Vaults changedapi/beta/vaults
Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+105added
Lines−81removed
From line
5
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits20to this page, all time
## Create a Vault ## Retrieve a Vault ## Update a Vault ## Delete a Vault ## Archive a Vault ### Create a Credential ### Retrieve a Credential ### Update a Credential ### Delete a Credential ### Archive a Credential ### Validate an MCP OAuth Credential ## Create Vault ## Get Vault ## Update Vault ## Delete Vault ## Archive Vault ### Create Credential ### Get Credential ### Update Credential ### Delete Credential ### Archive Credential ### Validate Credential
The whole hunk
from line 5, old and new numbered
/
from line 5
55
66# Vaults
77
8## Create Vault
8## Create a Vault
99
1010**POST** `/v1/vaults`
1111
12Create Vault
12Create a Vault
1313
1414### Headers
1515
from line 155
155155
156156 - `id: string`
157157
158 Unique identifier for the vault.
158 The unique ID of the vault (`vlt_...`).
159159
160160 - `archived_at: string or null`
161161
from line 225
225225
226226- `include_archived: optional boolean`
227227
228 Whether to include archived vaults in the results.
228 Whether to include archived vaults in the results. Defaults to `false`.
229229
230230- `limit: optional number`
231231
from line 235
235235
236236- `page: optional string`
237237
238 Opaque pagination token from a previous `list_vaults` response.
238 The `next_page` value from a previous [List Vaults](https://platform.claude.com/docs/en/api/beta/vaults/list?sdk_languages=http) response, to get the next page. Leave it out to get the first page.
239239
240240### Headers
241241
from line 363
363363
364364- `data: optional array of BetaManagedAgentsVault`
365365
366 List of vaults.
366 The vaults on this page, newest first.
367367
368368 - `type: "vault"`
369369
370370 - `id: string`
371371
372 Unique identifier for the vault.
372 The unique ID of the vault (`vlt_...`).
373373
374374 - `archived_at: string or null`
375375
from line 431
431431}
432432```
433433
434## Get Vault
434## Retrieve a Vault
435435
436436**GET** `/v1/vaults/{vault_id}`
437437
438Get Vault
438Retrieve a Vault
439439
440440### Path parameters
441441
from line 575
575575
576576 - `id: string`
577577
578 Unique identifier for the vault.
578 The unique ID of the vault (`vlt_...`).
579579
580580 - `archived_at: string or null`
581581
from line 628
628628}
629629```
630630
631## Update Vault
631## Update a Vault
632632
633633**POST** `/v1/vaults/{vault_id}`
634634
635Update Vault
635Update a Vault
636636
637637### Path parameters
638638
from line 784
784784
785785 - `id: string`
786786
787 Unique identifier for the vault.
787 The unique ID of the vault (`vlt_...`).
788788
789789 - `archived_at: string or null`
790790
from line 844
844844}
845845```
846846
847## Delete Vault
847## Delete a Vault
848848
849849**DELETE** `/v1/vaults/{vault_id}`
850850
851Delete Vault
851Delete a Vault
852852
853853### Path parameters
854854
from line 988
988988
989989 - `id: string`
990990
991 Unique identifier of the deleted vault.
991 The unique ID of the deleted vault (`vlt_...`).
992992
993993### Example
994994
from line 1009
10091009}
10101010```
10111011
1012## Archive Vault
1012## Archive a Vault
10131013
10141014**POST** `/v1/vaults/{vault_id}/archive`
10151015
1016Archive Vault
1016Archive a Vault
10171017
10181018### Path parameters
10191019
from line 1153
11531153
11541154 - `id: string`
11551155
1156 Unique identifier for the vault.
1156 The unique ID of the vault (`vlt_...`).
11571157
11581158 - `archived_at: string or null`
11591159
from line 1219
12191219
12201220 - `id: string`
12211221
1222 Unique identifier of the deleted vault.
1222 The unique ID of the deleted vault (`vlt_...`).
12231223
12241224### Beta Managed Agents Vault
12251225
from line 1231
12311231
12321232 - `id: string`
12331233
1234 Unique identifier for the vault.
1234 The unique ID of the vault (`vlt_...`).
12351235
12361236 - `archived_at: string or null`
12371237
from line 1261
12611261
12621262## Vaults › Credentials
12631263
1264### Create Credential
1264### Create a Credential
12651265
12661266**POST** `/v1/vaults/{vault_id}/credentials`
12671267
1268Create Credential
1268Create a Credential
12691269
12701270#### Path parameters
12711271
from line 1409
14091409
14101410 - `access_token: string`
14111411
1412 OAuth access token.
1412 The OAuth access token to send to the MCP server.
14131413
14141414 minLength: 1, maxLength: 8192
14151415
from line 1421
14211421
14221422 - `expires_at: optional string or null`
14231423
1424 A timestamp in RFC 3339 format
1424 When `access_token` expires, in RFC 3339.
14251425
1426 Must be in the future.
1427
14261428 format: date-time
14271429
14281430 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`
from line 1433
14311433
14321434 - `client_id: string`
14331435
1434 OAuth client ID.
1436 The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created.
14351437
14361438 minLength: 1, maxLength: 1024
14371439
14381440 - `refresh_token: string`
14391441
1440 OAuth refresh token.
1442 The OAuth refresh token that the API uses to get a new access token when the current one expires.
14411443
14421444 minLength: 1, maxLength: 8192
14431445
from line 1465
14631465
14641466 - `client_secret: string`
14651467
1466 OAuth client secret.
1468 The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication.
14671469
14681470 minLength: 1, maxLength: 512
14691471
from line 1477
14751477
14761478 - `client_secret: string`
14771479
1478 OAuth client secret.
1480 The OAuth client secret, sent to `token_endpoint` in the POST body.
14791481
14801482 minLength: 1, maxLength: 512
14811483
from line 1501
14991501
15001502 - `token: string`
15011503
1502 Static bearer token value.
1504 The static bearer token to send to the MCP server, such as an API key or personal access token.
15031505
15041506 minLength: 1, maxLength: 8192
15051507
from line 1535
15331535
15341536 - `allowed_hosts: array of string`
15351537
1536 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
1538 The destination hosts of the outbound requests that the credential's secret is substituted into.
15371539
1540 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
1541
15381542 - `secret_name: string`
15391543
15401544 Name of the environment variable. Immutable after create.
from line 1547
15431547
15441548 - `secret_value: string`
15451549
1546 Secret value. Write-only; never returned in responses.
1550 The secret to substitute into the agent's outbound requests. It's write-only and never returned in responses.
15471551
15481552 minLength: 1, maxLength: 4096
15491553
from line 1583
15791583
15801584 - `id: string`
15811585
1582 Unique identifier for the credential.
1586 The unique ID of the credential (`vcrd_...`).
15831587
15841588 - `archived_at: string or null`
15851589
from line 1607
16031607
16041608 - `expires_at: optional string or null`
16051609
1606 A timestamp in RFC 3339 format
1610 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
16071611
16081612 format: date-time
16091613
from line 1617
16131617
16141618 - `client_id: string`
16151619
1616 OAuth client ID.
1620 The OAuth client ID used when refreshing the access token.
16171621
16181622 - `token_endpoint: string`
16191623
from line 1697
16931697
16941698 - `allowed_hosts: array of string`
16951699
1696 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
1700 The destination hosts of the outbound requests that the credential's secret is substituted into.
16971701
1702 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
1703
16981704 - `secret_name: string`
16991705
17001706 Name of the environment variable.
from line 1787
17811787
17821788- `include_archived: optional boolean`
17831789
1784 Whether to include archived credentials in the results.
1790 Whether to include archived credentials in the results. Defaults to `false`.
17851791
17861792- `limit: optional number`
17871793
from line 1797
17911797
17921798- `page: optional string`
17931799
1794 Opaque pagination token from a previous `list_credentials` response.
1800 The `next_page` value from a previous [List Credentials](https://platform.claude.com/docs/en/api/beta/vaults/credentials/list?sdk_languages=http) response, to get the next page. Leave it out to get the first page.
17951801
17961802#### Headers
17971803
from line 1925
19191925
19201926- `data: optional array of BetaManagedAgentsCredential`
19211927
1922 List of credentials.
1928 The credentials on this page, newest first.
19231929
19241930 - `type: "vault_credential"`
19251931
19261932 - `id: string`
19271933
1928 Unique identifier for the credential.
1934 The unique ID of the credential (`vcrd_...`).
19291935
19301936 - `archived_at: string or null`
19311937
from line 1955
19491955
19501956 - `expires_at: optional string or null`
19511957
1952 A timestamp in RFC 3339 format
1958 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
19531959
19541960 format: date-time
19551961
from line 1965
19591965
19601966 - `client_id: string`
19611967
1962 OAuth client ID.
1968 The OAuth client ID used when refreshing the access token.
19631969
19641970 - `token_endpoint: string`
19651971
from line 2045
20392045
20402046 - `allowed_hosts: array of string`
20412047
2042 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2048 The destination hosts of the outbound requests that the credential's secret is substituted into.
20432049
2050 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2051
20442052 - `secret_name: string`
20452053
20462054 Name of the environment variable.
from line 2116
21082116}
21092117```
21102118
2111### Get Credential
2119### Retrieve a Credential
21122120
21132121**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`
21142122
2115Get Credential
2123Retrieve a Credential
21162124
21172125#### Path parameters
21182126
from line 2264
22562264
22572265 - `id: string`
22582266
2259 Unique identifier for the credential.
2267 The unique ID of the credential (`vcrd_...`).
22602268
22612269 - `archived_at: string or null`
22622270
from line 2288
22802288
22812289 - `expires_at: optional string or null`
22822290
2283 A timestamp in RFC 3339 format
2291 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
22842292
22852293 format: date-time
22862294
from line 2298
22902298
22912299 - `client_id: string`
22922300
2293 OAuth client ID.
2301 The OAuth client ID used when refreshing the access token.
22942302
22952303 - `token_endpoint: string`
22962304
from line 2378
23702378
23712379 - `allowed_hosts: array of string`
23722380
2373 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2381 The destination hosts of the outbound requests that the credential's secret is substituted into.
23742382
2383 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2384
23752385 - `secret_name: string`
23762386
23772387 Name of the environment variable.
from line 2440
24302440}
24312441```
24322442
2433### Update Credential
2443### Update a Credential
24342444
24352445**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`
24362446
2437Update Credential
2447Update a Credential
24382448
24392449#### Path parameters
24402450
from line 2582
25722582
25732583- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`
25742584
2575 Updated authentication configuration. The `type` is immutable; the variant sent must match the stored credential's type.
2585 New authentication settings for the credential. The `type` must match the credential's current type, which can't be changed.
25762586
25772587 - `BetaManagedAgentsMCPOAuthUpdateParams object`
25782588
from line 2592
25822592
25832593 - `access_token: optional string or null`
25842594
2585 Updated OAuth access token.
2595 The new OAuth access token to replace the stored one.
25862596
25872597 minLength: 1, maxLength: 8192
25882598
25892599 - `expires_at: optional string or null`
25902600
2591 A timestamp in RFC 3339 format
2601 When the credential's access token expires, in RFC 3339. Leave it out to keep the stored expiry.
25922602
2603 If you send a new `access_token`, send its `expires_at` too, or the new token keeps the old expiry.
2604
2605 Must be in the future.
2606
25932607 format: date-time
25942608
25952609 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`
from line 2612
25982612
25992613 - `refresh_token: optional string or null`
26002614
2601 Updated OAuth refresh token.
2615 The new OAuth refresh token to replace the stored one.
26022616
26032617 minLength: 1, maxLength: 8192
26042618
26052619 - `scope: optional string or null`
26062620
2607 Updated OAuth scope for the refresh request.
2621 The new OAuth scope for refresh requests. Send an empty string to clear the stored scope.
26082622
26092623 maxLength: 8192
26102624
from line 2632
26182632
26192633 - `client_secret: optional string or null`
26202634
2621 Updated OAuth client secret.
2635 A new OAuth client secret to replace the stored one.
26222636
2637 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
2638
26232639 minLength: 1, maxLength: 512
26242640
26252641 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`
from line 2646
26302646
26312647 - `client_secret: optional string or null`
26322648
2633 Updated OAuth client secret.
2649 A new OAuth client secret to replace the stored one.
26342650
2651 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
2652
26352653 minLength: 1, maxLength: 512
26362654
26372655 - `BetaManagedAgentsStaticBearerUpdateParams object`
from line 2660
26422660
26432661 - `token: optional string or null`
26442662
2645 Updated static bearer token value.
2663 The new static bearer token to replace the stored one.
26462664
26472665 minLength: 1, maxLength: 8192
26482666
from line 2684
26662684
26672685 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`
26682686
2669 Updated networking scope. Full replacement.
2687 The new networking scope, which replaces the stored one as a whole.
26702688
26712689 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`
26722690
from line 2700
26822700
26832701 - `allowed_hosts: array of string`
26842702
2685 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
2703 The destination hosts of the outbound requests that the credential's secret is substituted into.
26862704
2705 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
2706
26872707 - `secret_value: optional string or null`
26882708
2689 Updated secret value.
2709 The new secret value to replace the stored one.
26902710
26912711 minLength: 1, maxLength: 4096
26922712
from line 2730
27102730
27112731 - `id: string`
27122732
2713 Unique identifier for the credential.
2733 The unique ID of the credential (`vcrd_...`).
27142734
27152735 - `archived_at: string or null`
27162736
from line 2754
27342754
27352755 - `expires_at: optional string or null`
27362756
2737 A timestamp in RFC 3339 format
2757 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
27382758
27392759 format: date-time
27402760
from line 2764
27442764
27452765 - `client_id: string`
27462766
2747 OAuth client ID.
2767 The OAuth client ID used when refreshing the access token.
27482768
27492769 - `token_endpoint: string`
27502770
from line 2844
28242844
28252845 - `allowed_hosts: array of string`
28262846
2827 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2847 The destination hosts of the outbound requests that the credential's secret is substituted into.
28282848
2849 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2850
28292851 - `secret_name: string`
28302852
28312853 Name of the environment variable.
from line 2913
28912913}
28922914```
28932915
2894### Delete Credential
2916### Delete a Credential
28952917
28962918**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`
28972919
2898Delete Credential
2920Delete a Credential
28992921
29002922#### Path parameters
29012923
from line 3061
30393061
30403062 - `id: string`
30413063
3042 Unique identifier of the deleted credential.
3064 The unique ID of the deleted credential (`vcrd_...`).
30433065
30443066#### Example
30453067
from line 3082
30603082}
30613083```
30623084
3063### Archive Credential
3085### Archive a Credential
30643086
30653087**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`
30663088
3067Archive Credential
3089Archive a Credential
30683090
30693091#### Path parameters
30703092
from line 3230
32083230
32093231 - `id: string`
32103232
3211 Unique identifier for the credential.
3233 The unique ID of the credential (`vcrd_...`).
32123234
32133235 - `archived_at: string or null`
32143236
from line 3254
32323254
32333255 - `expires_at: optional string or null`
32343256
3235 A timestamp in RFC 3339 format
3257 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
32363258
32373259 format: date-time
32383260
from line 3264
32423264
32433265 - `client_id: string`
32443266
3245 OAuth client ID.
3267 The OAuth client ID used when refreshing the access token.
32463268
32473269 - `token_endpoint: string`
32483270
from line 3344
33223344
33233345 - `allowed_hosts: array of string`
33243346
3325 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
3347 The destination hosts of the outbound requests that the credential's secret is substituted into.
33263348
3349 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
3350
33273351 - `secret_name: string`
33283352
33293353 Name of the environment variable.
from line 3407
33833407}
33843408```
33853409
3386### Validate Credential
3410### Validate an MCP OAuth Credential
33873411
33883412**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`
33893413
3390Validate Credential
3414Validate an MCP OAuth Credential
33913415
33923416#### Path parameters
33933417
from line 3563
35393563
35403564 - `mcp_probe: BetaManagedAgentsMCPProbe or null`
35413565
3542 Details of the failing MCP probe step. Null when the probe succeeded.
3566 Details of the MCP probe step that failed, or `null` if the probe succeeded or there was no access token to test.
35433567
35443568 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
35453569
3546 The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).
3570 The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure.
35473571
35483572 - `body: string`
35493573
from line 3629
36053629
36063630 - `"invalid"`
36073631
3608 The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.
3632 The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again.
36093633
36103634 - `"unknown"`
36113635
3612 The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.
3636 The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out.
36133637
36143638 - `validated_at: string`
36153639
No line in this hunk matches that.