Credentials changedapi/beta/vaults/credentials
Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+171added
Lines−111removed
From line
5
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits20to this page, all time
## Create a Credential ## Retrieve a Credential ## Update a Credential ## Delete a Credential ## Archive a Credential ## Validate an MCP OAuth Credential ## Create Credential ## Get Credential ## Update Credential ## Delete Credential ## Archive Credential ## Validate Credential
The whole hunk
from line 5, old and new numbered
/
from line 5
55
66# Credentials
77
8## Create Credential
8## Create a Credential
99
1010**POST** `/v1/vaults/{vault_id}/credentials`
1111
12Create Credential
12Create a Credential
1313
1414### Path parameters
1515
from line 153
153153
154154 - `access_token: string`
155155
156 OAuth access token.
156 The OAuth access token to send to the MCP server.
157157
158158 minLength: 1, maxLength: 8192
159159
from line 165
165165
166166 - `expires_at: optional string or null`
167167
168 A timestamp in RFC 3339 format
168 When `access_token` expires, in RFC 3339.
169169
170 Must be in the future.
171
170172 format: date-time
171173
172174 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`
from line 177
175177
176178 - `client_id: string`
177179
178 OAuth client ID.
180 The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created.
179181
180182 minLength: 1, maxLength: 1024
181183
182184 - `refresh_token: string`
183185
184 OAuth refresh token.
186 The OAuth refresh token that the API uses to get a new access token when the current one expires.
185187
186188 minLength: 1, maxLength: 8192
187189
from line 209
207209
208210 - `client_secret: string`
209211
210 OAuth client secret.
212 The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication.
211213
212214 minLength: 1, maxLength: 512
213215
from line 221
219221
220222 - `client_secret: string`
221223
222 OAuth client secret.
224 The OAuth client secret, sent to `token_endpoint` in the POST body.
223225
224226 minLength: 1, maxLength: 512
225227
from line 245
243245
244246 - `token: string`
245247
246 Static bearer token value.
248 The static bearer token to send to the MCP server, such as an API key or personal access token.
247249
248250 minLength: 1, maxLength: 8192
249251
from line 279
277279
278280 - `allowed_hosts: array of string`
279281
280 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
282 The destination hosts of the outbound requests that the credential's secret is substituted into.
281283
284 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
285
282286 - `secret_name: string`
283287
284288 Name of the environment variable. Immutable after create.
from line 291
287291
288292 - `secret_value: string`
289293
290 Secret value. Write-only; never returned in responses.
294 The secret to substitute into the agent's outbound requests. It's write-only and never returned in responses.
291295
292296 minLength: 1, maxLength: 4096
293297
from line 327
323327
324328 - `id: string`
325329
326 Unique identifier for the credential.
330 The unique ID of the credential (`vcrd_...`).
327331
328332 - `archived_at: string or null`
329333
from line 351
347351
348352 - `expires_at: optional string or null`
349353
350 A timestamp in RFC 3339 format
354 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
351355
352356 format: date-time
353357
from line 361
357361
358362 - `client_id: string`
359363
360 OAuth client ID.
364 The OAuth client ID used when refreshing the access token.
361365
362366 - `token_endpoint: string`
363367
from line 441
437441
438442 - `allowed_hosts: array of string`
439443
440 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
444 The destination hosts of the outbound requests that the credential's secret is substituted into.
441445
446 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
447
442448 - `secret_name: string`
443449
444450 Name of the environment variable.
from line 531
525531
526532- `include_archived: optional boolean`
527533
528 Whether to include archived credentials in the results.
534 Whether to include archived credentials in the results. Defaults to `false`.
529535
530536- `limit: optional number`
531537
from line 541
535541
536542- `page: optional string`
537543
538 Opaque pagination token from a previous `list_credentials` response.
544 The `next_page` value from a previous [List Credentials](https://platform.claude.com/docs/en/api/beta/vaults/credentials/list?sdk_languages=http) response, to get the next page. Leave it out to get the first page.
539545
540546### Headers
541547
from line 669
663669
664670- `data: optional array of BetaManagedAgentsCredential`
665671
666 List of credentials.
672 The credentials on this page, newest first.
667673
668674 - `type: "vault_credential"`
669675
670676 - `id: string`
671677
672 Unique identifier for the credential.
678 The unique ID of the credential (`vcrd_...`).
673679
674680 - `archived_at: string or null`
675681
from line 699
693699
694700 - `expires_at: optional string or null`
695701
696 A timestamp in RFC 3339 format
702 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
697703
698704 format: date-time
699705
from line 709
703709
704710 - `client_id: string`
705711
706 OAuth client ID.
712 The OAuth client ID used when refreshing the access token.
707713
708714 - `token_endpoint: string`
709715
from line 789
783789
784790 - `allowed_hosts: array of string`
785791
786 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
792 The destination hosts of the outbound requests that the credential's secret is substituted into.
787793
794 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
795
788796 - `secret_name: string`
789797
790798 Name of the environment variable.
from line 860
852860}
853861```
854862
855## Get Credential
863## Retrieve a Credential
856864
857865**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`
858866
859Get Credential
867Retrieve a Credential
860868
861869### Path parameters
862870
from line 1008
10001008
10011009 - `id: string`
10021010
1003 Unique identifier for the credential.
1011 The unique ID of the credential (`vcrd_...`).
10041012
10051013 - `archived_at: string or null`
10061014
from line 1032
10241032
10251033 - `expires_at: optional string or null`
10261034
1027 A timestamp in RFC 3339 format
1035 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
10281036
10291037 format: date-time
10301038
from line 1042
10341042
10351043 - `client_id: string`
10361044
1037 OAuth client ID.
1045 The OAuth client ID used when refreshing the access token.
10381046
10391047 - `token_endpoint: string`
10401048
from line 1122
11141122
11151123 - `allowed_hosts: array of string`
11161124
1117 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
1125 The destination hosts of the outbound requests that the credential's secret is substituted into.
11181126
1127 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
1128
11191129 - `secret_name: string`
11201130
11211131 Name of the environment variable.
from line 1184
11741184}
11751185```
11761186
1177## Update Credential
1187## Update a Credential
11781188
11791189**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`
11801190
1181Update Credential
1191Update a Credential
11821192
11831193### Path parameters
11841194
from line 1326
13161326
13171327- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`
13181328
1319 Updated authentication configuration. The `type` is immutable; the variant sent must match the stored credential's type.
1329 New authentication settings for the credential. The `type` must match the credential's current type, which can't be changed.
13201330
13211331 - `BetaManagedAgentsMCPOAuthUpdateParams object`
13221332
from line 1336
13261336
13271337 - `access_token: optional string or null`
13281338
1329 Updated OAuth access token.
1339 The new OAuth access token to replace the stored one.
13301340
13311341 minLength: 1, maxLength: 8192
13321342
13331343 - `expires_at: optional string or null`
13341344
1335 A timestamp in RFC 3339 format
1345 When the credential's access token expires, in RFC 3339. Leave it out to keep the stored expiry.
13361346
1347 If you send a new `access_token`, send its `expires_at` too, or the new token keeps the old expiry.
1348
1349 Must be in the future.
1350
13371351 format: date-time
13381352
13391353 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`
from line 1356
13421356
13431357 - `refresh_token: optional string or null`
13441358
1345 Updated OAuth refresh token.
1359 The new OAuth refresh token to replace the stored one.
13461360
13471361 minLength: 1, maxLength: 8192
13481362
13491363 - `scope: optional string or null`
13501364
1351 Updated OAuth scope for the refresh request.
1365 The new OAuth scope for refresh requests. Send an empty string to clear the stored scope.
13521366
13531367 maxLength: 8192
13541368
from line 1376
13621376
13631377 - `client_secret: optional string or null`
13641378
1365 Updated OAuth client secret.
1379 A new OAuth client secret to replace the stored one.
13661380
1381 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
1382
13671383 minLength: 1, maxLength: 512
13681384
13691385 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`
from line 1390
13741390
13751391 - `client_secret: optional string or null`
13761392
1377 Updated OAuth client secret.
1393 A new OAuth client secret to replace the stored one.
13781394
1395 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
1396
13791397 minLength: 1, maxLength: 512
13801398
13811399 - `BetaManagedAgentsStaticBearerUpdateParams object`
from line 1404
13861404
13871405 - `token: optional string or null`
13881406
1389 Updated static bearer token value.
1407 The new static bearer token to replace the stored one.
13901408
13911409 minLength: 1, maxLength: 8192
13921410
from line 1428
14101428
14111429 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`
14121430
1413 Updated networking scope. Full replacement.
1431 The new networking scope, which replaces the stored one as a whole.
14141432
14151433 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`
14161434
from line 1444
14261444
14271445 - `allowed_hosts: array of string`
14281446
1429 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
1447 The destination hosts of the outbound requests that the credential's secret is substituted into.
14301448
1449 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
1450
14311451 - `secret_value: optional string or null`
14321452
1433 Updated secret value.
1453 The new secret value to replace the stored one.
14341454
14351455 minLength: 1, maxLength: 4096
14361456
from line 1474
14541474
14551475 - `id: string`
14561476
1457 Unique identifier for the credential.
1477 The unique ID of the credential (`vcrd_...`).
14581478
14591479 - `archived_at: string or null`
14601480
from line 1498
14781498
14791499 - `expires_at: optional string or null`
14801500
1481 A timestamp in RFC 3339 format
1501 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
14821502
14831503 format: date-time
14841504
from line 1508
14881508
14891509 - `client_id: string`
14901510
1491 OAuth client ID.
1511 The OAuth client ID used when refreshing the access token.
14921512
14931513 - `token_endpoint: string`
14941514
from line 1588
15681588
15691589 - `allowed_hosts: array of string`
15701590
1571 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
1591 The destination hosts of the outbound requests that the credential's secret is substituted into.
15721592
1593 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
1594
15731595 - `secret_name: string`
15741596
15751597 Name of the environment variable.
from line 1657
16351657}
16361658```
16371659
1638## Delete Credential
1660## Delete a Credential
16391661
16401662**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`
16411663
1642Delete Credential
1664Delete a Credential
16431665
16441666### Path parameters
16451667
from line 1805
17831805
17841806 - `id: string`
17851807
1786 Unique identifier of the deleted credential.
1808 The unique ID of the deleted credential (`vcrd_...`).
17871809
17881810### Example
17891811
from line 1826
18041826}
18051827```
18061828
1807## Archive Credential
1829## Archive a Credential
18081830
18091831**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`
18101832
1811Archive Credential
1833Archive a Credential
18121834
18131835### Path parameters
18141836
from line 1974
19521974
19531975 - `id: string`
19541976
1955 Unique identifier for the credential.
1977 The unique ID of the credential (`vcrd_...`).
19561978
19571979 - `archived_at: string or null`
19581980
from line 1998
19761998
19771999 - `expires_at: optional string or null`
19782000
1979 A timestamp in RFC 3339 format
2001 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
19802002
19812003 format: date-time
19822004
from line 2008
19862008
19872009 - `client_id: string`
19882010
1989 OAuth client ID.
2011 The OAuth client ID used when refreshing the access token.
19902012
19912013 - `token_endpoint: string`
19922014
from line 2088
20662088
20672089 - `allowed_hosts: array of string`
20682090
2069 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2091 The destination hosts of the outbound requests that the credential's secret is substituted into.
20702092
2093 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2094
20712095 - `secret_name: string`
20722096
20732097 Name of the environment variable.
from line 2151
21272151}
21282152```
21292153
2130## Validate Credential
2154## Validate an MCP OAuth Credential
21312155
21322156**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`
21332157
2134Validate Credential
2158Validate an MCP OAuth Credential
21352159
21362160### Path parameters
21372161
from line 2307
22832307
22842308 - `mcp_probe: BetaManagedAgentsMCPProbe or null`
22852309
2286 Details of the failing MCP probe step. Null when the probe succeeded.
2310 Details of the MCP probe step that failed, or `null` if the probe succeeded or there was no access token to test.
22872311
22882312 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
22892313
2290 The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).
2314 The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure.
22912315
22922316 - `body: string`
22932317
from line 2373
23492373
23502374 - `"invalid"`
23512375
2352 The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.
2376 The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again.
23532377
23542378 - `"unknown"`
23552379
2356 The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.
2380 The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out.
23572381
23582382 - `validated_at: string`
23592383
from line 2442
24182442
24192443 - `id: string`
24202444
2421 Unique identifier for the credential.
2445 The unique ID of the credential (`vcrd_...`).
24222446
24232447 - `archived_at: string or null`
24242448
from line 2466
24422466
24432467 - `expires_at: optional string or null`
24442468
2445 A timestamp in RFC 3339 format
2469 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
24462470
24472471 format: date-time
24482472
from line 2476
24522476
24532477 - `client_id: string`
24542478
2455 OAuth client ID.
2479 The OAuth client ID used when refreshing the access token.
24562480
24572481 - `token_endpoint: string`
24582482
from line 2556
25322556
25332557 - `allowed_hosts: array of string`
25342558
2535 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2559 The destination hosts of the outbound requests that the credential's secret is substituted into.
25362560
2561 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2562
25372563 - `secret_name: string`
25382564
25392565 Name of the environment variable.
from line 2606
25802606
25812607 - `allowed_hosts: array of string`
25822608
2583 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
2609 The destination hosts of the outbound requests that the credential's secret is substituted into.
25842610
2611 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
2612
25852613### Beta Managed Agents Credential Validation
25862614
25872615- `BetaManagedAgentsCredentialValidation object`
from line 2628
26002628
26012629 - `mcp_probe: BetaManagedAgentsMCPProbe or null`
26022630
2603 Details of the failing MCP probe step. Null when the probe succeeded.
2631 Details of the MCP probe step that failed, or `null` if the probe succeeded or there was no access token to test.
26042632
26052633 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
26062634
2607 The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).
2635 The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure.
26082636
26092637 - `body: string`
26102638
from line 2694
26662694
26672695 - `"invalid"`
26682696
2669 The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.
2697 The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again.
26702698
26712699 - `"unknown"`
26722700
2673 The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.
2701 The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out.
26742702
26752703 - `validated_at: string`
26762704
from line 2722
26942722
26952723 - `"invalid"`
26962724
2697 The probe reached the MCP server and was rejected, and a refresh (if attempted) did not recover it.
2725 The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again.
26982726
26992727 - `"unknown"`
27002728
2701 The probe could not determine validity — for example, a transport error or a successful refresh that was not re-probed.
2729 The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out.
27022730
27032731### Beta Managed Agents Deleted Credential
27042732
from line 2738
27102738
27112739 - `id: string`
27122740
2713 Unique identifier of the deleted credential.
2741 The unique ID of the deleted credential (`vcrd_...`).
27142742
27152743### Beta Managed Agents Environment Variable Auth Response
27162744
from line 2778
27502778
27512779 - `allowed_hosts: array of string`
27522780
2753 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2781 The destination hosts of the outbound requests that the credential's secret is substituted into.
27542782
2783 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2784
27552785 - `secret_name: string`
27562786
27572787 Name of the environment variable.
from line 2812
27822812
27832813 - `allowed_hosts: array of string`
27842814
2785 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
2815 The destination hosts of the outbound requests that the credential's secret is substituted into.
27862816
2817 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
2818
27872819 - `secret_name: string`
27882820
27892821 Name of the environment variable. Immutable after create.
from line 2824
27922824
27932825 - `secret_value: string`
27942826
2795 Secret value. Write-only; never returned in responses.
2827 The secret to substitute into the agent's outbound requests. It's write-only and never returned in responses.
27962828
27972829 minLength: 1, maxLength: 4096
27982830
from line 2862
28302862
28312863 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`
28322864
2833 Updated networking scope. Full replacement.
2865 The new networking scope, which replaces the stored one as a whole.
28342866
28352867 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`
28362868
from line 2878
28462878
28472879 - `allowed_hosts: array of string`
28482880
2849 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
2881 The destination hosts of the outbound requests that the credential's secret is substituted into.
28502882
2883 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
2884
28512885 - `secret_value: optional string or null`
28522886
2853 Updated secret value.
2887 The new secret value to replace the stored one.
28542888
28552889 minLength: 1, maxLength: 4096
28562890
from line 2920
28862920
28872921- `BetaManagedAgentsInjectionLocationUpdateParams object`
28882922
2889 Updated injection location.
2923 Changes which parts of an outbound request the secret is substituted into. A location you leave out keeps its current setting.
28902924
2925 After the change, at least one location must be enabled.
2926
2927 See [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults?sdk_languages=http#add-a-credential) to learn more about injection locations.
2928
28912929 - `body: optional boolean`
28922930
28932931 Substitute when the placeholder appears in the request body.
from line 2944
29062944
29072945 - `allowed_hosts: array of string`
29082946
2909 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
2947 The destination hosts of the outbound requests that the credential's secret is substituted into.
29102948
2949 Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries.
2950
29112951### Beta Managed Agents Limited Credential Networking Response
29122952
29132953- `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
from line 2958
29182958
29192959 - `allowed_hosts: array of string`
29202960
2921 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
2961 The destination hosts of the outbound requests that the credential's secret is substituted into.
29222962
2963 An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself.
2964
29232965### Beta Managed Agents MCP OAuth Auth Response
29242966
29252967- `BetaManagedAgentsMCPOAuthAuthResponse object`
from line 2976
29342976
29352977 - `expires_at: optional string or null`
29362978
2937 A timestamp in RFC 3339 format
2979 When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known.
29382980
29392981 format: date-time
29402982
from line 2986
29442986
29452987 - `client_id: string`
29462988
2947 OAuth client ID.
2989 The OAuth client ID used when refreshing the access token.
29482990
29492991 - `token_endpoint: string`
29502992
from line 3030
29883030
29893031 - `access_token: string`
29903032
2991 OAuth access token.
3033 The OAuth access token to send to the MCP server.
29923034
29933035 minLength: 1, maxLength: 8192
29943036
from line 3042
30003042
30013043 - `expires_at: optional string or null`
30023044
3003 A timestamp in RFC 3339 format
3045 When `access_token` expires, in RFC 3339.
30043046
3047 Must be in the future.
3048
30053049 format: date-time
30063050
30073051 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`
from line 3054
30103054
30113055 - `client_id: string`
30123056
3013 OAuth client ID.
3057 The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created.
30143058
30153059 minLength: 1, maxLength: 1024
30163060
30173061 - `refresh_token: string`
30183062
3019 OAuth refresh token.
3063 The OAuth refresh token that the API uses to get a new access token when the current one expires.
30203064
30213065 minLength: 1, maxLength: 8192
30223066
from line 3086
30423086
30433087 - `client_secret: string`
30443088
3045 OAuth client secret.
3089 The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication.
30463090
30473091 minLength: 1, maxLength: 512
30483092
from line 3098
30543098
30553099 - `client_secret: string`
30563100
3057 OAuth client secret.
3101 The OAuth client secret, sent to `token_endpoint` in the POST body.
30583102
30593103 minLength: 1, maxLength: 512
30603104
from line 3122
30783122
30793123 - `client_id: string`
30803124
3081 OAuth client ID.
3125 The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created.
30823126
30833127 minLength: 1, maxLength: 1024
30843128
30853129 - `refresh_token: string`
30863130
3087 OAuth refresh token.
3131 The OAuth refresh token that the API uses to get a new access token when the current one expires.
30883132
30893133 minLength: 1, maxLength: 8192
30903134
from line 3154
31103154
31113155 - `client_secret: string`
31123156
3113 OAuth client secret.
3157 The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication.
31143158
31153159 minLength: 1, maxLength: 512
31163160
from line 3166
31223166
31233167 - `client_secret: string`
31243168
3125 OAuth client secret.
3169 The OAuth client secret, sent to `token_endpoint` in the POST body.
31263170
31273171 minLength: 1, maxLength: 512
31283172
from line 3190
31463190
31473191 - `client_id: string`
31483192
3149 OAuth client ID.
3193 The OAuth client ID used when refreshing the access token.
31503194
31513195 - `token_endpoint: string`
31523196
from line 3232
31883232
31893233 - `refresh_token: optional string or null`
31903234
3191 Updated OAuth refresh token.
3235 The new OAuth refresh token to replace the stored one.
31923236
31933237 minLength: 1, maxLength: 8192
31943238
31953239 - `scope: optional string or null`
31963240
3197 Updated OAuth scope for the refresh request.
3241 The new OAuth scope for refresh requests. Send an empty string to clear the stored scope.
31983242
31993243 maxLength: 8192
32003244
from line 3252
32083252
32093253 - `client_secret: optional string or null`
32103254
3211 Updated OAuth client secret.
3255 A new OAuth client secret to replace the stored one.
32123256
3257 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
3258
32133259 minLength: 1, maxLength: 512
32143260
32153261 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`
from line 3266
32203266
32213267 - `client_secret: optional string or null`
32223268
3223 Updated OAuth client secret.
3269 A new OAuth client secret to replace the stored one.
32243270
3271 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
3272
32253273 minLength: 1, maxLength: 512
32263274
32273275### Beta Managed Agents MCP OAuth Update Params
from line 3282
32343282
32353283 - `access_token: optional string or null`
32363284
3237 Updated OAuth access token.
3285 The new OAuth access token to replace the stored one.
32383286
32393287 minLength: 1, maxLength: 8192
32403288
32413289 - `expires_at: optional string or null`
32423290
3243 A timestamp in RFC 3339 format
3291 When the credential's access token expires, in RFC 3339. Leave it out to keep the stored expiry.
32443292
3293 If you send a new `access_token`, send its `expires_at` too, or the new token keeps the old expiry.
3294
3295 Must be in the future.
3296
32453297 format: date-time
32463298
32473299 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`
from line 3302
32503302
32513303 - `refresh_token: optional string or null`
32523304
3253 Updated OAuth refresh token.
3305 The new OAuth refresh token to replace the stored one.
32543306
32553307 minLength: 1, maxLength: 8192
32563308
32573309 - `scope: optional string or null`
32583310
3259 Updated OAuth scope for the refresh request.
3311 The new OAuth scope for refresh requests. Send an empty string to clear the stored scope.
32603312
32613313 maxLength: 8192
32623314
from line 3322
32703322
32713323 - `client_secret: optional string or null`
32723324
3273 Updated OAuth client secret.
3325 A new OAuth client secret to replace the stored one.
32743326
3327 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
3328
32753329 minLength: 1, maxLength: 512
32763330
32773331 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`
from line 3336
32823336
32833337 - `client_secret: optional string or null`
32843338
3285 Updated OAuth client secret.
3339 A new OAuth client secret to replace the stored one.
32863340
3341 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
3342
32873343 minLength: 1, maxLength: 512
32883344
32893345### Beta Managed Agents MCP Probe
from line 3350
32943350
32953351 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
32963352
3297 The captured HTTP error response. Null when no HTTP response was received (timeout, DNS, TLS).
3353 The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure.
32983354
32993355 - `body: string`
33003356
from line 3468
34123468
34133469 - `token: string`
34143470
3415 Static bearer token value.
3471 The static bearer token to send to the MCP server, such as an API key or personal access token.
34163472
34173473 minLength: 1, maxLength: 8192
34183474
from line 3488
34323488
34333489 - `token: optional string or null`
34343490
3435 Updated static bearer token value.
3491 The new static bearer token to replace the stored one.
34363492
34373493 minLength: 1, maxLength: 8192
34383494
from line 3502
34463502
34473503 - `client_secret: string`
34483504
3449 OAuth client secret.
3505 The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication.
34503506
34513507 minLength: 1, maxLength: 512
34523508
from line 3524
34683524
34693525 - `client_secret: optional string or null`
34703526
3471 Updated OAuth client secret.
3527 A new OAuth client secret to replace the stored one.
34723528
3529 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
3530
34733531 minLength: 1, maxLength: 512
34743532
34753533### Beta Managed Agents Token Endpoint Auth None Param
from line 3556
34983556
34993557 - `client_secret: string`
35003558
3501 OAuth client secret.
3559 The OAuth client secret, sent to `token_endpoint` in the POST body.
35023560
35033561 minLength: 1, maxLength: 512
35043562
from line 3578
35203578
35213579 - `client_secret: optional string or null`
35223580
3523 Updated OAuth client secret.
3581 A new OAuth client secret to replace the stored one.
3582
3583 The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one.
35243584
35253585 minLength: 1, maxLength: 512
35263586
No line in this hunk matches that.