Vaults changedapi/beta/vaults
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+317added
Lines−1,466removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits21to this page, all time
### Headers ### Body parameters #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## Vaults › Credentials ### Create Credential #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### List Credentials #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Get Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Update Credential #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Delete Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Archive Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Validate Credential #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Header Parameters ### Body Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Credentials ## Create Credential ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## List Credentials ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Get Credential ### Path Parameters ### Header Parameters #### Response ## Update Credential ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Delete Credential ### Path Parameters ### Header Parameters #### Response ## Archive Credential ### Path Parameters ### Header Parameters #### Response ## Validate Credential ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Beta Managed Agents Credential ### Beta Managed Agents Credential Networking Params ### Beta Managed Agents Credential Validation ### Beta Managed Agents Credential Validation Status ### Beta Managed Agents Deleted Credential ### Beta Managed Agents Environment Variable Auth Response ### Beta Managed Agents Environment Variable Create Params ### Beta Managed Agents Environment Variable Update Params ### Beta Managed Agents Injection Location Params ### Beta Managed Agents Injection Location Response ### Beta Managed Agents Injection Location Update Params ### Beta Managed Agents Limited Credential Networking Params ### Beta Managed Agents Limited Credential Networking Response ### Beta Managed Agents MCP OAuth Auth Response ### Beta Managed Agents MCP OAuth Create Params ### Beta Managed Agents MCP OAuth Refresh Params ### Beta Managed Agents MCP OAuth Refresh Response ### Beta Managed Agents MCP OAuth Refresh Update Params ### Beta Managed Agents MCP OAuth Update Params ### Beta Managed Agents MCP Probe ### Beta Managed Agents Refresh HTTP Response ### Beta Managed Agents Refresh Object ### Beta Managed Agents Static Bearer Auth Response ### Beta Managed Agents Static Bearer Create Params ### Beta Managed Agents Static Bearer Update Params ### Beta Managed Agents Token Endpoint Auth Basic Param ### Beta Managed Agents Token Endpoint Auth Basic Response ### Beta Managed Agents Token Endpoint Auth Basic Update Param ### Beta Managed Agents Token Endpoint Auth None Param ### Beta Managed Agents Token Endpoint Auth None Response ### Beta Managed Agents Token Endpoint Auth Post Param ### Beta Managed Agents Token Endpoint Auth Post Response ### Beta Managed Agents Token Endpoint Auth Post Update Param ### Beta Managed Agents Unrestricted Credential Networking Params ### Beta Managed Agents Unrestricted Credential Networking Response
The whole hunk
from line 1, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 1
1---
2title: Vaults
3url: https://platform.claude.com/docs/en/api/beta/vaults
4---
5
61# Vaults
72
83## Create Vault
94
10**post** `/v1/vaults`
5**POST** `/v1/vaults`
116
127Create Vault
138
14### Header Parameters
9### Headers
1510
1611- `"anthropic-beta": optional array of AnthropicBeta`
1712
from line 84
8984
9085 - `"mid-conversation-tool-changes-2026-07-01"`
9186
92### Body Parameters
87### Body parameters
9388
9489- `display_name: string`
9590
9691 Human-readable name for the vault. 1-255 characters.
9792
93 minLength: 1, maxLength: 255
94
9895- `metadata: optional map[string]`
9996
10097 Arbitrary key-value metadata to attach to the vault. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.
10198
10299### Returns
103100
104- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`
101- `BetaManagedAgentsVault object`
105102
106103 A vault that stores credentials for use by agents during sessions.
107104
from line 110
113110
114111 A timestamp in RFC 3339 format
115112
113 format: date-time
114
116115 - `created_at: string`
117116
118117 A timestamp in RFC 3339 format
119118
119 format: date-time
120
120121 - `display_name: string`
121122
122123 Human-readable name for the vault.
from line 128
127128
128129 - `type: "vault"`
129130
130 - `"vault"`
131
132131 - `updated_at: string`
133132
134133 A timestamp in RFC 3339 format
135134
135 format: date-time
136
136137### Example
137138
138```http
139```bash
139140curl https://api.anthropic.com/v1/vaults \
140141 -H 'Content-Type: application/json' \
141142 -H 'anthropic-version: 2023-06-01' \
from line 150
149150 }'
150151```
151152
152#### Response
153#### Response (200)
153154
154155```json
155156{
from line 168
167168
168169## List Vaults
169170
170**get** `/v1/vaults`
171**GET** `/v1/vaults`
171172
172173List Vaults
173174
174### Query Parameters
175### Query parameters
175176
176177- `include_archived: optional boolean`
177178
from line 182
181182
182183 Maximum number of vaults to return per page. Defaults to 20, maximum 100.
183184
185 format: int32
186
184187- `page: optional string`
185188
186189 Opaque pagination token from a previous `list_vaults` response.
187190
188### Header Parameters
191### Headers
189192
190193- `"anthropic-beta": optional array of AnthropicBeta`
191194
from line 280
277280
278281 A timestamp in RFC 3339 format
279282
283 format: date-time
284
280285 - `created_at: string`
281286
282287 A timestamp in RFC 3339 format
283288
289 format: date-time
290
284291 - `display_name: string`
285292
286293 Human-readable name for the vault.
from line 298
291298
292299 - `type: "vault"`
293300
294 - `"vault"`
295
296301 - `updated_at: string`
297302
298303 A timestamp in RFC 3339 format
299304
305 format: date-time
306
300307- `next_page: optional string or null`
301308
302309 Pagination token for the next page, or null if no more results.
303310
304311### Example
305312
306```http
313```bash
307314curl https://api.anthropic.com/v1/vaults \
308315 -H 'anthropic-version: 2023-06-01' \
309316 -H 'anthropic-beta: managed-agents-2026-04-01' \
310317 -H "X-Api-Key: $ANTHROPIC_API_KEY"
311318```
312319
313#### Response
320#### Response (200)
314321
315322```json
316323{
from line 340
333340
334341## Get Vault
335342
336**get** `/v1/vaults/{vault_id}`
343**GET** `/v1/vaults/{vault_id}`
337344
338345Get Vault
339346
340### Path Parameters
347### Path parameters
341348
342349- `vault_id: string`
343350
344### Header Parameters
351### Headers
345352
346353- `"anthropic-beta": optional array of AnthropicBeta`
347354
from line 428
421428
422429### Returns
423430
424- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`
431- `BetaManagedAgentsVault object`
425432
426433 A vault that stores credentials for use by agents during sessions.
427434
from line 440
433440
434441 A timestamp in RFC 3339 format
435442
443 format: date-time
444
436445 - `created_at: string`
437446
438447 A timestamp in RFC 3339 format
439448
449 format: date-time
450
440451 - `display_name: string`
441452
442453 Human-readable name for the vault.
from line 458
447458
448459 - `type: "vault"`
449460
450 - `"vault"`
451
452461 - `updated_at: string`
453462
454463 A timestamp in RFC 3339 format
455464
465 format: date-time
466
456467### Example
457468
458```http
469```bash
459470curl https://api.anthropic.com/v1/vaults/$VAULT_ID \
460471 -H 'anthropic-version: 2023-06-01' \
461472 -H 'anthropic-beta: managed-agents-2026-04-01' \
462473 -H "X-Api-Key: $ANTHROPIC_API_KEY"
463474```
464475
465#### Response
476#### Response (200)
466477
467478```json
468479{
from line 491
480491
481492## Update Vault
482493
483**post** `/v1/vaults/{vault_id}`
494**POST** `/v1/vaults/{vault_id}`
484495
485496Update Vault
486497
487### Path Parameters
498### Path parameters
488499
489500- `vault_id: string`
490501
491### Header Parameters
502### Headers
492503
493504- `"anthropic-beta": optional array of AnthropicBeta`
494505
from line 577
566577
567578 - `"mid-conversation-tool-changes-2026-07-01"`
568579
569### Body Parameters
580### Body parameters
570581
571582- `display_name: optional string or null`
572583
573584 Updated human-readable name for the vault. 1-255 characters.
574585
586 minLength: 1, maxLength: 255
587
575588- `metadata: optional map[string] or null`
576589
577590 Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.
578591
579592### Returns
580593
581- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`
594- `BetaManagedAgentsVault object`
582595
583596 A vault that stores credentials for use by agents during sessions.
584597
from line 603
590603
591604 A timestamp in RFC 3339 format
592605
606 format: date-time
607
593608 - `created_at: string`
594609
595610 A timestamp in RFC 3339 format
596611
612 format: date-time
613
597614 - `display_name: string`
598615
599616 Human-readable name for the vault.
from line 621
604621
605622 - `type: "vault"`
606623
607 - `"vault"`
608
609624 - `updated_at: string`
610625
611626 A timestamp in RFC 3339 format
612627
628 format: date-time
629
613630### Example
614631
615```http
632```bash
616633curl https://api.anthropic.com/v1/vaults/$VAULT_ID \
617634 -H 'Content-Type: application/json' \
618635 -H 'anthropic-version: 2023-06-01' \
from line 643
626643 }'
627644```
628645
629#### Response
646#### Response (200)
630647
631648```json
632649{
from line 661
644661
645662## Delete Vault
646663
647**delete** `/v1/vaults/{vault_id}`
664**DELETE** `/v1/vaults/{vault_id}`
648665
649666Delete Vault
650667
651### Path Parameters
668### Path parameters
652669
653670- `vault_id: string`
654671
655### Header Parameters
672### Headers
656673
657674- `"anthropic-beta": optional array of AnthropicBeta`
658675
from line 749
732749
733750### Returns
734751
735- `BetaManagedAgentsDeletedVault object { id, type }`
752- `BetaManagedAgentsDeletedVault object`
736753
737754 Confirmation of a deleted vault.
738755
from line 759
742759
743760 - `type: "vault_deleted"`
744761
745 - `"vault_deleted"`
746
747762### Example
748763
749```http
764```bash
750765curl https://api.anthropic.com/v1/vaults/$VAULT_ID \
751766 -X DELETE \
752767 -H 'anthropic-version: 2023-06-01' \
from line 769
754769 -H "X-Api-Key: $ANTHROPIC_API_KEY"
755770```
756771
757#### Response
772#### Response (200)
758773
759774```json
760775{
from line 780
765780
766781## Archive Vault
767782
768**post** `/v1/vaults/{vault_id}/archive`
783**POST** `/v1/vaults/{vault_id}/archive`
769784
770785Archive Vault
771786
772### Path Parameters
787### Path parameters
773788
774789- `vault_id: string`
775790
776### Header Parameters
791### Headers
777792
778793- `"anthropic-beta": optional array of AnthropicBeta`
779794
from line 868
853868
854869### Returns
855870
856- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`
871- `BetaManagedAgentsVault object`
857872
858873 A vault that stores credentials for use by agents during sessions.
859874
from line 880
865880
866881 A timestamp in RFC 3339 format
867882
883 format: date-time
884
868885 - `created_at: string`
869886
870887 A timestamp in RFC 3339 format
871888
889 format: date-time
890
872891 - `display_name: string`
873892
874893 Human-readable name for the vault.
from line 898
879898
880899 - `type: "vault"`
881900
882 - `"vault"`
883
884901 - `updated_at: string`
885902
886903 A timestamp in RFC 3339 format
887904
905 format: date-time
906
888907### Example
889908
890```http
909```bash
891910curl https://api.anthropic.com/v1/vaults/$VAULT_ID/archive \
892911 -X POST \
893912 -H 'anthropic-version: 2023-06-01' \
from line 914
895914 -H "X-Api-Key: $ANTHROPIC_API_KEY"
896915```
897916
898#### Response
917#### Response (200)
899918
900919```json
901920{
from line 930
911930}
912931```
913932
914## Domain Types
933## Domain types
915934
916935### Beta Managed Agents Deleted Vault
917936
918- `BetaManagedAgentsDeletedVault object { id, type }`
937- `BetaManagedAgentsDeletedVault object`
919938
920939 Confirmation of a deleted vault.
921940
from line 944
925944
926945 - `type: "vault_deleted"`
927946
928 - `"vault_deleted"`
929
930947### Beta Managed Agents Vault
931948
932- `BetaManagedAgentsVault object { id, archived_at, created_at, 4 more }`
949- `BetaManagedAgentsVault object`
933950
934951 A vault that stores credentials for use by agents during sessions.
935952
from line 958
941958
942959 A timestamp in RFC 3339 format
943960
961 format: date-time
962
944963 - `created_at: string`
945964
946965 A timestamp in RFC 3339 format
947966
967 format: date-time
968
948969 - `display_name: string`
949970
950971 Human-readable name for the vault.
from line 976
955976
956977 - `type: "vault"`
957978
958 - `"vault"`
959
960979 - `updated_at: string`
961980
962981 A timestamp in RFC 3339 format
963982
964# Credentials
965
966## Create Credential
967
968**post** `/v1/vaults/{vault_id}/credentials`
983 format: date-time
984
985## Vaults › Credentials
986
987### Create Credential
988
989**POST** `/v1/vaults/{vault_id}/credentials`
969990
970991Create Credential
971992
972### Path Parameters
993#### Path parameters
973994
974995- `vault_id: string`
975996
976### Header Parameters
997#### Headers
977998
978999- `"anthropic-beta": optional array of AnthropicBeta`
9791000
from line 1072
10511072
10521073 - `"mid-conversation-tool-changes-2026-07-01"`
10531074
1054### Body Parameters
1075#### Body parameters
10551076
10561077- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`
10571078
10581079 Authentication details for creating a credential.
10591080
1060 - `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`
1081 - `BetaManagedAgentsMCPOAuthCreateParams object`
10611082
10621083 Parameters for creating an MCP OAuth credential.
10631084
from line 1086
10651086
10661087 OAuth access token.
10671088
1089 minLength: 1, maxLength: 8192
1090
10681091 - `mcp_server_url: string`
10691092
10701093 URL of the MCP server this credential authenticates against.
10711094
1095 minLength: 1, maxLength: 2047
1096
10721097 - `type: "mcp_oauth"`
10731098
1074 - `"mcp_oauth"`
1075
10761099 - `expires_at: optional string or null`
10771100
10781101 A timestamp in RFC 3339 format
10791102
1103 format: date-time
1104
10801105 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`
10811106
10821107 OAuth refresh token parameters for creating a credential with refresh support.
from line 1110
10851110
10861111 OAuth client ID.
10871112
1113 minLength: 1, maxLength: 1024
1114
10881115 - `refresh_token: string`
10891116
10901117 OAuth refresh token.
10911118
1119 minLength: 1, maxLength: 4096
1120
10921121 - `token_endpoint: string`
10931122
10941123 Token endpoint URL used to refresh the access token.
10951124
1125 minLength: 1, maxLength: 2047
1126
10961127 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`
10971128
10981129 Token endpoint requires no client authentication.
10991130
1100 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`
1131 - `BetaManagedAgentsTokenEndpointAuthNoneParam object`
11011132
11021133 Token endpoint requires no client authentication.
11031134
11041135 - `type: "none"`
11051136
1106 - `"none"`
1107
1108 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`
1137 - `BetaManagedAgentsTokenEndpointAuthBasicParam object`
11091138
11101139 Token endpoint uses HTTP Basic authentication with client credentials.
11111140
from line 1142
11131142
11141143 OAuth client secret.
11151144
1145 minLength: 1, maxLength: 512
1146
11161147 - `type: "client_secret_basic"`
11171148
1118 - `"client_secret_basic"`
1119
1120 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`
1149 - `BetaManagedAgentsTokenEndpointAuthPostParam object`
11211150
11221151 Token endpoint uses POST body authentication with client credentials.
11231152
from line 1154
11251154
11261155 OAuth client secret.
11271156
1157 minLength: 1, maxLength: 512
1158
11281159 - `type: "client_secret_post"`
11291160
1130 - `"client_secret_post"`
1131
11321161 - `resource: optional string or null`
11331162
11341163 OAuth resource indicator.
11351164
1165 minLength: 1, maxLength: 2047
1166
11361167 - `scope: optional string or null`
11371168
11381169 OAuth scope for the refresh request.
11391170
1140 - `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`
1171 minLength: 1, maxLength: 8192
1172
1173 - `BetaManagedAgentsStaticBearerCreateParams object`
11411174
11421175 Parameters for creating a static bearer token credential.
11431176
from line 1178
11451178
11461179 Static bearer token value.
11471180
1181 minLength: 1, maxLength: 8192
1182
11481183 - `mcp_server_url: string`
11491184
11501185 URL of the MCP server this credential authenticates against.
11511186
1187 minLength: 1, maxLength: 2047
1188
11521189 - `type: "static_bearer"`
11531190
1154 - `"static_bearer"`
1155
1156 - `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`
1191 - `BetaManagedAgentsEnvironmentVariableCreateParams object`
11571192
11581193 Parameters for creating an environment variable credential.
11591194
from line 1196
11611196
11621197 Outbound hosts the secret value is substituted on.
11631198
1164 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`
1199 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`
11651200
11661201 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
11671202
11681203 - `type: "unrestricted"`
11691204
1170 - `"unrestricted"`
1171
1172 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`
1205 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`
11731206
11741207 Substitute the secret only on requests to the listed hosts.
11751208
from line 1212
11791212
11801213 - `type: "limited"`
11811214
1182 - `"limited"`
1183
11841215 - `secret_name: string`
11851216
11861217 Name of the environment variable. Immutable after create.
11871218
1219 minLength: 1, maxLength: 255
1220
11881221 - `secret_value: string`
11891222
11901223 Secret value. Write-only; never returned in responses.
11911224
1225 minLength: 1, maxLength: 4096
1226
11921227 - `type: "environment_variable"`
11931228
1194 - `"environment_variable"`
1195
11961229 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`
11971230
11981231 Where in the outbound request the secret value may be substituted.
from line 1242
12091242
12101243 Human-readable name for the credential. Up to 255 characters.
12111244
1245 maxLength: 255
1246
12121247- `metadata: optional map[string]`
12131248
12141249 Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.
12151250
1216### Returns
1217
1218- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`
1251#### Returns
1252
1253- `BetaManagedAgentsCredential object`
12191254
12201255 A credential stored in a vault. Sensitive fields are never returned in responses.
12211256
from line 1262
12271262
12281263 A timestamp in RFC 3339 format
12291264
1265 format: date-time
1266
12301267 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`
12311268
12321269 Authentication details for a credential.
12331270
1234 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
1271 - `BetaManagedAgentsMCPOAuthAuthResponse object`
12351272
12361273 OAuth credential details for an MCP server.
12371274
from line 1278
12411278
12421279 - `type: "mcp_oauth"`
12431280
1244 - `"mcp_oauth"`
1245
12461281 - `expires_at: optional string or null`
12471282
12481283 A timestamp in RFC 3339 format
12491284
1285 format: date-time
1286
12501287 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
12511288
12521289 OAuth refresh token configuration returned in credential responses.
from line 1300
12631300
12641301 Token endpoint requires no client authentication.
12651302
1266 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
1303 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`
12671304
12681305 Token endpoint requires no client authentication.
12691306
12701307 - `type: "none"`
12711308
1272 - `"none"`
1273
1274 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
1309 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`
12751310
12761311 Token endpoint uses HTTP Basic authentication with client credentials.
12771312
12781313 - `type: "client_secret_basic"`
12791314
1280 - `"client_secret_basic"`
1281
1282 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
1315 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`
12831316
12841317 Token endpoint uses POST body authentication with client credentials.
12851318
12861319 - `type: "client_secret_post"`
12871320
1288 - `"client_secret_post"`
1289
12901321 - `resource: optional string or null`
12911322
12921323 OAuth resource indicator.
from line 1326
12951326
12961327 OAuth scope for the refresh request.
12971328
1298 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
1329 - `BetaManagedAgentsStaticBearerAuthResponse object`
12991330
13001331 Static bearer token credential details for an MCP server.
13011332
from line 1336
13051336
13061337 - `type: "static_bearer"`
13071338
1308 - `"static_bearer"`
1309
1310 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
1339 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
13111340
13121341 Environment variable credential details. The secret value is never returned.
13131342
from line 1356
13271356
13281357 Outbound hosts the secret value is substituted on.
13291358
1330 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
1359 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`
13311360
13321361 The secret is substituted on any host the session's Environment network policy permits egress to.
13331362
13341363 - `type: "unrestricted"`
13351364
1336 - `"unrestricted"`
1337
1338 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
1365 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
13391366
13401367 The secret is substituted only on requests to the listed hosts.
13411368
from line 1372
13451372
13461373 - `type: "limited"`
13471374
1348 - `"limited"`
1349
13501375 - `secret_name: string`
13511376
13521377 Name of the environment variable.
13531378
13541379 - `type: "environment_variable"`
13551380
1356 - `"environment_variable"`
1357
13581381 - `created_at: string`
13591382
13601383 A timestamp in RFC 3339 format
13611384
1385 format: date-time
1386
13621387 - `metadata: map[string]`
13631388
13641389 Arbitrary key-value metadata attached to the credential.
13651390
13661391 - `type: "vault_credential"`
13671392
1368 - `"vault_credential"`
1369
13701393 - `updated_at: string`
13711394
13721395 A timestamp in RFC 3339 format
13731396
1397 format: date-time
1398
13741399 - `vault_id: string`
13751400
13761401 Identifier of the vault this credential belongs to.
from line 1404
13791404
13801405 Human-readable name for the credential.
13811406
1382### Example
1383
1384```http
1407#### Example
1408
1409```bash
13851410curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \
13861411 -H 'Content-Type: application/json' \
13871412 -H 'anthropic-version: 2023-06-01' \
from line 1425
14001425 }'
14011426```
14021427
1403#### Response
1428##### Response (200)
14041429
14051430```json
14061431{
from line 1446
14211446}
14221447```
14231448
1424## List Credentials
1425
1426**get** `/v1/vaults/{vault_id}/credentials`
1449### List Credentials
1450
1451**GET** `/v1/vaults/{vault_id}/credentials`
14271452
14281453List Credentials
14291454
1430### Path Parameters
1455#### Path parameters
14311456
14321457- `vault_id: string`
14331458
1434### Query Parameters
1459#### Query parameters
14351460
14361461- `include_archived: optional boolean`
14371462
from line 1466
14411466
14421467 Maximum number of credentials to return per page. Defaults to 20, maximum 100.
14431468
1469 format: int32
1470
14441471- `page: optional string`
14451472
14461473 Opaque pagination token from a previous `list_credentials` response.
14471474
1448### Header Parameters
1475#### Headers
14491476
14501477- `"anthropic-beta": optional array of AnthropicBeta`
14511478
from line 1550
15231550
15241551 - `"mid-conversation-tool-changes-2026-07-01"`
15251552
1526### Returns
1553#### Returns
15271554
15281555- `data: optional array of BetaManagedAgentsCredential`
15291556
from line 1564
15371564
15381565 A timestamp in RFC 3339 format
15391566
1567 format: date-time
1568
15401569 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`
15411570
15421571 Authentication details for a credential.
15431572
1544 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
1573 - `BetaManagedAgentsMCPOAuthAuthResponse object`
15451574
15461575 OAuth credential details for an MCP server.
15471576
from line 1580
15511580
15521581 - `type: "mcp_oauth"`
15531582
1554 - `"mcp_oauth"`
1555
15561583 - `expires_at: optional string or null`
15571584
15581585 A timestamp in RFC 3339 format
15591586
1587 format: date-time
1588
15601589 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
15611590
15621591 OAuth refresh token configuration returned in credential responses.
from line 1602
15731602
15741603 Token endpoint requires no client authentication.
15751604
1576 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
1605 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`
15771606
15781607 Token endpoint requires no client authentication.
15791608
15801609 - `type: "none"`
15811610
1582 - `"none"`
1583
1584 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
1611 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`
15851612
15861613 Token endpoint uses HTTP Basic authentication with client credentials.
15871614
15881615 - `type: "client_secret_basic"`
15891616
1590 - `"client_secret_basic"`
1591
1592 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
1617 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`
15931618
15941619 Token endpoint uses POST body authentication with client credentials.
15951620
15961621 - `type: "client_secret_post"`
15971622
1598 - `"client_secret_post"`
1599
16001623 - `resource: optional string or null`
16011624
16021625 OAuth resource indicator.
from line 1628
16051628
16061629 OAuth scope for the refresh request.
16071630
1608 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
1631 - `BetaManagedAgentsStaticBearerAuthResponse object`
16091632
16101633 Static bearer token credential details for an MCP server.
16111634
from line 1638
16151638
16161639 - `type: "static_bearer"`
16171640
1618 - `"static_bearer"`
1619
1620 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
1641 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
16211642
16221643 Environment variable credential details. The secret value is never returned.
16231644
from line 1658
16371658
16381659 Outbound hosts the secret value is substituted on.
16391660
1640 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
1661 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`
16411662
16421663 The secret is substituted on any host the session's Environment network policy permits egress to.
16431664
16441665 - `type: "unrestricted"`
16451666
1646 - `"unrestricted"`
1647
1648 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
1667 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
16491668
16501669 The secret is substituted only on requests to the listed hosts.
16511670
from line 1674
16551674
16561675 - `type: "limited"`
16571676
1658 - `"limited"`
1659
16601677 - `secret_name: string`
16611678
16621679 Name of the environment variable.
16631680
16641681 - `type: "environment_variable"`
16651682
1666 - `"environment_variable"`
1667
16681683 - `created_at: string`
16691684
16701685 A timestamp in RFC 3339 format
16711686
1687 format: date-time
1688
16721689 - `metadata: map[string]`
16731690
16741691 Arbitrary key-value metadata attached to the credential.
16751692
16761693 - `type: "vault_credential"`
16771694
1678 - `"vault_credential"`
1679
16801695 - `updated_at: string`
16811696
16821697 A timestamp in RFC 3339 format
16831698
1699 format: date-time
1700
16841701 - `vault_id: string`
16851702
16861703 Identifier of the vault this credential belongs to.
from line 1710
16931710
16941711 Pagination token for the next page, or null if no more results.
16951712
1696### Example
1697
1698```http
1713#### Example
1714
1715```bash
16991716curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \
17001717 -H 'anthropic-version: 2023-06-01' \
17011718 -H 'anthropic-beta: managed-agents-2026-04-01' \
17021719 -H "X-Api-Key: $ANTHROPIC_API_KEY"
17031720```
17041721
1705#### Response
1722##### Response (200)
17061723
17071724```json
17081725{
from line 1745
17281745}
17291746```
17301747
1731## Get Credential
1732
1733**get** `/v1/vaults/{vault_id}/credentials/{credential_id}`
1748### Get Credential
1749
1750**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`
17341751
17351752Get Credential
17361753
1737### Path Parameters
1754#### Path parameters
17381755
17391756- `vault_id: string`
17401757
17411758- `credential_id: string`
17421759
1743### Header Parameters
1760#### Headers
17441761
17451762- `"anthropic-beta": optional array of AnthropicBeta`
17461763
from line 1835
18181835
18191836 - `"mid-conversation-tool-changes-2026-07-01"`
18201837
1821### Returns
1822
1823- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`
1838#### Returns
1839
1840- `BetaManagedAgentsCredential object`
18241841
18251842 A credential stored in a vault. Sensitive fields are never returned in responses.
18261843
from line 1849
18321849
18331850 A timestamp in RFC 3339 format
18341851
1852 format: date-time
1853
18351854 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`
18361855
18371856 Authentication details for a credential.
18381857
1839 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
1858 - `BetaManagedAgentsMCPOAuthAuthResponse object`
18401859
18411860 OAuth credential details for an MCP server.
18421861
from line 1865
18461865
18471866 - `type: "mcp_oauth"`
18481867
1849 - `"mcp_oauth"`
1850
18511868 - `expires_at: optional string or null`
18521869
18531870 A timestamp in RFC 3339 format
18541871
1872 format: date-time
1873
18551874 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
18561875
18571876 OAuth refresh token configuration returned in credential responses.
from line 1887
18681887
18691888 Token endpoint requires no client authentication.
18701889
1871 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
1890 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`
18721891
18731892 Token endpoint requires no client authentication.
18741893
18751894 - `type: "none"`
18761895
1877 - `"none"`
1878
1879 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
1896 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`
18801897
18811898 Token endpoint uses HTTP Basic authentication with client credentials.
18821899
18831900 - `type: "client_secret_basic"`
18841901
1885 - `"client_secret_basic"`
1886
1887 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
1902 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`
18881903
18891904 Token endpoint uses POST body authentication with client credentials.
18901905
18911906 - `type: "client_secret_post"`
18921907
1893 - `"client_secret_post"`
1894
18951908 - `resource: optional string or null`
18961909
18971910 OAuth resource indicator.
from line 1913
19001913
19011914 OAuth scope for the refresh request.
19021915
1903 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
1916 - `BetaManagedAgentsStaticBearerAuthResponse object`
19041917
19051918 Static bearer token credential details for an MCP server.
19061919
from line 1923
19101923
19111924 - `type: "static_bearer"`
19121925
1913 - `"static_bearer"`
1914
1915 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
1926 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
19161927
19171928 Environment variable credential details. The secret value is never returned.
19181929
from line 1943
19321943
19331944 Outbound hosts the secret value is substituted on.
19341945
1935 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
1946 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`
19361947
19371948 The secret is substituted on any host the session's Environment network policy permits egress to.
19381949
19391950 - `type: "unrestricted"`
19401951
1941 - `"unrestricted"`
1942
1943 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
1952 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
19441953
19451954 The secret is substituted only on requests to the listed hosts.
19461955
from line 1959
19501959
19511960 - `type: "limited"`
19521961
1953 - `"limited"`
1954
19551962 - `secret_name: string`
19561963
19571964 Name of the environment variable.
19581965
19591966 - `type: "environment_variable"`
19601967
1961 - `"environment_variable"`
1962
19631968 - `created_at: string`
19641969
19651970 A timestamp in RFC 3339 format
19661971
1972 format: date-time
1973
19671974 - `metadata: map[string]`
19681975
19691976 Arbitrary key-value metadata attached to the credential.
19701977
19711978 - `type: "vault_credential"`
19721979
1973 - `"vault_credential"`
1974
19751980 - `updated_at: string`
19761981
19771982 A timestamp in RFC 3339 format
19781983
1984 format: date-time
1985
19791986 - `vault_id: string`
19801987
19811988 Identifier of the vault this credential belongs to.
from line 1991
19841991
19851992 Human-readable name for the credential.
19861993
1987### Example
1988
1989```http
1994#### Example
1995
1996```bash
19901997curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \
19911998 -H 'anthropic-version: 2023-06-01' \
19921999 -H 'anthropic-beta: managed-agents-2026-04-01' \
19932000 -H "X-Api-Key: $ANTHROPIC_API_KEY"
19942001```
19952002
1996#### Response
2003##### Response (200)
19972004
19982005```json
19992006{
from line 2021
20142021}
20152022```
20162023
2017## Update Credential
2018
2019**post** `/v1/vaults/{vault_id}/credentials/{credential_id}`
2024### Update Credential
2025
2026**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`
20202027
20212028Update Credential
20222029
2023### Path Parameters
2030#### Path parameters
20242031
20252032- `vault_id: string`
20262033
20272034- `credential_id: string`
20282035
2029### Header Parameters
2036#### Headers
20302037
20312038- `"anthropic-beta": optional array of AnthropicBeta`
20322039
from line 2111
21042111
21052112 - `"mid-conversation-tool-changes-2026-07-01"`
21062113
2107### Body Parameters
2114#### Body parameters
21082115
21092116- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`
21102117
21112118 Updated authentication details for a credential.
21122119
2113 - `BetaManagedAgentsMCPOAuthUpdateParams object { type, access_token, expires_at, refresh }`
2120 - `BetaManagedAgentsMCPOAuthUpdateParams object`
21142121
21152122 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.
21162123
21172124 - `type: "mcp_oauth"`
21182125
2119 - `"mcp_oauth"`
2120
21212126 - `access_token: optional string or null`
21222127
21232128 Updated OAuth access token.
21242129
2130 minLength: 1, maxLength: 8192
2131
21252132 - `expires_at: optional string or null`
21262133
21272134 A timestamp in RFC 3339 format
21282135
2136 format: date-time
2137
21292138 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`
21302139
21312140 Parameters for updating OAuth refresh token configuration.
from line 2143
21342143
21352144 Updated OAuth refresh token.
21362145
2146 minLength: 1, maxLength: 4096
2147
21372148 - `scope: optional string or null`
21382149
21392150 Updated OAuth scope for the refresh request.
21402151
2152 maxLength: 8192
2153
21412154 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`
21422155
21432156 Updated HTTP Basic authentication parameters for the token endpoint.
21442157
2145 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`
2158 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`
21462159
21472160 Updated HTTP Basic authentication parameters for the token endpoint.
21482161
21492162 - `type: "client_secret_basic"`
21502163
2151 - `"client_secret_basic"`
2152
21532164 - `client_secret: optional string or null`
21542165
21552166 Updated OAuth client secret.
21562167
2157 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`
2168 minLength: 1, maxLength: 512
2169
2170 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`
21582171
21592172 Updated POST body authentication parameters for the token endpoint.
21602173
21612174 - `type: "client_secret_post"`
21622175
2163 - `"client_secret_post"`
2164
21652176 - `client_secret: optional string or null`
21662177
21672178 Updated OAuth client secret.
21682179
2169 - `BetaManagedAgentsStaticBearerUpdateParams object { type, token }`
2180 minLength: 1, maxLength: 512
2181
2182 - `BetaManagedAgentsStaticBearerUpdateParams object`
21702183
21712184 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.
21722185
21732186 - `type: "static_bearer"`
21742187
2175 - `"static_bearer"`
2176
21772188 - `token: optional string or null`
21782189
21792190 Updated static bearer token value.
21802191
2181 - `BetaManagedAgentsEnvironmentVariableUpdateParams object { type, injection_location, networking, secret_value }`
2192 minLength: 1, maxLength: 8192
2193
2194 - `BetaManagedAgentsEnvironmentVariableUpdateParams object`
21822195
21832196 Parameters for updating an environment variable credential. `secret_name` is immutable.
21842197
21852198 - `type: "environment_variable"`
21862199
2187 - `"environment_variable"`
2188
21892200 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`
21902201
21912202 Updated injection location.
from line 2213
22022213
22032214 Updated networking scope. Full replacement.
22042215
2205 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`
2216 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`
22062217
22072218 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
22082219
22092220 - `type: "unrestricted"`
22102221
2211 - `"unrestricted"`
2212
2213 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`
2222 - `BetaManagedAgentsLimitedCredentialNetworkingParams object`
22142223
22152224 Substitute the secret only on requests to the listed hosts.
22162225
from line 2229
22202229
22212230 - `type: "limited"`
22222231
2223 - `"limited"`
2224
22252232 - `secret_value: optional string or null`
22262233
22272234 Updated secret value.
22282235
2236 minLength: 1, maxLength: 4096
2237
22292238- `display_name: optional string or null`
22302239
22312240 Updated human-readable name for the credential. 1-255 characters.
22322241
2242 minLength: 1, maxLength: 255
2243
22332244- `metadata: optional map[string] or null`
22342245
22352246 Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.
22362247
2237### Returns
2238
2239- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`
2248#### Returns
2249
2250- `BetaManagedAgentsCredential object`
22402251
22412252 A credential stored in a vault. Sensitive fields are never returned in responses.
22422253
from line 2259
22482259
22492260 A timestamp in RFC 3339 format
22502261
2262 format: date-time
2263
22512264 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`
22522265
22532266 Authentication details for a credential.
22542267
2255 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
2268 - `BetaManagedAgentsMCPOAuthAuthResponse object`
22562269
22572270 OAuth credential details for an MCP server.
22582271
from line 2275
22622275
22632276 - `type: "mcp_oauth"`
22642277
2265 - `"mcp_oauth"`
2266
22672278 - `expires_at: optional string or null`
22682279
22692280 A timestamp in RFC 3339 format
22702281
2282 format: date-time
2283
22712284 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
22722285
22732286 OAuth refresh token configuration returned in credential responses.
from line 2297
22842297
22852298 Token endpoint requires no client authentication.
22862299
2287 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
2300 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`
22882301
22892302 Token endpoint requires no client authentication.
22902303
22912304 - `type: "none"`
22922305
2293 - `"none"`
2294
2295 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
2306 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`
22962307
22972308 Token endpoint uses HTTP Basic authentication with client credentials.
22982309
22992310 - `type: "client_secret_basic"`
23002311
2301 - `"client_secret_basic"`
2302
2303 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
2312 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`
23042313
23052314 Token endpoint uses POST body authentication with client credentials.
23062315
23072316 - `type: "client_secret_post"`
23082317
2309 - `"client_secret_post"`
2310
23112318 - `resource: optional string or null`
23122319
23132320 OAuth resource indicator.
from line 2323
23162323
23172324 OAuth scope for the refresh request.
23182325
2319 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
2326 - `BetaManagedAgentsStaticBearerAuthResponse object`
23202327
23212328 Static bearer token credential details for an MCP server.
23222329
from line 2333
23262333
23272334 - `type: "static_bearer"`
23282335
2329 - `"static_bearer"`
2330
2331 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
2336 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
23322337
23332338 Environment variable credential details. The secret value is never returned.
23342339
from line 2353
23482353
23492354 Outbound hosts the secret value is substituted on.
23502355
2351 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
2356 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`
23522357
23532358 The secret is substituted on any host the session's Environment network policy permits egress to.
23542359
23552360 - `type: "unrestricted"`
23562361
2357 - `"unrestricted"`
2358
2359 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
2362 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
23602363
23612364 The secret is substituted only on requests to the listed hosts.
23622365
from line 2369
23662369
23672370 - `type: "limited"`
23682371
2369 - `"limited"`
2370
23712372 - `secret_name: string`
23722373
23732374 Name of the environment variable.
23742375
23752376 - `type: "environment_variable"`
23762377
2377 - `"environment_variable"`
2378
23792378 - `created_at: string`
23802379
23812380 A timestamp in RFC 3339 format
23822381
2382 format: date-time
2383
23832384 - `metadata: map[string]`
23842385
23852386 Arbitrary key-value metadata attached to the credential.
23862387
23872388 - `type: "vault_credential"`
23882389
2389 - `"vault_credential"`
2390
23912390 - `updated_at: string`
23922391
23932392 A timestamp in RFC 3339 format
23942393
2394 format: date-time
2395
23952396 - `vault_id: string`
23962397
23972398 Identifier of the vault this credential belongs to.
from line 2401
24002401
24012402 Human-readable name for the credential.
24022403
2403### Example
2404
2405```http
2404#### Example
2405
2406```bash
24062407curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \
24072408 -H 'Content-Type: application/json' \
24082409 -H 'anthropic-version: 2023-06-01' \
from line 2417
24162417 }'
24172418```
24182419
2419#### Response
2420##### Response (200)
24202421
24212422```json
24222423{
from line 2438
24372438}
24382439```
24392440
2440## Delete Credential
2441
2442**delete** `/v1/vaults/{vault_id}/credentials/{credential_id}`
2441### Delete Credential
2442
2443**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`
24432444
24442445Delete Credential
24452446
2446### Path Parameters
2447#### Path parameters
24472448
24482449- `vault_id: string`
24492450
24502451- `credential_id: string`
24512452
2452### Header Parameters
2453#### Headers
24532454
24542455- `"anthropic-beta": optional array of AnthropicBeta`
24552456
from line 2528
25272528
25282529 - `"mid-conversation-tool-changes-2026-07-01"`
25292530
2530### Returns
2531
2532- `BetaManagedAgentsDeletedCredential object { id, type }`
2531#### Returns
2532
2533- `BetaManagedAgentsDeletedCredential object`
25332534
25342535 Confirmation of a deleted credential.
25352536
from line 2540
25392540
25402541 - `type: "vault_credential_deleted"`
25412542
2542 - `"vault_credential_deleted"`
2543
2544### Example
2545
2546```http
2543#### Example
2544
2545```bash
25472546curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \
25482547 -X DELETE \
25492548 -H 'anthropic-version: 2023-06-01' \
from line 2550
25512550 -H "X-Api-Key: $ANTHROPIC_API_KEY"
25522551```
25532552
2554#### Response
2553##### Response (200)
25552554
25562555```json
25572556{
from line 2559
25602559}
25612560```
25622561
2563## Archive Credential
2564
2565**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`
2562### Archive Credential
2563
2564**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`
25662565
25672566Archive Credential
25682567
2569### Path Parameters
2568#### Path parameters
25702569
25712570- `vault_id: string`
25722571
25732572- `credential_id: string`
25742573
2575### Header Parameters
2574#### Headers
25762575
25772576- `"anthropic-beta": optional array of AnthropicBeta`
25782577
from line 2649
26502649
26512650 - `"mid-conversation-tool-changes-2026-07-01"`
26522651
2653### Returns
2654
2655- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`
2652#### Returns
2653
2654- `BetaManagedAgentsCredential object`
26562655
26572656 A credential stored in a vault. Sensitive fields are never returned in responses.
26582657
from line 2663
26642663
26652664 A timestamp in RFC 3339 format
26662665
2666 format: date-time
2667
26672668 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`
26682669
26692670 Authentication details for a credential.
26702671
2671 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
2672 - `BetaManagedAgentsMCPOAuthAuthResponse object`
26722673
26732674 OAuth credential details for an MCP server.
26742675
from line 2679
26782679
26792680 - `type: "mcp_oauth"`
26802681
2681 - `"mcp_oauth"`
2682
26832682 - `expires_at: optional string or null`
26842683
26852684 A timestamp in RFC 3339 format
26862685
2686 format: date-time
2687
26872688 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
26882689
26892690 OAuth refresh token configuration returned in credential responses.
from line 2701
27002701
27012702 Token endpoint requires no client authentication.
27022703
2703 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
2704 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`
27042705
27052706 Token endpoint requires no client authentication.
27062707
27072708 - `type: "none"`
27082709
2709 - `"none"`
2710
2711 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
2710 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`
27122711
27132712 Token endpoint uses HTTP Basic authentication with client credentials.
27142713
27152714 - `type: "client_secret_basic"`
27162715
2717 - `"client_secret_basic"`
2718
2719 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
2716 - `BetaManagedAgentsTokenEndpointAuthPostResponse object`
27202717
27212718 Token endpoint uses POST body authentication with client credentials.
27222719
27232720 - `type: "client_secret_post"`
27242721
2725 - `"client_secret_post"`
2726
27272722 - `resource: optional string or null`
27282723
27292724 OAuth resource indicator.
from line 2727
27322727
27332728 OAuth scope for the refresh request.
27342729
2735 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
2730 - `BetaManagedAgentsStaticBearerAuthResponse object`
27362731
27372732 Static bearer token credential details for an MCP server.
27382733
from line 2737
27422737
27432738 - `type: "static_bearer"`
27442739
2745 - `"static_bearer"`
2746
2747 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
2740 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
27482741
27492742 Environment variable credential details. The secret value is never returned.
27502743
from line 2757
27642757
27652758 Outbound hosts the secret value is substituted on.
27662759
2767 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
2760 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`
27682761
27692762 The secret is substituted on any host the session's Environment network policy permits egress to.
27702763
27712764 - `type: "unrestricted"`
27722765
2773 - `"unrestricted"`
2774
2775 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
2766 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
27762767
27772768 The secret is substituted only on requests to the listed hosts.
27782769
from line 2773
27822773
27832774 - `type: "limited"`
27842775
2785 - `"limited"`
2786
27872776 - `secret_name: string`
27882777
27892778 Name of the environment variable.
27902779
27912780 - `type: "environment_variable"`
27922781
2793 - `"environment_variable"`
2794
27952782 - `created_at: string`
27962783
27972784 A timestamp in RFC 3339 format
27982785
2786 format: date-time
2787
27992788 - `metadata: map[string]`
28002789
28012790 Arbitrary key-value metadata attached to the credential.
28022791
28032792 - `type: "vault_credential"`
28042793
2805 - `"vault_credential"`
2806
28072794 - `updated_at: string`
28082795
28092796 A timestamp in RFC 3339 format
28102797
2798 format: date-time
2799
28112800 - `vault_id: string`
28122801
28132802 Identifier of the vault this credential belongs to.
from line 2805
28162805
28172806 Human-readable name for the credential.
28182807
2819### Example
2820
2821```http
2808#### Example
2809
2810```bash
28222811curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \
28232812 -X POST \
28242813 -H 'anthropic-version: 2023-06-01' \
from line 2815
28262815 -H "X-Api-Key: $ANTHROPIC_API_KEY"
28272816```
28282817
2829#### Response
2818##### Response (200)
28302819
28312820```json
28322821{
from line 2836
28472836}
28482837```
28492838
2850## Validate Credential
2851
2852**post** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`
2839### Validate Credential
2840
2841**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`
28532842
28542843Validate Credential
28552844
2856### Path Parameters
2845#### Path parameters
28572846
28582847- `vault_id: string`
28592848
28602849- `credential_id: string`
28612850
2862### Header Parameters
2851#### Headers
28632852
28642853- `"anthropic-beta": optional array of AnthropicBeta`
28652854
from line 2926
29372926
29382927 - `"mid-conversation-tool-changes-2026-07-01"`
29392928
2940### Returns
2941
2942- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`
2929#### Returns
2930
2931- `BetaManagedAgentsCredentialValidation object`
29432932
29442933 Result of live-probing a credential against its configured MCP server.
29452934
from line 2964
29752964
29762965 HTTP status code.
29772966
2967 format: int32
2968
29782969 - `method: string`
29792970
29802971 The MCP method that failed (for example `initialize` or `tools/list`).
from line 3002
30113002
30123003 - `type: "vault_credential_validation"`
30133004
3014 - `"vault_credential_validation"`
3015
30163005 - `validated_at: string`
30173006
30183007 A timestamp in RFC 3339 format
30193008
3009 format: date-time
3010
30203011 - `vault_id: string`
30213012
30223013 Identifier of the vault containing the credential.
30233014
3024### Example
3025
3026```http
3015#### Example
3016
3017```bash
30273018curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \
30283019 -X POST \
30293020 -H 'anthropic-version: 2023-06-01' \
from line 3022
30313022 -H "X-Api-Key: $ANTHROPIC_API_KEY"
30323023```
30333024
3034#### Response
3025##### Response (200)
30353026
30363027```json
30373028{
from line 3052
30613052 "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv"
30623053}
30633054```
3064
3065## Domain Types
3066
3067### Beta Managed Agents Credential
3068
3069- `BetaManagedAgentsCredential object { id, archived_at, auth, 6 more }`
3070
3071 A credential stored in a vault. Sensitive fields are never returned in responses.
3072
3073 - `id: string`
3074
3075 Unique identifier for the credential.
3076
3077 - `archived_at: string or null`
3078
3079 A timestamp in RFC 3339 format
3080
3081 - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`
3082
3083 Authentication details for a credential.
3084
3085 - `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
3086
3087 OAuth credential details for an MCP server.
3088
3089 - `mcp_server_url: string`
3090
3091 URL of the MCP server this credential authenticates against.
3092
3093 - `type: "mcp_oauth"`
3094
3095 - `"mcp_oauth"`
3096
3097 - `expires_at: optional string or null`
3098
3099 A timestamp in RFC 3339 format
3100
3101 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
3102
3103 OAuth refresh token configuration returned in credential responses.
3104
3105 - `client_id: string`
3106
3107 OAuth client ID.
3108
3109 - `token_endpoint: string`
3110
3111 Token endpoint URL used to refresh the access token.
3112
3113 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`
3114
3115 Token endpoint requires no client authentication.
3116
3117 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
3118
3119 Token endpoint requires no client authentication.
3120
3121 - `type: "none"`
3122
3123 - `"none"`
3124
3125 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
3126
3127 Token endpoint uses HTTP Basic authentication with client credentials.
3128
3129 - `type: "client_secret_basic"`
3130
3131 - `"client_secret_basic"`
3132
3133 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
3134
3135 Token endpoint uses POST body authentication with client credentials.
3136
3137 - `type: "client_secret_post"`
3138
3139 - `"client_secret_post"`
3140
3141 - `resource: optional string or null`
3142
3143 OAuth resource indicator.
3144
3145 - `scope: optional string or null`
3146
3147 OAuth scope for the refresh request.
3148
3149 - `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
3150
3151 Static bearer token credential details for an MCP server.
3152
3153 - `mcp_server_url: string`
3154
3155 URL of the MCP server this credential authenticates against.
3156
3157 - `type: "static_bearer"`
3158
3159 - `"static_bearer"`
3160
3161 - `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
3162
3163 Environment variable credential details. The secret value is never returned.
3164
3165 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
3166
3167 Where in the outbound request the secret value is substituted.
3168
3169 - `body: boolean`
3170
3171 Whether the placeholder is substituted in the request body.
3172
3173 - `header: boolean`
3174
3175 Whether the placeholder is substituted in request header values.
3176
3177 - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`
3178
3179 Outbound hosts the secret value is substituted on.
3180
3181 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
3182
3183 The secret is substituted on any host the session's Environment network policy permits egress to.
3184
3185 - `type: "unrestricted"`
3186
3187 - `"unrestricted"`
3188
3189 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
3190
3191 The secret is substituted only on requests to the listed hosts.
3192
3193 - `allowed_hosts: array of string`
3194
3195 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
3196
3197 - `type: "limited"`
3198
3199 - `"limited"`
3200
3201 - `secret_name: string`
3202
3203 Name of the environment variable.
3204
3205 - `type: "environment_variable"`
3206
3207 - `"environment_variable"`
3208
3209 - `created_at: string`
3210
3211 A timestamp in RFC 3339 format
3212
3213 - `metadata: map[string]`
3214
3215 Arbitrary key-value metadata attached to the credential.
3216
3217 - `type: "vault_credential"`
3218
3219 - `"vault_credential"`
3220
3221 - `updated_at: string`
3222
3223 A timestamp in RFC 3339 format
3224
3225 - `vault_id: string`
3226
3227 Identifier of the vault this credential belongs to.
3228
3229 - `display_name: optional string or null`
3230
3231 Human-readable name for the credential.
3232
3233### Beta Managed Agents Credential Networking Params
3234
3235- `BetaManagedAgentsCredentialNetworkingParams = BetaManagedAgentsUnrestrictedCredentialNetworkingParams or BetaManagedAgentsLimitedCredentialNetworkingParams`
3236
3237 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
3238
3239 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`
3240
3241 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
3242
3243 - `type: "unrestricted"`
3244
3245 - `"unrestricted"`
3246
3247 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`
3248
3249 Substitute the secret only on requests to the listed hosts.
3250
3251 - `allowed_hosts: array of string`
3252
3253 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
3254
3255 - `type: "limited"`
3256
3257 - `"limited"`
3258
3259### Beta Managed Agents Credential Validation
3260
3261- `BetaManagedAgentsCredentialValidation object { credential_id, has_refresh_token, mcp_probe, 5 more }`
3262
3263 Result of live-probing a credential against its configured MCP server.
3264
3265 - `credential_id: string`
3266
3267 Unique identifier of the credential that was validated.
3268
3269 - `has_refresh_token: boolean`
3270
3271 Whether the credential has a refresh token configured.
3272
3273 - `mcp_probe: BetaManagedAgentsMCPProbe or null`
3274
3275 The failing step of an MCP validation probe.
3276
3277 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
3278
3279 An HTTP response captured during a credential validation probe.
3280
3281 - `body: string`
3282
3283 Response body. May be truncated and has sensitive values scrubbed.
3284
3285 - `body_truncated: boolean`
3286
3287 Whether `body` was truncated.
3288
3289 - `content_type: string`
3290
3291 Value of the `Content-Type` response header.
3292
3293 - `status_code: number`
3294
3295 HTTP status code.
3296
3297 - `method: string`
3298
3299 The MCP method that failed (for example `initialize` or `tools/list`).
3300
3301 - `refresh: BetaManagedAgentsRefreshObject or null`
3302
3303 Outcome of a refresh-token exchange attempted during credential validation.
3304
3305 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
3306
3307 An HTTP response captured during a credential validation probe.
3308
3309 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`
3310
3311 Outcome of a refresh-token exchange attempted during credential validation.
3312
3313 - `"succeeded"`
3314
3315 - `"failed"`
3316
3317 - `"connect_error"`
3318
3319 - `"no_refresh_token"`
3320
3321 - `status: BetaManagedAgentsCredentialValidationStatus`
3322
3323 Overall verdict of a credential validation probe.
3324
3325 - `"valid"`
3326
3327 - `"invalid"`
3328
3329 - `"unknown"`
3330
3331 - `type: "vault_credential_validation"`
3332
3333 - `"vault_credential_validation"`
3334
3335 - `validated_at: string`
3336
3337 A timestamp in RFC 3339 format
3338
3339 - `vault_id: string`
3340
3341 Identifier of the vault containing the credential.
3342
3343### Beta Managed Agents Credential Validation Status
3344
3345- `BetaManagedAgentsCredentialValidationStatus = "valid" or "invalid" or "unknown"`
3346
3347 Overall verdict of a credential validation probe.
3348
3349 - `"valid"`
3350
3351 - `"invalid"`
3352
3353 - `"unknown"`
3354
3355### Beta Managed Agents Deleted Credential
3356
3357- `BetaManagedAgentsDeletedCredential object { id, type }`
3358
3359 Confirmation of a deleted credential.
3360
3361 - `id: string`
3362
3363 Unique identifier of the deleted credential.
3364
3365 - `type: "vault_credential_deleted"`
3366
3367 - `"vault_credential_deleted"`
3368
3369### Beta Managed Agents Environment Variable Auth Response
3370
3371- `BetaManagedAgentsEnvironmentVariableAuthResponse object { injection_location, networking, secret_name, type }`
3372
3373 Environment variable credential details. The secret value is never returned.
3374
3375 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
3376
3377 Where in the outbound request the secret value is substituted.
3378
3379 - `body: boolean`
3380
3381 Whether the placeholder is substituted in the request body.
3382
3383 - `header: boolean`
3384
3385 Whether the placeholder is substituted in request header values.
3386
3387 - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`
3388
3389 Outbound hosts the secret value is substituted on.
3390
3391 - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
3392
3393 The secret is substituted on any host the session's Environment network policy permits egress to.
3394
3395 - `type: "unrestricted"`
3396
3397 - `"unrestricted"`
3398
3399 - `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
3400
3401 The secret is substituted only on requests to the listed hosts.
3402
3403 - `allowed_hosts: array of string`
3404
3405 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
3406
3407 - `type: "limited"`
3408
3409 - `"limited"`
3410
3411 - `secret_name: string`
3412
3413 Name of the environment variable.
3414
3415 - `type: "environment_variable"`
3416
3417 - `"environment_variable"`
3418
3419### Beta Managed Agents Environment Variable Create Params
3420
3421- `BetaManagedAgentsEnvironmentVariableCreateParams object { networking, secret_name, secret_value, 2 more }`
3422
3423 Parameters for creating an environment variable credential.
3424
3425 - `networking: BetaManagedAgentsCredentialNetworkingParams`
3426
3427 Outbound hosts the secret value is substituted on.
3428
3429 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`
3430
3431 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
3432
3433 - `type: "unrestricted"`
3434
3435 - `"unrestricted"`
3436
3437 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`
3438
3439 Substitute the secret only on requests to the listed hosts.
3440
3441 - `allowed_hosts: array of string`
3442
3443 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
3444
3445 - `type: "limited"`
3446
3447 - `"limited"`
3448
3449 - `secret_name: string`
3450
3451 Name of the environment variable. Immutable after create.
3452
3453 - `secret_value: string`
3454
3455 Secret value. Write-only; never returned in responses.
3456
3457 - `type: "environment_variable"`
3458
3459 - `"environment_variable"`
3460
3461 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`
3462
3463 Where in the outbound request the secret value may be substituted.
3464
3465 - `body: optional boolean`
3466
3467 Substitute when the placeholder appears in the request body.
3468
3469 - `header: optional boolean`
3470
3471 Substitute when the placeholder appears in a request header value.
3472
3473### Beta Managed Agents Environment Variable Update Params
3474
3475- `BetaManagedAgentsEnvironmentVariableUpdateParams object { type, injection_location, networking, secret_value }`
3476
3477 Parameters for updating an environment variable credential. `secret_name` is immutable.
3478
3479 - `type: "environment_variable"`
3480
3481 - `"environment_variable"`
3482
3483 - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`
3484
3485 Updated injection location.
3486
3487 - `body: optional boolean`
3488
3489 Substitute when the placeholder appears in the request body.
3490
3491 - `header: optional boolean`
3492
3493 Substitute when the placeholder appears in a request header value.
3494
3495 - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`
3496
3497 Updated networking scope. Full replacement.
3498
3499 - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`
3500
3501 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
3502
3503 - `type: "unrestricted"`
3504
3505 - `"unrestricted"`
3506
3507 - `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`
3508
3509 Substitute the secret only on requests to the listed hosts.
3510
3511 - `allowed_hosts: array of string`
3512
3513 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
3514
3515 - `type: "limited"`
3516
3517 - `"limited"`
3518
3519 - `secret_value: optional string or null`
3520
3521 Updated secret value.
3522
3523### Beta Managed Agents Injection Location Params
3524
3525- `BetaManagedAgentsInjectionLocationParams object { body, header }`
3526
3527 Where in the outbound request the secret value may be substituted.
3528
3529 - `body: optional boolean`
3530
3531 Substitute when the placeholder appears in the request body.
3532
3533 - `header: optional boolean`
3534
3535 Substitute when the placeholder appears in a request header value.
3536
3537### Beta Managed Agents Injection Location Response
3538
3539- `BetaManagedAgentsInjectionLocationResponse object { body, header }`
3540
3541 Where in the outbound request the secret value is substituted.
3542
3543 - `body: boolean`
3544
3545 Whether the placeholder is substituted in the request body.
3546
3547 - `header: boolean`
3548
3549 Whether the placeholder is substituted in request header values.
3550
3551### Beta Managed Agents Injection Location Update Params
3552
3553- `BetaManagedAgentsInjectionLocationUpdateParams object { body, header }`
3554
3555 Updated injection location.
3556
3557 - `body: optional boolean`
3558
3559 Substitute when the placeholder appears in the request body.
3560
3561 - `header: optional boolean`
3562
3563 Substitute when the placeholder appears in a request header value.
3564
3565### Beta Managed Agents Limited Credential Networking Params
3566
3567- `BetaManagedAgentsLimitedCredentialNetworkingParams object { allowed_hosts, type }`
3568
3569 Substitute the secret only on requests to the listed hosts.
3570
3571 - `allowed_hosts: array of string`
3572
3573 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
3574
3575 - `type: "limited"`
3576
3577 - `"limited"`
3578
3579### Beta Managed Agents Limited Credential Networking Response
3580
3581- `BetaManagedAgentsLimitedCredentialNetworkingResponse object { allowed_hosts, type }`
3582
3583 The secret is substituted only on requests to the listed hosts.
3584
3585 - `allowed_hosts: array of string`
3586
3587 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
3588
3589 - `type: "limited"`
3590
3591 - `"limited"`
3592
3593### Beta Managed Agents MCP OAuth Auth Response
3594
3595- `BetaManagedAgentsMCPOAuthAuthResponse object { mcp_server_url, type, expires_at, refresh }`
3596
3597 OAuth credential details for an MCP server.
3598
3599 - `mcp_server_url: string`
3600
3601 URL of the MCP server this credential authenticates against.
3602
3603 - `type: "mcp_oauth"`
3604
3605 - `"mcp_oauth"`
3606
3607 - `expires_at: optional string or null`
3608
3609 A timestamp in RFC 3339 format
3610
3611 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`
3612
3613 OAuth refresh token configuration returned in credential responses.
3614
3615 - `client_id: string`
3616
3617 OAuth client ID.
3618
3619 - `token_endpoint: string`
3620
3621 Token endpoint URL used to refresh the access token.
3622
3623 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`
3624
3625 Token endpoint requires no client authentication.
3626
3627 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
3628
3629 Token endpoint requires no client authentication.
3630
3631 - `type: "none"`
3632
3633 - `"none"`
3634
3635 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
3636
3637 Token endpoint uses HTTP Basic authentication with client credentials.
3638
3639 - `type: "client_secret_basic"`
3640
3641 - `"client_secret_basic"`
3642
3643 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
3644
3645 Token endpoint uses POST body authentication with client credentials.
3646
3647 - `type: "client_secret_post"`
3648
3649 - `"client_secret_post"`
3650
3651 - `resource: optional string or null`
3652
3653 OAuth resource indicator.
3654
3655 - `scope: optional string or null`
3656
3657 OAuth scope for the refresh request.
3658
3659### Beta Managed Agents MCP OAuth Create Params
3660
3661- `BetaManagedAgentsMCPOAuthCreateParams object { access_token, mcp_server_url, type, 2 more }`
3662
3663 Parameters for creating an MCP OAuth credential.
3664
3665 - `access_token: string`
3666
3667 OAuth access token.
3668
3669 - `mcp_server_url: string`
3670
3671 URL of the MCP server this credential authenticates against.
3672
3673 - `type: "mcp_oauth"`
3674
3675 - `"mcp_oauth"`
3676
3677 - `expires_at: optional string or null`
3678
3679 A timestamp in RFC 3339 format
3680
3681 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`
3682
3683 OAuth refresh token parameters for creating a credential with refresh support.
3684
3685 - `client_id: string`
3686
3687 OAuth client ID.
3688
3689 - `refresh_token: string`
3690
3691 OAuth refresh token.
3692
3693 - `token_endpoint: string`
3694
3695 Token endpoint URL used to refresh the access token.
3696
3697 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`
3698
3699 Token endpoint requires no client authentication.
3700
3701 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`
3702
3703 Token endpoint requires no client authentication.
3704
3705 - `type: "none"`
3706
3707 - `"none"`
3708
3709 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`
3710
3711 Token endpoint uses HTTP Basic authentication with client credentials.
3712
3713 - `client_secret: string`
3714
3715 OAuth client secret.
3716
3717 - `type: "client_secret_basic"`
3718
3719 - `"client_secret_basic"`
3720
3721 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`
3722
3723 Token endpoint uses POST body authentication with client credentials.
3724
3725 - `client_secret: string`
3726
3727 OAuth client secret.
3728
3729 - `type: "client_secret_post"`
3730
3731 - `"client_secret_post"`
3732
3733 - `resource: optional string or null`
3734
3735 OAuth resource indicator.
3736
3737 - `scope: optional string or null`
3738
3739 OAuth scope for the refresh request.
3740
3741### Beta Managed Agents MCP OAuth Refresh Params
3742
3743- `BetaManagedAgentsMCPOAuthRefreshParams object { client_id, refresh_token, token_endpoint, 3 more }`
3744
3745 OAuth refresh token parameters for creating a credential with refresh support.
3746
3747 - `client_id: string`
3748
3749 OAuth client ID.
3750
3751 - `refresh_token: string`
3752
3753 OAuth refresh token.
3754
3755 - `token_endpoint: string`
3756
3757 Token endpoint URL used to refresh the access token.
3758
3759 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`
3760
3761 Token endpoint requires no client authentication.
3762
3763 - `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`
3764
3765 Token endpoint requires no client authentication.
3766
3767 - `type: "none"`
3768
3769 - `"none"`
3770
3771 - `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`
3772
3773 Token endpoint uses HTTP Basic authentication with client credentials.
3774
3775 - `client_secret: string`
3776
3777 OAuth client secret.
3778
3779 - `type: "client_secret_basic"`
3780
3781 - `"client_secret_basic"`
3782
3783 - `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`
3784
3785 Token endpoint uses POST body authentication with client credentials.
3786
3787 - `client_secret: string`
3788
3789 OAuth client secret.
3790
3791 - `type: "client_secret_post"`
3792
3793 - `"client_secret_post"`
3794
3795 - `resource: optional string or null`
3796
3797 OAuth resource indicator.
3798
3799 - `scope: optional string or null`
3800
3801 OAuth scope for the refresh request.
3802
3803### Beta Managed Agents MCP OAuth Refresh Response
3804
3805- `BetaManagedAgentsMCPOAuthRefreshResponse object { client_id, token_endpoint, token_endpoint_auth, 2 more }`
3806
3807 OAuth refresh token configuration returned in credential responses.
3808
3809 - `client_id: string`
3810
3811 OAuth client ID.
3812
3813 - `token_endpoint: string`
3814
3815 Token endpoint URL used to refresh the access token.
3816
3817 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`
3818
3819 Token endpoint requires no client authentication.
3820
3821 - `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
3822
3823 Token endpoint requires no client authentication.
3824
3825 - `type: "none"`
3826
3827 - `"none"`
3828
3829 - `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
3830
3831 Token endpoint uses HTTP Basic authentication with client credentials.
3832
3833 - `type: "client_secret_basic"`
3834
3835 - `"client_secret_basic"`
3836
3837 - `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
3838
3839 Token endpoint uses POST body authentication with client credentials.
3840
3841 - `type: "client_secret_post"`
3842
3843 - `"client_secret_post"`
3844
3845 - `resource: optional string or null`
3846
3847 OAuth resource indicator.
3848
3849 - `scope: optional string or null`
3850
3851 OAuth scope for the refresh request.
3852
3853### Beta Managed Agents MCP OAuth Refresh Update Params
3854
3855- `BetaManagedAgentsMCPOAuthRefreshUpdateParams object { refresh_token, scope, token_endpoint_auth }`
3856
3857 Parameters for updating OAuth refresh token configuration.
3858
3859 - `refresh_token: optional string or null`
3860
3861 Updated OAuth refresh token.
3862
3863 - `scope: optional string or null`
3864
3865 Updated OAuth scope for the refresh request.
3866
3867 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`
3868
3869 Updated HTTP Basic authentication parameters for the token endpoint.
3870
3871 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`
3872
3873 Updated HTTP Basic authentication parameters for the token endpoint.
3874
3875 - `type: "client_secret_basic"`
3876
3877 - `"client_secret_basic"`
3878
3879 - `client_secret: optional string or null`
3880
3881 Updated OAuth client secret.
3882
3883 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`
3884
3885 Updated POST body authentication parameters for the token endpoint.
3886
3887 - `type: "client_secret_post"`
3888
3889 - `"client_secret_post"`
3890
3891 - `client_secret: optional string or null`
3892
3893 Updated OAuth client secret.
3894
3895### Beta Managed Agents MCP OAuth Update Params
3896
3897- `BetaManagedAgentsMCPOAuthUpdateParams object { type, access_token, expires_at, refresh }`
3898
3899 Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.
3900
3901 - `type: "mcp_oauth"`
3902
3903 - `"mcp_oauth"`
3904
3905 - `access_token: optional string or null`
3906
3907 Updated OAuth access token.
3908
3909 - `expires_at: optional string or null`
3910
3911 A timestamp in RFC 3339 format
3912
3913 - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`
3914
3915 Parameters for updating OAuth refresh token configuration.
3916
3917 - `refresh_token: optional string or null`
3918
3919 Updated OAuth refresh token.
3920
3921 - `scope: optional string or null`
3922
3923 Updated OAuth scope for the refresh request.
3924
3925 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`
3926
3927 Updated HTTP Basic authentication parameters for the token endpoint.
3928
3929 - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`
3930
3931 Updated HTTP Basic authentication parameters for the token endpoint.
3932
3933 - `type: "client_secret_basic"`
3934
3935 - `"client_secret_basic"`
3936
3937 - `client_secret: optional string or null`
3938
3939 Updated OAuth client secret.
3940
3941 - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`
3942
3943 Updated POST body authentication parameters for the token endpoint.
3944
3945 - `type: "client_secret_post"`
3946
3947 - `"client_secret_post"`
3948
3949 - `client_secret: optional string or null`
3950
3951 Updated OAuth client secret.
3952
3953### Beta Managed Agents MCP Probe
3954
3955- `BetaManagedAgentsMCPProbe object { http_response, method }`
3956
3957 The failing step of an MCP validation probe.
3958
3959 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
3960
3961 An HTTP response captured during a credential validation probe.
3962
3963 - `body: string`
3964
3965 Response body. May be truncated and has sensitive values scrubbed.
3966
3967 - `body_truncated: boolean`
3968
3969 Whether `body` was truncated.
3970
3971 - `content_type: string`
3972
3973 Value of the `Content-Type` response header.
3974
3975 - `status_code: number`
3976
3977 HTTP status code.
3978
3979 - `method: string`
3980
3981 The MCP method that failed (for example `initialize` or `tools/list`).
3982
3983### Beta Managed Agents Refresh HTTP Response
3984
3985- `BetaManagedAgentsRefreshHTTPResponse object { body, body_truncated, content_type, status_code }`
3986
3987 An HTTP response captured during a credential validation probe.
3988
3989 - `body: string`
3990
3991 Response body. May be truncated and has sensitive values scrubbed.
3992
3993 - `body_truncated: boolean`
3994
3995 Whether `body` was truncated.
3996
3997 - `content_type: string`
3998
3999 Value of the `Content-Type` response header.
4000
4001 - `status_code: number`
4002
4003 HTTP status code.
4004
4005### Beta Managed Agents Refresh Object
4006
4007- `BetaManagedAgentsRefreshObject object { http_response, status }`
4008
4009 Outcome of a refresh-token exchange attempted during credential validation.
4010
4011 - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`
4012
4013 An HTTP response captured during a credential validation probe.
4014
4015 - `body: string`
4016
4017 Response body. May be truncated and has sensitive values scrubbed.
4018
4019 - `body_truncated: boolean`
4020
4021 Whether `body` was truncated.
4022
4023 - `content_type: string`
4024
4025 Value of the `Content-Type` response header.
4026
4027 - `status_code: number`
4028
4029 HTTP status code.
4030
4031 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`
4032
4033 Outcome of a refresh-token exchange attempted during credential validation.
4034
4035 - `"succeeded"`
4036
4037 - `"failed"`
4038
4039 - `"connect_error"`
4040
4041 - `"no_refresh_token"`
4042
4043### Beta Managed Agents Static Bearer Auth Response
4044
4045- `BetaManagedAgentsStaticBearerAuthResponse object { mcp_server_url, type }`
4046
4047 Static bearer token credential details for an MCP server.
4048
4049 - `mcp_server_url: string`
4050
4051 URL of the MCP server this credential authenticates against.
4052
4053 - `type: "static_bearer"`
4054
4055 - `"static_bearer"`
4056
4057### Beta Managed Agents Static Bearer Create Params
4058
4059- `BetaManagedAgentsStaticBearerCreateParams object { token, mcp_server_url, type }`
4060
4061 Parameters for creating a static bearer token credential.
4062
4063 - `token: string`
4064
4065 Static bearer token value.
4066
4067 - `mcp_server_url: string`
4068
4069 URL of the MCP server this credential authenticates against.
4070
4071 - `type: "static_bearer"`
4072
4073 - `"static_bearer"`
4074
4075### Beta Managed Agents Static Bearer Update Params
4076
4077- `BetaManagedAgentsStaticBearerUpdateParams object { type, token }`
4078
4079 Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.
4080
4081 - `type: "static_bearer"`
4082
4083 - `"static_bearer"`
4084
4085 - `token: optional string or null`
4086
4087 Updated static bearer token value.
4088
4089### Beta Managed Agents Token Endpoint Auth Basic Param
4090
4091- `BetaManagedAgentsTokenEndpointAuthBasicParam object { client_secret, type }`
4092
4093 Token endpoint uses HTTP Basic authentication with client credentials.
4094
4095 - `client_secret: string`
4096
4097 OAuth client secret.
4098
4099 - `type: "client_secret_basic"`
4100
4101 - `"client_secret_basic"`
4102
4103### Beta Managed Agents Token Endpoint Auth Basic Response
4104
4105- `BetaManagedAgentsTokenEndpointAuthBasicResponse object { type }`
4106
4107 Token endpoint uses HTTP Basic authentication with client credentials.
4108
4109 - `type: "client_secret_basic"`
4110
4111 - `"client_secret_basic"`
4112
4113### Beta Managed Agents Token Endpoint Auth Basic Update Param
4114
4115- `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object { type, client_secret }`
4116
4117 Updated HTTP Basic authentication parameters for the token endpoint.
4118
4119 - `type: "client_secret_basic"`
4120
4121 - `"client_secret_basic"`
4122
4123 - `client_secret: optional string or null`
4124
4125 Updated OAuth client secret.
4126
4127### Beta Managed Agents Token Endpoint Auth None Param
4128
4129- `BetaManagedAgentsTokenEndpointAuthNoneParam object { type }`
4130
4131 Token endpoint requires no client authentication.
4132
4133 - `type: "none"`
4134
4135 - `"none"`
4136
4137### Beta Managed Agents Token Endpoint Auth None Response
4138
4139- `BetaManagedAgentsTokenEndpointAuthNoneResponse object { type }`
4140
4141 Token endpoint requires no client authentication.
4142
4143 - `type: "none"`
4144
4145 - `"none"`
4146
4147### Beta Managed Agents Token Endpoint Auth Post Param
4148
4149- `BetaManagedAgentsTokenEndpointAuthPostParam object { client_secret, type }`
4150
4151 Token endpoint uses POST body authentication with client credentials.
4152
4153 - `client_secret: string`
4154
4155 OAuth client secret.
4156
4157 - `type: "client_secret_post"`
4158
4159 - `"client_secret_post"`
4160
4161### Beta Managed Agents Token Endpoint Auth Post Response
4162
4163- `BetaManagedAgentsTokenEndpointAuthPostResponse object { type }`
4164
4165 Token endpoint uses POST body authentication with client credentials.
4166
4167 - `type: "client_secret_post"`
4168
4169 - `"client_secret_post"`
4170
4171### Beta Managed Agents Token Endpoint Auth Post Update Param
4172
4173- `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object { type, client_secret }`
4174
4175 Updated POST body authentication parameters for the token endpoint.
4176
4177 - `type: "client_secret_post"`
4178
4179 - `"client_secret_post"`
4180
4181 - `client_secret: optional string or null`
4182
4183 Updated OAuth client secret.
4184
4185### Beta Managed Agents Unrestricted Credential Networking Params
4186
4187- `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object { type }`
4188
4189 Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.
4190
4191 - `type: "unrestricted"`
4192
4193 - `"unrestricted"`
4194
4195### Beta Managed Agents Unrestricted Credential Networking Response
4196
4197- `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object { type }`
4198
4199 The secret is substituted on any host the session's Environment network policy permits egress to.
4200
4201 - `type: "unrestricted"`
4202
4203 - `"unrestricted"`
42043055
No line in this hunk matches that.