentsTokenEndpointAuthPostParam object`

28262771

28272772 Token endpoint uses POST body authentication with client credentials.

28282773

from line 2775

28302775

28312776 OAuth client secret.

28322777

2778 minLength: 1, maxLength: 512

2779

28332780 - `type: "client_secret_post"`

28342781

2835 - `"client_secret_post"`

2836

28372782 - `resource: optional string or null`

28382783

28392784 OAuth resource indicator.

28402785

2786 minLength: 1, maxLength: 2047

2787

28412788 - `scope: optional string or null`

28422789

28432790 OAuth scope for the refresh request.

28442791

2792 minLength: 1, maxLength: 8192

2793

28452794### Beta Managed Agents MCP OAuth Refresh Response

28462795

2847- `BetaManagedAgentsMCPOAuthRefreshResponse object { client_id, token_endpoint, token_endpoint_auth, 2 more }`

2796- `BetaManagedAgentsMCPOAuthRefreshResponse object`

28482797

28492798 OAuth refresh token configuration returned in credential responses.

28502799

from line 2809

28602809

28612810 Token endpoint requires no client authentication.

28622811

2863 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

2812 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

28642813

28652814 Token endpoint requires no client authentication.

28662815

28672816 - `type: "none"`

28682817

2869 - `"none"`

2870

2871 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

2818 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

28722819

28732820 Token endpoint uses HTTP Basic authentication with client credentials.

28742821

28752822 - `type: "client_secret_basic"`

28762823

2877 - `"client_secret_basic"`

2878

2879 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

2824 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

28802825

28812826 Token endpoint uses POST body authentication with client credentials.

28822827

28832828 - `type: "client_secret_post"`

28842829

2885 - `"client_secret_post"`

2886

28872830 - `resource: optional string or null`

28882831

28892832 OAuth resource indicator.

from line 2837

28942837

28952838### Beta Managed Agents MCP OAuth Refresh Update Params

28962839

2897- `BetaManagedAgentsMCPOAuthRefreshUpdateParams object { refresh_token, scope, token_endpoint_auth }`

2840- `BetaManagedAgentsMCPOAuthRefreshUpdateParams object`

28982841

28992842 Parameters for updating OAuth refresh token configuration.

29002843

from line 2845

29022845

29032846 Updated OAuth refresh token.

29042847

2848 minLength: 1, maxLength: 4096

2849

29052850 - `scope: optional string or null`

29062851

29072852 Updated OAuth scope for the refresh request.

29082853

2854 maxLength: 8192

2855

29092856 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`

29102857

29112858 Updated HTTP Basic authentication parameters for the token endpoint.

29122859

2913 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

2860 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`

29142861

29152862 Updated HTTP Basic authentication parameters for the token endpoint.

29162863

29172864 - `type: "client_secret_basic"`

29182865

2919 - `"client_secret_basic"`

2920

29212866 - `client_secret: optional string or null`

29222867

29232868 Updated OAuth client secret.

29242869

2925 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

2870 minLength: 1, maxLength: 512

2871

2872 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`

29262873

29272874 Updated POST body authentication parameters for the token endpoint.

29282875

29292876 - `type: "client_secret_post"`

29302877

2931 - `"client_secret_post"`

2932

29332878 - `client_secret: optional string or null`

29342879

29352880 Updated OAuth client secret.

29362881

2882 minLength: 1, maxLength: 512

2883

29372884### Beta Managed Agents MCP OAuth Update Params

29382885

2939- `BetaManagedAgentsMCPOAuthUpdateParams object { type, access_token, expires_at, refresh }`

2886- `BetaManagedAgentsMCPOAuthUpdateParams object`

29402887

29412888 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.

29422889

29432890 - `type: "mcp_oauth"`

29442891

2945 - `"mcp_oauth"`

2946

29472892 - `access_token: optional string or null`

29482893

29492894 Updated OAuth access token.

29502895

2896 minLength: 1, maxLength: 8192

2897

29512898 - `expires_at: optional string or null`

29522899

29532900 A timestamp in RFC 3339 format

29542901

2902 format: date-time

2903

29552904 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`

29562905

29572906 Parameters for updating OAuth refresh token configuration.

from line 2909

29602909

29612910 Updated OAuth refresh token.

29622911

2912 minLength: 1, maxLength: 4096

2913

29632914 - `scope: optional string or null`

29642915

29652916 Updated OAuth scope for the refresh request.

29662917

2918 maxLength: 8192

2919

29672920 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`

29682921

29692922 Updated HTTP Basic authentication parameters for the token endpoint.

29702923

2971 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

2924 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`

29722925

29732926 Updated HTTP Basic authentication parameters for the token endpoint.

29742927

29752928 - `type: "client_secret_basic"`

29762929

2977 - `"client_secret_basic"`

2978

29792930 - `client_secret: optional string or null`

29802931

29812932 Updated OAuth client secret.

29822933

2983 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

2934 minLength: 1, maxLength: 512

2935

2936 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`

29842937

29852938 Updated POST body authentication parameters for the token endpoint.

29862939

29872940 - `type: "client_secret_post"`

29882941

2989 - `"client_secret_post"`

2990

29912942 - `client_secret: optional string or null`

29922943

29932944 Updated OAuth client secret.

29942945

2946 minLength: 1, maxLength: 512

2947

29952948### Beta Managed Agents MCP Probe

29962949

2997- `BetaManagedAgentsMCPProbe object { http_response, method }`

2950- `BetaManagedAgentsMCPProbe object`

29982951

29992952 The failing step of an MCP validation probe.

30002953

from line 2971

30182971

30192972 HTTP status code.

30202973

2974 format: int32

2975

30212976 - `method: string`

30222977

30232978 The MCP method that failed (for example `initialize` or `tools/list`).

30242979

30252980### Beta Managed Agents Refresh HTTP Response

30262981

3027- `BetaManagedAgentsRefreshHTTPResponse object { body, body_truncated, content_type, status_code }`

2982- `BetaManagedAgentsRefreshHTTPResponse object`

30282983

30292984 An HTTP response captured during a credential validation probe.

30302985

from line 2999

30442999

30453000 HTTP status code.

30463001

3002 format: int32

3003

30473004### Beta Managed Agents Refresh Object

30483005

3049- `BetaManagedAgentsRefreshObject object { http_response, status }`

3006- `BetaManagedAgentsRefreshObject object`

30503007

30513008 Outcome of a refresh-token exchange attempted during credential validation.

30523009

from line 3027

30703027

30713028 HTTP status code.

30723029

3030 format: int32

3031

30733032 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`

30743033

30753034 Outcome of a refresh-token exchange attempted during credential validation.

from line 3043

30843043

30853044### Beta Managed Agents Static Bearer Auth Response

30863045

3087- `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

3046- `BetaManagedAgentsStaticBearerAuthResponse object`

30883047

30893048 Static bearer token credential details for an MCP server.

30903049

from line 3053

30943053

30953054 - `type: "static_bearer"`

30963055

3097 - `"static_bearer"`

3098

30993056### Beta Managed Agents Static Bearer Create Params

31003057

3101- `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`

3058- `BetaManagedAgentsStaticBearerCreateParams object`

31023059

31033060 Parameters for creating a static bearer token credential.

31043061

from line 3063

31063063

31073064 Static bearer token value.

31083065

3066 minLength: 1, maxLength: 8192

3067

31093068 - `mcp_server_url: string`

31103069

31113070 URL of the MCP server this credential authenticates against.

31123071

3072 minLength: 1, maxLength: 2047

3073

31133074 - `type: "static_bearer"`

31143075

3115 - `"static_bearer"`

3116

31173076### Beta Managed Agents Static Bearer Update Params

31183077

3119- `BetaManagedAgentsStaticBearerUpdateParams object { type, token }`

3078- `BetaManagedAgentsStaticBearerUpdateParams object`

31203079

31213080 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.

31223081

31233082 - `type: "static_bearer"`

31243083

3125 - `"static_bearer"`

3126

31273084 - `token: optional string or null`

31283085

31293086 Updated static bearer token value.

31303087

3088 minLength: 1, maxLength: 8192

3089

31313090### Beta Managed Agents Token Endpoint Auth Basic Param

31323091

3133- `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

3092- `BetaManagedAgentsTokenEndpointAuthBasicParam object`

31343093

31353094 Token endpoint uses HTTP Basic authentication with client credentials.

31363095

from line 3097

31383097

31393098 OAuth client secret.

31403099

3100 minLength: 1, maxLength: 512

3101

31413102 - `type: "client_secret_basic"`

31423103

3143 - `"client_secret_basic"`

3144

31453104### Beta Managed Agents Token Endpoint Auth Basic Response

31463105

3147- `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

3106- `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

31483107

31493108 Token endpoint uses HTTP Basic authentication with client credentials.

31503109

31513110 - `type: "client_secret_basic"`

31523111

3153 - `"client_secret_basic"`

3154

31553112### Beta Managed Agents Token Endpoint Auth Basic Update Param

31563113

3157- `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`

3114- `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`

31583115

31593116 Updated HTTP Basic authentication parameters for the token endpoint.

31603117

31613118 - `type: "client_secret_basic"`

31623119

3163 - `"client_secret_basic"`

3164

31653120 - `client_secret: optional string or null`

31663121

31673122 Updated OAuth client secret.

31683123

3124 minLength: 1, maxLength: 512

3125

31693126### Beta Managed Agents Token Endpoint Auth None Param

31703127

3171- `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

3128- `BetaManagedAgentsTokenEndpointAuthNoneParam object`

31723129

31733130 Token endpoint requires no client authentication.

31743131

31753132 - `type: "none"`

31763133

3177 - `"none"`

3178

31793134### Beta Managed Agents Token Endpoint Auth None Response

31803135

3181- `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

3136- `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

31823137

31833138 Token endpoint requires no client authentication.

31843139

31853140 - `type: "none"`

31863141

3187 - `"none"`

3188

31893142### Beta Managed Agents Token Endpoint Auth Post Param

31903143

3191- `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

3144- `BetaManagedAgentsTokenEndpointAuthPostParam object`

31923145

31933146 Token endpoint uses POST body authentication with client credentials.

31943147

from line 3149

31963149

31973150 OAuth client secret.

31983151

3152 minLength: 1, maxLength: 512

3153

31993154 - `type: "client_secret_post"`

32003155

3201 - `"client_secret_post"`

3202

32033156### Beta Managed Agents Token Endpoint Auth Post Response

32043157

3205- `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

3158- `BetaManagedAgentsTokenEndpointAuthPostResponse object`

32063159

32073160 Token endpoint uses POST body authentication with client credentials.

32083161

32093162 - `type: "client_secret_post"`

32103163

3211 - `"client_secret_post"`

3212

32133164### Beta Managed Agents Token Endpoint Auth Post Update Param

32143165

3215- `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`

3166- `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`

32163167

32173168 Updated POST body authentication parameters for the token endpoint.

32183169

32193170 - `type: "client_secret_post"`

32203171

3221 - `"client_secret_post"`

3222

32233172 - `client_secret: optional string or null`

32243173

32253174 Updated OAuth client secret.

32263175

3176 minLength: 1, maxLength: 512

3177

32273178### Beta Managed Agents Unrestricted Credential Networking Params

32283179

3229- `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

3180- `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

32303181

32313182 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

32323183

32333184 - `type: "unrestricted"`

32343185

3235 - `"unrestricted"`

3236

32373186### Beta Managed Agents Unrestricted Credential Networking Response

32383187

3239- `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

3188- `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

32403189

32413190 The secret is substituted on any host the session's Environment network policy permits egress to.

32423191

32433192 - `type: "unrestricted"`

3244

3245 - `"unrestricted"`

32463193

api/beta/vaults/credentials/archive Changed · +28 / -43 lines

# Archive Credential ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Archive Credential ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Archive Credential

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/archive

4---

1# Archive Credential

6## Archive Credential

3**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`

8**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`

105Archive Credential

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

1611- `credential_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Returns

91## Returns

9792

98- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

93- `BetaManagedAgentsCredential object`

9994

10095 A credential stored in a vault. Sensitive fields are never returned in responses.

10196

from line 102

107102

108103 A timestamp in RFC 3339 format

109104

105 format: date-time

106

110107 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

111108

112109 Authentication details for a credential.

113110

114 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

111 - `BetaManagedAgentsMCPOAuthAuthResponse object`

115112

116113 OAuth credential details for an MCP server.

117114

from line 118

121118

122119 - `type: "mcp_oauth"`

123120

124 - `"mcp_oauth"`

125

126121 - `expires_at: optional string or null`

127122

128123 A timestamp in RFC 3339 format

129124

125 format: date-time

126

130127 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

131128

132129 OAuth refresh token configuration returned in credential responses.

from line 140

143140

144141 Token endpoint requires no client authentication.

145142

146 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

143 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

147144

148145 Token endpoint requires no client authentication.

149146

150147 - `type: "none"`

151148

152 - `"none"`

149 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

153150

154 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

155

156151 Token endpoint uses HTTP Basic authentication with client credentials.

157152

158153 - `type: "client_secret_basic"`

159154

160 - `"client_secret_basic"`

155 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

161156

162 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

163

164157 Token endpoint uses POST body authentication with client credentials.

165158

166159 - `type: "client_secret_post"`

167160

168 - `"client_secret_post"`

169

170161 - `resource: optional string or null`

171162

172163 OAuth resource indicator.

from line 166

175166

176167 OAuth scope for the refresh request.

177168

178 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

169 - `BetaManagedAgentsStaticBearerAuthResponse object`

179170

180171 Static bearer token credential details for an MCP server.

181172

from line 176

185176

186177 - `type: "static_bearer"`

187178

188 - `"static_bearer"`

179 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

189180

190 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

191

192181 Environment variable credential details. The secret value is never returned.

193182

194183 - `injection_location: BetaManagedAgentsInjectionLocationResponse`

from line 196

207196

208197 Outbound hosts the secret value is substituted on.

209198

210 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

199 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

211200

212201 The secret is substituted on any host the session's Environment network policy permits egress to.

213202

214203 - `type: "unrestricted"`

215204

216 - `"unrestricted"`

205 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

217206

218 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

219

220207 The secret is substituted only on requests to the listed hosts.

221208

222209 - `allowed_hosts: array of string`

from line 212

225212

226213 - `type: "limited"`

227214

228 - `"limited"`

229

230215 - `secret_name: string`

231216

232217 Name of the environment variable.

from line 218

233218

234219 - `type: "environment_variable"`

235220

236 - `"environment_variable"`

237

238221 - `created_at: string`

239222

240223 A timestamp in RFC 3339 format

241224

225 format: date-time

226

242227 - `metadata: map[string]`

243228

244229 Arbitrary key-value metadata attached to the credential.

from line 230

245230

246231 - `type: "vault_credential"`

247232

248 - `"vault_credential"`

249

250233 - `updated_at: string`

251234

252235 A timestamp in RFC 3339 format

253236

237 format: date-time

238

254239 - `vault_id: string`

255240

256241 Identifier of the vault this credential belongs to.

from line 244

259244

260245 Human-readable name for the credential.

261246

262### Example

247## Example

263248

264```http

249```bash

265250curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \

266251 -X POST \

267252 -H 'anthropic-version: 2023-06-01' \

from line 254

269254 -H "X-Api-Key: $ANTHROPIC_API_KEY"

270255```

271256

272#### Response

257### Response (200)

273258

274259```json

275260{

api/beta/vaults/credentials/create Changed · +67 / -68 lines

# Create Credential ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Credential ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Create Credential

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/create

4---

1# Create Credential

6## Create Credential

3**POST** `/v1/vaults/{vault_id}/credentials`

8**post** `/v1/vaults/{vault_id}/credentials`

105Create Credential

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

16### Header Parameters

11## Headers

1712

1813- `"anthropic-beta": optional array of AnthropicBeta`

1914

from line 86

9186

9287 - `"mid-conversation-tool-changes-2026-07-01"`

9388

94### Body Parameters

89## Body parameters

9590

9691- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`

9792

9893 Authentication details for creating a credential.

9994

100 - `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`

95 - `BetaManagedAgentsMCPOAuthCreateParams object`

10196

10297 Parameters for creating an MCP OAuth credential.

10398

from line 100

105100

106101 OAuth access token.

107102

103 minLength: 1, maxLength: 8192

104

108105 - `mcp_server_url: string`

109106

110107 URL of the MCP server this credential authenticates against.

111108

109 minLength: 1, maxLength: 2047

110

112111 - `type: "mcp_oauth"`

113112

114 - `"mcp_oauth"`

115

116113 - `expires_at: optional string or null`

117114

118115 A timestamp in RFC 3339 format

119116

117 format: date-time

118

120119 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`

121120

122121 OAuth refresh token parameters for creating a credential with refresh support.

from line 124

125124

126125 OAuth client ID.

127126

127 minLength: 1, maxLength: 1024

128

128129 - `refresh_token: string`

129130

130131 OAuth refresh token.

131132

133 minLength: 1, maxLength: 4096

134

132135 - `token_endpoint: string`

133136

134137 Token endpoint URL used to refresh the access token.

135138

139 minLength: 1, maxLength: 2047

140

136141 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`

137142

138143 Token endpoint requires no client authentication.

139144

140 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`

145 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`

141146

142147 Token endpoint requires no client authentication.

143148

144149 - `type: "none"`

145150

146 - `"none"`

151 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`

147152

148 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`

149

150153 Token endpoint uses HTTP Basic authentication with client credentials.

151154

152155 - `client_secret: string`

from line 156

153156

154157 OAuth client secret.

155158

159 minLength: 1, maxLength: 512

160

156161 - `type: "client_secret_basic"`

157162

158 - `"client_secret_basic"`

163 - `BetaManagedAgentsTokenEndpointAuthPostParam object`

159164

160 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`

161

162165 Token endpoint uses POST body authentication with client credentials.

163166

164167 - `client_secret: string`

from line 168

165168

166169 OAuth client secret.

167170

171 minLength: 1, maxLength: 512

172

168173 - `type: "client_secret_post"`

169174

170 - `"client_secret_post"`

171

172175 - `resource: optional string or null`

173176

174177 OAuth resource indicator.

175178

179 minLength: 1, maxLength: 2047

180

176181 - `scope: optional string or null`

177182

178183 OAuth scope for the refresh request.

179184

180 - `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`

185 minLength: 1, maxLength: 8192

181186

187 - `BetaManagedAgentsStaticBearerCreateParams object`

188

182189 Parameters for creating a static bearer token credential.

183190

184191 - `token: string`

from line 192

185192

186193 Static bearer token value.

187194

195 minLength: 1, maxLength: 8192

196

188197 - `mcp_server_url: string`

189198

190199 URL of the MCP server this credential authenticates against.

191200

201 minLength: 1, maxLength: 2047

202

192203 - `type: "static_bearer"`

193204

194 - `"static_bearer"`

205 - `BetaManagedAgentsEnvironmentVariableCreateParams object`

195206

196 - `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`

197

198207 Parameters for creating an environment variable credential.

199208

200209 - `networking: BetaManagedAgentsCredentialNetworkingParams`

from line 210

201210

202211 Outbound hosts the secret value is substituted on.

203212

204 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`

213 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`

205214

206215 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.

207216

208217 - `type: "unrestricted"`

209218

210 - `"unrestricted"`

219 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`

211220

212 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`

213

214221 Substitute the secret only on requests to the listed hosts.

215222

216223 - `allowed_hosts: array of string`

from line 226

219226

220227 - `type: "limited"`

221228

222 - `"limited"`

223

224229 - `secret_name: string`

225230

226231 Name of the environment variable. Immutable after create.

227232

233 minLength: 1, maxLength: 255

234

228235 - `secret_value: string`

229236

230237 Secret value. Write-only; never returned in responses.

231238

239 minLength: 1, maxLength: 4096

240

232241 - `type: "environment_variable"`

233242

234 - `"environment_variable"`

235

236243 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`

237244

238245 Where in the outbound request the secret value may be substituted.

from line 256

249256

250257 Human-readable name for the credential. Up to 255 characters.

251258

259 maxLength: 255

260

252261- `metadata: optional map[string]`

253262

254263 Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.

255264

256### Returns

265## Returns

257266

258- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

267- `BetaManagedAgentsCredential object`

259268

260269 A credential stored in a vault. Sensitive fields are never returned in responses.

261270

from line 276

267276

268277 A timestamp in RFC 3339 format

269278

279 format: date-time

280

270281 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

271282

272283 Authentication details for a credential.

273284

274 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

285 - `BetaManagedAgentsMCPOAuthAuthResponse object`

275286

276287 OAuth credential details for an MCP server.

277288

from line 292

281292

282293 - `type: "mcp_oauth"`

283294

284 - `"mcp_oauth"`

285

286295 - `expires_at: optional string or null`

287296

288297 A timestamp in RFC 3339 format

289298

299 format: date-time

300

290301 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

291302

292303 OAuth refresh token configuration returned in credential responses.

from line 314

303314

304315 Token endpoint requires no client authentication.

305316

306 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

317 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

307318

308319 Token endpoint requires no client authentication.

309320

310321 - `type: "none"`

311322

312 - `"none"`

323 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

313324

314 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

315

316325 Token endpoint uses HTTP Basic authentication with client credentials.

317326

318327 - `type: "client_secret_basic"`

319328

320 - `"client_secret_basic"`

329 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

321330

322 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

323

324331 Token endpoint uses POST body authentication with client credentials.

325332

326333 - `type: "client_secret_post"`

327334

328 - `"client_secret_post"`

329

330335 - `resource: optional string or null`

331336

332337 OAuth resource indicator.

from line 340

335340

336341 OAuth scope for the refresh request.

337342

338 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

343 - `BetaManagedAgentsStaticBearerAuthResponse object`

339344

340345 Static bearer token credential details for an MCP server.

341346

from line 350

345350

346351 - `type: "static_bearer"`

347352

348 - `"static_bearer"`

353 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

349354

350 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

351

352355 Environment variable credential details. The secret value is never returned.

353356

354357 - `injection_location: BetaManagedAgentsInjectionLocationResponse`

from line 370

367370

368371 Outbound hosts the secret value is substituted on.

369372

370 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

373 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

371374

372375 The secret is substituted on any host the session's Environment network policy permits egress to.

373376

374377 - `type: "unrestricted"`

375378

376 - `"unrestricted"`

379 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

377380

378 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

379

380381 The secret is substituted only on requests to the listed hosts.

381382

382383 - `allowed_hosts: array of string`

from line 386

385386

386387 - `type: "limited"`

387388

388 - `"limited"`

389

390389 - `secret_name: string`

391390

392391 Name of the environment variable.

from line 392

393392

394393 - `type: "environment_variable"`

395394

396 - `"environment_variable"`

397

398395 - `created_at: string`

399396

400397 A timestamp in RFC 3339 format

401398

399 format: date-time

400

402401 - `metadata: map[string]`

403402

404403 Arbitrary key-value metadata attached to the credential.

from line 404

405404

406405 - `type: "vault_credential"`

407406

408 - `"vault_credential"`

409

410407 - `updated_at: string`

411408

412409 A timestamp in RFC 3339 format

413410

411 format: date-time

412

414413 - `vault_id: string`

415414

416415 Identifier of the vault this credential belongs to.

from line 418

419418

420419 Human-readable name for the credential.

421420

422### Example

421## Example

423422

424```http

423```bash

425424curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

426425 -H 'Content-Type: application/json' \

427426 -H 'anthropic-version: 2023-06-01' \

from line 439

440439 }'

441440```

442441

443#### Response

442### Response (200)

444443

445444```json

446445{

api/beta/vaults/credentials/delete Changed · +9 / -16 lines

# Delete Credential ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Delete Credential ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Delete Credential

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/delete

4---

1# Delete Credential

6## Delete Credential

3**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`

8**delete** `/v1/vaults/{vault_id}/credentials/{credential_id}`

105Delete Credential

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

1611- `credential_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Returns

91## Returns

9792

98- `BetaManagedAgentsDeletedCredential object { id, type }`

93- `BetaManagedAgentsDeletedCredential object`

9994

10095 Confirmation of a deleted credential.

10196

from line 100

105100

106101 - `type: "vault_credential_deleted"`

107102

108 - `"vault_credential_deleted"`

103## Example

109104

110### Example

111

112```http

105```bash

113106curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

114107 -X DELETE \

115108 -H 'anthropic-version: 2023-06-01' \

from line 110

117110 -H "X-Api-Key: $ANTHROPIC_API_KEY"

118111```

119112

120#### Response

113### Response (200)

121114

122115```json

123116{

api/beta/vaults/credentials/list Changed · +29 / -42 lines

# List Credentials ## Path parameters ## Query parameters ## Headers ## Returns ## Example ### Response (200) ## List Credentials ### Path Parameters ### Query Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: List Credentials

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/list

4---

1# List Credentials

6## List Credentials

3**GET** `/v1/vaults/{vault_id}/credentials`

8**get** `/v1/vaults/{vault_id}/credentials`

105List Credentials

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

16### Query Parameters

11## Query parameters

1712

1813- `include_archived: optional boolean`

1914

from line 18

2318

2419 Maximum number of credentials to return per page. Defaults to 20, maximum 100.

2520

21 format: int32

2623- `page: optional string`

2724

2825 Opaque pagination token from a previous `list_credentials` response.

2926

30### Header Parameters

27## Headers

3128

3229- `"anthropic-beta": optional array of AnthropicBeta`

3330

from line 102

105102

106103 - `"mid-conversation-tool-changes-2026-07-01"`

107104

108### Returns

105## Returns

109106

110107- `data: optional array of BetaManagedAgentsCredential`

111108

from line 116

119116

120117 A timestamp in RFC 3339 format

121118

119 format: date-time

120

122121 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

123122

124123 Authentication details for a credential.

125124

126 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

125 - `BetaManagedAgentsMCPOAuthAuthResponse object`

127126

128127 OAuth credential details for an MCP server.

129128

from line 132

133132

134133 - `type: "mcp_oauth"`

135134

136 - `"mcp_oauth"`

137

138135 - `expires_at: optional string or null`

139136

140137 A timestamp in RFC 3339 format

141138

139 format: date-time

140

142141 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

143142

144143 OAuth refresh token configuration returned in credential responses.

from line 154

155154

156155 Token endpoint requires no client authentication.

157156

158 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

157 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

159158

160159 Token endpoint requires no client authentication.

161160

162161 - `type: "none"`

163162

164 - `"none"`

163 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

165164

166 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

167

168165 Token endpoint uses HTTP Basic authentication with client credentials.

169166

170167 - `type: "client_secret_basic"`

171168

172 - `"client_secret_basic"`

169 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

173170

174 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

175

176171 Token endpoint uses POST body authentication with client credentials.

177172

178173 - `type: "client_secret_post"`

179174

180 - `"client_secret_post"`

181

182175 - `resource: optional string or null`

183176

184177 OAuth resource indicator.

from line 180

187180

188181 OAuth scope for the refresh request.

189182

190 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

183 - `BetaManagedAgentsStaticBearerAuthResponse object`

191184

192185 Static bearer token credential details for an MCP server.

193186

from line 190

197190

198191 - `type: "static_bearer"`

199192

200 - `"static_bearer"`

193 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

201194

202 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

203

204195 Environment variable credential details. The secret value is never returned.

205196

206197 - `injection_location: BetaManagedAgentsInjectionLocationResponse`

from line 210

219210

220211 Outbound hosts the secret value is substituted on.

221212

222 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

213 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

223214

224215 The secret is substituted on any host the session's Environment network policy permits egress to.

225216

226217 - `type: "unrestricted"`

227218

228 - `"unrestricted"`

219 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

229220

230 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

231

232221 The secret is substituted only on requests to the listed hosts.

233222

234223 - `allowed_hosts: array of string`

from line 226

237226

238227 - `type: "limited"`

239228

240 - `"limited"`

241

242229 - `secret_name: string`

243230

244231 Name of the environment variable.

from line 232

245232

246233 - `type: "environment_variable"`

247234

248 - `"environment_variable"`

249

250235 - `created_at: string`

251236

252237 A timestamp in RFC 3339 format

253238

239 format: date-time

240

254241 - `metadata: map[string]`

255242

256243 Arbitrary key-value metadata attached to the credential.

from line 244

257244

258245 - `type: "vault_credential"`

259246

260 - `"vault_credential"`

261

262247 - `updated_at: string`

263248

264249 A timestamp in RFC 3339 format

265250

251 format: date-time

252

266253 - `vault_id: string`

267254

268255 Identifier of the vault this credential belongs to.

from line 262

275262

276263 Pagination token for the next page, or null if no more results.

277264

278### Example

265## Example

279266

280```http

267```bash

281268curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \

282269 -H 'anthropic-version: 2023-06-01' \

283270 -H 'anthropic-beta: managed-agents-2026-04-01' \

from line 271

284271 -H "X-Api-Key: $ANTHROPIC_API_KEY"

285272```

286273

287#### Response

274### Response (200)

288275

289276```json

290277{

api/beta/vaults/credentials/mcp_oauth_validate Changed · +16 / -19 lines

# Validate Credential ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Validate Credential ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Validate Credential

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/mcp_oauth_validate

4---

1# Validate Credential

6## Validate Credential

3**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`

8**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`

105Validate Credential

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

1611- `credential_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Returns

91## Returns

9792

98- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`

93- `BetaManagedAgentsCredentialValidation object`

9994

10095 Result of live-probing a credential against its configured MCP server.

10196

from line 126

131126

132127 HTTP status code.

133128

129 format: int32

130

134131 - `method: string`

135132

136133 The MCP method that failed (for example `initialize` or `tools/list`).

from line 164

167164

168165 - `type: "vault_credential_validation"`

169166

170 - `"vault_credential_validation"`

171

172167 - `validated_at: string`

173168

174169 A timestamp in RFC 3339 format

175170

171 format: date-time

172

176173 - `vault_id: string`

177174

178175 Identifier of the vault containing the credential.

179176

180### Example

177## Example

181178

182```http

179```bash

183180curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \

184181 -X POST \

185182 -H 'anthropic-version: 2023-06-01' \

from line 184

187184 -H "X-Api-Key: $ANTHROPIC_API_KEY"

188185```

189186

190#### Response

187### Response (200)

191188

192189```json

193190{

api/beta/vaults/credentials/retrieve Changed · +28 / -43 lines

# Get Credential ## Path parameters ## Headers ## Returns ## Example ### Response (200) ## Get Credential ### Path Parameters ### Header Parameters ### Returns ### Example #### Response

from line 1

1---

2title: Get Credential

3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials/retrieve

4---

1# Get Credential

6## Get Credential

3**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`

8**get** `/v1/vaults/{vault_id}/credentials/{credential_id}`

105Get Credential

116

12### Path Parameters

7## Path parameters

138

149- `vault_id: string`

1510

1611- `credential_id: string`

1712

18### Header Parameters

13## Headers

1914

2015- `"anthropic-beta": optional array of AnthropicBeta`

2116

from line 88

9388

9489 - `"mid-conversation-tool-changes-2026-07-01"`

9590

96### Returns

91## Returns

9792

98- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`

93- `BetaManagedAgentsCredential object`

9994

10095 A credential stored in a vault. Sensitive fields are never returned in responses.

10196

from line 102

107102

108103 A timestamp in RFC 3339 format

109104

105 format: date-time

106

110107 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`

111108

112109 Authentication details for a credential.

113110

114 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`

111 - `BetaManagedAgentsMCPOAuthAuthResponse object`

115112

116113 OAuth credential details for an MCP server.

117114

from line 118

121118

122119 - `type: "mcp_oauth"`

123120

124 - `"mcp_oauth"`

125

126121 - `expires_at: optional string or null`

127122

128123 A timestamp in RFC 3339 format

129124

125 format: date-time

126

130127 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`

131128

132129 OAuth refresh token configuration returned in credential responses.

from line 140

143140

144141 Token endpoint requires no client authentication.

145142

146 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`

143 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`

147144

148145 Token endpoint requires no client authentication.

149146

150147 - `type: "none"`

151148

152 - `"none"`

149 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`

153150

154 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`

155

156151 Token endpoint uses HTTP Basic authentication with client credentials.

157152

158153 - `type: "client_secret_basic"`

159154

160 - `"client_secret_basic"`

155 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`

161156

162 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`

163

164157 Token endpoint uses POST body authentication with client credentials.

165158

166159 - `type: "client_secret_post"`

167160

168 - `"client_secret_post"`

169

170161 - `resource: optional string or null`

171162

172163 OAuth resource indicator.

from line 166

175166

176167 OAuth scope for the refresh request.

177168

178 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`

169 - `BetaManagedAgentsStaticBearerAuthResponse object`

179170

180171 Static bearer token credential details for an MCP server.

181172

from line 176

185176

186177 - `type: "static_bearer"`

187178

188 - `"static_bearer"`

179 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`

189180

190 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`

191

192181 Environment variable credential details. The secret value is never returned.

193182

194183 - `injection_location: BetaManagedAgentsInjectionLocationResponse`

from line 196

207196

208197 Outbound hosts the secret value is substituted on.

209198

210 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`

199 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`

211200

212201 The secret is substituted on any host the session's Environment network policy permits egress to.

213202

214203 - `type: "unrestricted"`

215204

216 - `"unrestricted"`

205 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`

217206

218 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`

219

220207 The secret is substituted only on requests to the listed hosts.

221208

222209 - `allowed_hosts: array of string`

from line 212

225212

226213 - `type: "limited"`

227214

228 - `"limited"`

229

230215 - `secret_name: string`

231216

232217 Name of the environment variable.

from line 218

233218

234219 - `type: "environment_variable"`

235220

236 - `"environment_variable"`

237

238221 - `created_at: string`

239222

240223 A timestamp in RFC 3339 format

241224

225 format: date-time

226

242227 - `metadata: map[string]`

243228

244229 Arbitrary key-value metadata attached to the credential.

from line 230

245230

246231 - `type: "vault_credential"`

247232

248 - `"vault_credential"`

249

250233 - `updated_at: string`

251234

252235 A timestamp in RFC 3339 format

253236

237 format: date-time

238

254239 - `vault_id: string`

255240

256241 Identifier of the vault this credential belongs to.

from line 244

259244

260245 Human-readable name for the credential.

261246

262### Example

247## Example

263248

264```http

249```bash

265250curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \

266251 -H 'anthropic-version: 2023-06-01' \

267252 -H 'anthropic-beta: managed-agents-2026-04-01' \

from line 253

268253 -H "X-Api-Key: $ANTHROPIC_API_KEY"

269254```

270255

271#### Response

256### Response (200)

272257

273258```json

274259{