Sweep 22 Sep 2026 · 17:19Z Build v2.1.280 501 read Stable v2.1.267 Latest v2.1.280 Next v2.1.280 Feeds RSS JSON llms.txt Unofficial
One change · api

Credentials changed

api/beta/vaults/credentials

Nearest release: v2.1.268, published under an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here
Lines+696added
Lines−663removed
From line 1 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits9to this page, all time

The whole hunk

from line 1, old and new numbered
/
lines
from line 1
1---
2title: Credentials
3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials
4---
5 
16# Credentials
27 
38## Create Credential
from line 23
1823 
1924 - `string`
2025 
21 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
26 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
2227 
2328 - `"message-batches-2024-09-24"`
2429 
from line 71
6671 
6772 - `"user-profiles-2026-08-18"`
6873 
74 - `"user-profiles-2026-09-04"`
75 
6976 - `"advisor-tool-2026-03-01"`
7077 
7178 - `"managed-agents-2026-04-01"`
from line 115
108115 
109116 - `"mid-conversation-system-clear-at-2026-08-21"`
110117 
118- `"anthropic-workspace-id": optional string`
119 
111120### Body parameters
112121 
113122- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`
from line 127
118127 
119128 Parameters for creating an MCP OAuth credential.
120129 
130 - `type: "mcp_oauth"`
131 
121132 - `access_token: string`
122133 
123134 OAuth access token.
from line 141
130141 
131142 minLength: 1, maxLength: 2047
132143 
133 - `type: "mcp_oauth"`
134 
135144 - `expires_at: optional string or null`
136145 
137146 A timestamp in RFC 3339 format
from line 161
152161 
153162 OAuth refresh token.
154163 
155 minLength: 1, maxLength: 4096
164 minLength: 1, maxLength: 8192
156165 
157166 - `token_endpoint: string`
158167 
from line 183
174183 
175184 Token endpoint uses HTTP Basic authentication with client credentials.
176185 
186 - `type: "client_secret_basic"`
187 
177188 - `client_secret: string`
178189 
179190 OAuth client secret.
from line 191
180191 
181192 minLength: 1, maxLength: 512
182193 
183 - `type: "client_secret_basic"`
184 
185194 - `BetaManagedAgentsTokenEndpointAuthPostParam object`
186195 
187196 Token endpoint uses POST body authentication with client credentials.
188197 
198 - `type: "client_secret_post"`
199 
189200 - `client_secret: string`
190201 
191202 OAuth client secret.
from line 203
192203 
193204 minLength: 1, maxLength: 512
194205 
195 - `type: "client_secret_post"`
196 
197206 - `resource: optional string or null`
198207 
199208 OAuth resource indicator.
from line 219
210219 
211220 Parameters for creating a static bearer token credential.
212221 
222 - `type: "static_bearer"`
223 
213224 - `token: string`
214225 
215226 Static bearer token value.
from line 233
222233 
223234 minLength: 1, maxLength: 2047
224235 
225 - `type: "static_bearer"`
226 
227236 - `BetaManagedAgentsEnvironmentVariableCreateParams object`
228237 
229238 Parameters for creating an environment variable credential.
230239 
240 - `type: "environment_variable"`
241 
231242 - `networking: BetaManagedAgentsCredentialNetworkingParams`
232243 
233244 Outbound hosts the secret value is substituted on.
from line 253
242253 
243254 Substitute the secret only on requests to the listed hosts.
244255 
256 - `type: "limited"`
257 
245258 - `allowed_hosts: array of string`
246259 
247260 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
248261 
249 - `type: "limited"`
250 
251262 - `secret_name: string`
252263 
253264 Name of the environment variable. Immutable after create.
from line 271
260271 
261272 minLength: 1, maxLength: 4096
262273 
263 - `type: "environment_variable"`
264 
265274 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`
266275 
267276 Where in the outbound request the secret value may be substituted.
from line 299
290299 
291300 A credential stored in a vault. Sensitive fields are never returned in responses.
292301 
302 - `type: "vault_credential"`
303 
293304 - `id: string`
294305 
295306 Unique identifier for the credential.
from line 319
308319 
309320 OAuth credential details for an MCP server.
310321 
322 - `type: "mcp_oauth"`
323 
311324 - `mcp_server_url: string`
312325 
313326 URL of the MCP server this credential authenticates against.
314327 
315 - `type: "mcp_oauth"`
316 
317328 - `expires_at: optional string or null`
318329 
319330 A timestamp in RFC 3339 format
from line 377
366377 
367378 Static bearer token credential details for an MCP server.
368379 
380 - `type: "static_bearer"`
381 
369382 - `mcp_server_url: string`
370383 
371384 URL of the MCP server this credential authenticates against.
372385 
373 - `type: "static_bearer"`
374 
375386 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
376387 
377388 Environment variable credential details. The secret value is never returned.
378389 
390 - `type: "environment_variable"`
391 
379392 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
380393 
381394 Where in the outbound request the secret value is substituted.
from line 415
402415 
403416 The secret is substituted only on requests to the listed hosts.
404417 
418 - `type: "limited"`
419 
405420 - `allowed_hosts: array of string`
406421 
407422 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
408423 
409 - `type: "limited"`
410 
411424 - `secret_name: string`
412425 
413426 Name of the environment variable.
414427 
415 - `type: "environment_variable"`
416 
417428 - `created_at: string`
418429 
419430 A timestamp in RFC 3339 format
from line 435
424435 
425436 Arbitrary key-value metadata attached to the credential.
426437 
427 - `type: "vault_credential"`
428 
429438 - `updated_at: string`
430439 
431440 A timestamp in RFC 3339 format
from line 525
516525 
517526 - `string`
518527 
519 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
528 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
520529 
521530 - `"message-batches-2024-09-24"`
522531 
from line 573
564573 
565574 - `"user-profiles-2026-08-18"`
566575 
576 - `"user-profiles-2026-09-04"`
577 
567578 - `"advisor-tool-2026-03-01"`
568579 
569580 - `"managed-agents-2026-04-01"`
from line 617
606617 
607618 - `"mid-conversation-system-clear-at-2026-08-21"`
608619 
620- `"anthropic-workspace-id": optional string`
621 
609622### Returns
610623 
611624- `data: optional array of BetaManagedAgentsCredential`
from line 625
612625 
613626 List of credentials.
614627 
628 - `type: "vault_credential"`
629 
615630 - `id: string`
616631 
617632 Unique identifier for the credential.
from line 645
630645 
631646 OAuth credential details for an MCP server.
632647 
648 - `type: "mcp_oauth"`
649 
633650 - `mcp_server_url: string`
634651 
635652 URL of the MCP server this credential authenticates against.
636653 
637 - `type: "mcp_oauth"`
638 
639654 - `expires_at: optional string or null`
640655 
641656 A timestamp in RFC 3339 format
from line 703
688703 
689704 Static bearer token credential details for an MCP server.
690705 
706 - `type: "static_bearer"`
707 
691708 - `mcp_server_url: string`
692709 
693710 URL of the MCP server this credential authenticates against.
694711 
695 - `type: "static_bearer"`
696 
697712 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
698713 
699714 Environment variable credential details. The secret value is never returned.
700715 
716 - `type: "environment_variable"`
717 
701718 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
702719 
703720 Where in the outbound request the secret value is substituted.
from line 741
724741 
725742 The secret is substituted only on requests to the listed hosts.
726743 
744 - `type: "limited"`
745 
727746 - `allowed_hosts: array of string`
728747 
729748 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
730749 
731 - `type: "limited"`
732 
733750 - `secret_name: string`
734751 
735752 Name of the environment variable.
736753 
737 - `type: "environment_variable"`
738 
739754 - `created_at: string`
740755 
741756 A timestamp in RFC 3339 format
from line 761
746761 
747762 Arbitrary key-value metadata attached to the credential.
748763 
749 - `type: "vault_credential"`
750 
751764 - `updated_at: string`
752765 
753766 A timestamp in RFC 3339 format
from line 834
821834 
822835 - `string`
823836 
824 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
837 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
825838 
826839 - `"message-batches-2024-09-24"`
827840 
from line 882
869882 
870883 - `"user-profiles-2026-08-18"`
871884 
885 - `"user-profiles-2026-09-04"`
886 
872887 - `"advisor-tool-2026-03-01"`
873888 
874889 - `"managed-agents-2026-04-01"`
from line 926
911926 
912927 - `"mid-conversation-system-clear-at-2026-08-21"`
913928 
929- `"anthropic-workspace-id": optional string`
930 
914931### Returns
915932 
916933- `BetaManagedAgentsCredential object`
from line 934
917934 
918935 A credential stored in a vault. Sensitive fields are never returned in responses.
919936 
937 - `type: "vault_credential"`
938 
920939 - `id: string`
921940 
922941 Unique identifier for the credential.
from line 954
935954 
936955 OAuth credential details for an MCP server.
937956 
957 - `type: "mcp_oauth"`
958 
938959 - `mcp_server_url: string`
939960 
940961 URL of the MCP server this credential authenticates against.
941962 
942 - `type: "mcp_oauth"`
943 
944963 - `expires_at: optional string or null`
945964 
946965 A timestamp in RFC 3339 format
from line 1012
9931012 
9941013 Static bearer token credential details for an MCP server.
9951014 
1015 - `type: "static_bearer"`
1016 
9961017 - `mcp_server_url: string`
9971018 
9981019 URL of the MCP server this credential authenticates against.
9991020 
1000 - `type: "static_bearer"`
1001 
10021021 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
10031022 
10041023 Environment variable credential details. The secret value is never returned.
10051024 
1025 - `type: "environment_variable"`
1026 
10061027 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
10071028 
10081029 Where in the outbound request the secret value is substituted.
from line 1050
10291050 
10301051 The secret is substituted only on requests to the listed hosts.
10311052 
1053 - `type: "limited"`
1054 
10321055 - `allowed_hosts: array of string`
10331056 
10341057 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
10351058 
1036 - `type: "limited"`
1037 
10381059 - `secret_name: string`
10391060 
10401061 Name of the environment variable.
10411062 
1042 - `type: "environment_variable"`
1043 
10441063 - `created_at: string`
10451064 
10461065 A timestamp in RFC 3339 format
from line 1070
10511070 
10521071 Arbitrary key-value metadata attached to the credential.
10531072 
1054 - `type: "vault_credential"`
1055 
10561073 - `updated_at: string`
10571074 
10581075 A timestamp in RFC 3339 format
from line 1134
11171134 
11181135 - `string`
11191136 
1120 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
1137 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
11211138 
11221139 - `"message-batches-2024-09-24"`
11231140 
from line 1182
11651182 
11661183 - `"user-profiles-2026-08-18"`
11671184 
1185 - `"user-profiles-2026-09-04"`
1186 
11681187 - `"advisor-tool-2026-03-01"`
11691188 
11701189 - `"managed-agents-2026-04-01"`
from line 1226
12071226 
12081227 - `"mid-conversation-system-clear-at-2026-08-21"`
12091228 
1229- `"anthropic-workspace-id": optional string`
1230 
12101231### Body parameters
12111232 
12121233- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`
from line 1260
12391260 
12401261 Updated OAuth refresh token.
12411262 
1242 minLength: 1, maxLength: 4096
1263 minLength: 1, maxLength: 8192
12431264 
12441265 - `scope: optional string or null`
12451266 
from line 1340
13191340 
13201341 Substitute the secret only on requests to the listed hosts.
13211342 
1343 - `type: "limited"`
1344 
13221345 - `allowed_hosts: array of string`
13231346 
13241347 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
13251348 
1326 - `type: "limited"`
1327 
13281349 - `secret_value: optional string or null`
13291350 
13301351 Updated secret value.
from line 1368
13471368 
13481369 A credential stored in a vault. Sensitive fields are never returned in responses.
13491370 
1371 - `type: "vault_credential"`
1372 
13501373 - `id: string`
13511374 
13521375 Unique identifier for the credential.
from line 1388
13651388 
13661389 OAuth credential details for an MCP server.
13671390 
1391 - `type: "mcp_oauth"`
1392 
13681393 - `mcp_server_url: string`
13691394 
13701395 URL of the MCP server this credential authenticates against.
13711396 
1372 - `type: "mcp_oauth"`
1373 
13741397 - `expires_at: optional string or null`
13751398 
13761399 A timestamp in RFC 3339 format
from line 1446
14231446 
14241447 Static bearer token credential details for an MCP server.
14251448 
1449 - `type: "static_bearer"`
1450 
14261451 - `mcp_server_url: string`
14271452 
14281453 URL of the MCP server this credential authenticates against.
14291454 
1430 - `type: "static_bearer"`
1431 
14321455 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
14331456 
14341457 Environment variable credential details. The secret value is never returned.
14351458 
1459 - `type: "environment_variable"`
1460 
14361461 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
14371462 
14381463 Where in the outbound request the secret value is substituted.
from line 1484
14591484 
14601485 The secret is substituted only on requests to the listed hosts.
14611486 
1487 - `type: "limited"`
1488 
14621489 - `allowed_hosts: array of string`
14631490 
14641491 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
14651492 
1466 - `type: "limited"`
1467 
14681493 - `secret_name: string`
14691494 
14701495 Name of the environment variable.
14711496 
1472 - `type: "environment_variable"`
1473 
14741497 - `created_at: string`
14751498 
14761499 A timestamp in RFC 3339 format
from line 1504
14811504 
14821505 Arbitrary key-value metadata attached to the credential.
14831506 
1484 - `type: "vault_credential"`
1485 
14861507 - `updated_at: string`
14871508 
14881509 A timestamp in RFC 3339 format
from line 1575
15541575 
15551576 - `string`
15561577 
1557 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
1578 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
15581579 
15591580 - `"message-batches-2024-09-24"`
15601581 
from line 1623
16021623 
16031624 - `"user-profiles-2026-08-18"`
16041625 
1626 - `"user-profiles-2026-09-04"`
1627 
16051628 - `"advisor-tool-2026-03-01"`
16061629 
16071630 - `"managed-agents-2026-04-01"`
from line 1667
16441667 
16451668 - `"mid-conversation-system-clear-at-2026-08-21"`
16461669 
1670- `"anthropic-workspace-id": optional string`
1671 
16471672### Returns
16481673 
16491674- `BetaManagedAgentsDeletedCredential object`
from line 1675
16501675 
16511676 Confirmation of a deleted credential.
16521677 
1678 - `type: "vault_credential_deleted"`
1679 
16531680 - `id: string`
16541681 
16551682 Unique identifier of the deleted credential.
16561683 
1657 - `type: "vault_credential_deleted"`
1658 
16591684### Example
16601685 
16611686```bash
from line 1720
16951720 
16961721 - `string`
16971722 
1698 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
1723 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
16991724 
17001725 - `"message-batches-2024-09-24"`
17011726 
from line 1768
17431768 
17441769 - `"user-profiles-2026-08-18"`
17451770 
1771 - `"user-profiles-2026-09-04"`
1772 
17461773 - `"advisor-tool-2026-03-01"`
17471774 
17481775 - `"managed-agents-2026-04-01"`
from line 1812
17851812 
17861813 - `"mid-conversation-system-clear-at-2026-08-21"`
17871814 
1815- `"anthropic-workspace-id": optional string`
1816 
17881817### Returns
17891818 
17901819- `BetaManagedAgentsCredential object`
from line 1820
17911820 
17921821 A credential stored in a vault. Sensitive fields are never returned in responses.
17931822 
1823 - `type: "vault_credential"`
1824 
17941825 - `id: string`
17951826 
17961827 Unique identifier for the credential.
from line 1840
18091840 
18101841 OAuth credential details for an MCP server.
18111842 
1843 - `type: "mcp_oauth"`
1844 
18121845 - `mcp_server_url: string`
18131846 
18141847 URL of the MCP server this credential authenticates against.
18151848 
1816 - `type: "mcp_oauth"`
1817 
18181849 - `expires_at: optional string or null`
18191850 
18201851 A timestamp in RFC 3339 format
from line 1898
18671898 
18681899 Static bearer token credential details for an MCP server.
18691900 
1901 - `type: "static_bearer"`
1902 
18701903 - `mcp_server_url: string`
18711904 
18721905 URL of the MCP server this credential authenticates against.
18731906 
1874 - `type: "static_bearer"`
1875 
18761907 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
18771908 
18781909 Environment variable credential details. The secret value is never returned.
18791910 
1911 - `type: "environment_variable"`
1912 
18801913 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
18811914 
18821915 Where in the outbound request the secret value is substituted.
from line 1936
19031936 
19041937 The secret is substituted only on requests to the listed hosts.
19051938 
1939 - `type: "limited"`
1940 
19061941 - `allowed_hosts: array of string`
19071942 
19081943 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
19091944 
1910 - `type: "limited"`
1911 
19121945 - `secret_name: string`
19131946 
19141947 Name of the environment variable.
19151948 
1916 - `type: "environment_variable"`
1917 
19181949 - `created_at: string`
19191950 
19201951 A timestamp in RFC 3339 format
from line 1956
19251956 
19261957 Arbitrary key-value metadata attached to the credential.
19271958 
1928 - `type: "vault_credential"`
1929 
19301959 - `updated_at: string`
19311960 
19321961 A timestamp in RFC 3339 format
from line 2021
19922021 
19932022 - `string`
19942023 
1995 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
2024 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
19962025 
19972026 - `"message-batches-2024-09-24"`
19982027 
from line 2069
20402069 
20412070 - `"user-profiles-2026-08-18"`
20422071 
2072 - `"user-profiles-2026-09-04"`
2073 
20432074 - `"advisor-tool-2026-03-01"`
20442075 
20452076 - `"managed-agents-2026-04-01"`
from line 2113
20822113 
20832114 - `"mid-conversation-system-clear-at-2026-08-21"`
20842115 
2116- `"anthropic-workspace-id": optional string`
2117 
20852118### Returns
20862119 
20872120- `BetaManagedAgentsCredentialValidation object`
from line 2121
20882121 
20892122 Result of live-probing a credential against its configured MCP server.
20902123 
2124 - `type: "vault_credential_validation"`
2125 
20912126 - `credential_id: string`
20922127 
20932128 Unique identifier of the credential that was validated.
from line 2191
21562191 
21572192 - `"unknown"`
21582193 
2159 - `type: "vault_credential_validation"`
2160 
21612194 - `validated_at: string`
21622195 
21632196 A timestamp in RFC 3339 format
from line 2250
22172250 
22182251 A credential stored in a vault. Sensitive fields are never returned in responses.
22192252 
2253 - `type: "vault_credential"`
2254 
22202255 - `id: string`
22212256 
22222257 Unique identifier for the credential.
from line 2270
22352270 
22362271 OAuth credential details for an MCP server.
22372272 
2273 - `type: "mcp_oauth"`
2274 
22382275 - `mcp_server_url: string`
22392276 
22402277 URL of the MCP server this credential authenticates against.
22412278 
2242 - `type: "mcp_oauth"`
2243 
22442279 - `expires_at: optional string or null`
22452280 
22462281 A timestamp in RFC 3339 format
from line 2328
22932328 
22942329 Static bearer token credential details for an MCP server.
22952330 
2331 - `type: "static_bearer"`
2332 
22962333 - `mcp_server_url: string`
22972334 
22982335 URL of the MCP server this credential authenticates against.
22992336 
2300 - `type: "static_bearer"`
2301 
23022337 - `BetaManagedAgentsEnvironmentVariableAuthResponse object`
23032338 
23042339 Environment variable credential details. The secret value is never returned.
23052340 
2341 - `type: "environment_variable"`
2342 
23062343 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
23072344 
23082345 Where in the outbound request the secret value is substituted.
from line 2366
23292366 
23302367 The secret is substituted only on requests to the listed hosts.
23312368 
2369 - `type: "limited"`
2370 
23322371 - `allowed_hosts: array of string`
23332372 
23342373 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
23352374 
2336 - `type: "limited"`
2337 
23382375 - `secret_name: string`
23392376 
23402377 Name of the environment variable.
23412378 
2342 - `type: "environment_variable"`
2343 
23442379 - `created_at: string`
23452380 
23462381 A timestamp in RFC 3339 format
from line 2386
23512386 
23522387 Arbitrary key-value metadata attached to the credential.
23532388 
2354 - `type: "vault_credential"`
2355 
23562389 - `updated_at: string`
23572390 
23582391 A timestamp in RFC 3339 format
from line 2416
23832416 
23842417 Substitute the secret only on requests to the listed hosts.
23852418 
2419 - `type: "limited"`
2420 
23862421 - `allowed_hosts: array of string`
23872422 
23882423 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
23892424 
2390 - `type: "limited"`
2391 
23922425### Beta Managed Agents Credential Validation
23932426 
23942427- `BetaManagedAgentsCredentialValidation object`
from line 2428
23952428 
23962429 Result of live-probing a credential against its configured MCP server.
23972430 
2431 - `type: "vault_credential_validation"`
2432 
23982433 - `credential_id: string`
23992434 
24002435 Unique identifier of the credential that was validated.
from line 2498
24632498 
24642499 - `"unknown"`
24652500 
2466 - `type: "vault_credential_validation"`
2467 
24682501 - `validated_at: string`
24692502 
24702503 A timestamp in RFC 3339 format
from line 2526
24932526 
24942527 Confirmation of a deleted credential.
24952528 
2529 - `type: "vault_credential_deleted"`
2530 
24962531 - `id: string`
24972532 
24982533 Unique identifier of the deleted credential.
24992534 
2500 - `type: "vault_credential_deleted"`
2501 
25022535### Beta Managed Agents Environment Variable Auth Response
25032536 
25042537- `BetaManagedAgentsEnvironmentVariableAuthResponse object`
from line 2538
25052538 
25062539 Environment variable credential details. The secret value is never returned.
25072540 
2541 - `type: "environment_variable"`
2542 
25082543 - `injection_location: BetaManagedAgentsInjectionLocationResponse`
25092544 
25102545 Where in the outbound request the secret value is substituted.
from line 2566
25312566 
25322567 The secret is substituted only on requests to the listed hosts.
25332568 
2569 - `type: "limited"`
2570 
25342571 - `allowed_hosts: array of string`
25352572 
25362573 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
25372574 
2538 - `type: "limited"`
2539 
25402575 - `secret_name: string`
25412576 
25422577 Name of the environment variable.
25432578 
2544 - `type: "environment_variable"`
2545 
25462579### Beta Managed Agents Environment Variable Create Params
25472580 
25482581- `BetaManagedAgentsEnvironmentVariableCreateParams object`
from line 2582
25492582 
25502583 Parameters for creating an environment variable credential.
25512584 
2585 - `type: "environment_variable"`
2586 
25522587 - `networking: BetaManagedAgentsCredentialNetworkingParams`
25532588 
25542589 Outbound hosts the secret value is substituted on.
from line 2598
25632598 
25642599 Substitute the secret only on requests to the listed hosts.
25652600 
2601 - `type: "limited"`
2602 
25662603 - `allowed_hosts: array of string`
25672604 
25682605 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
25692606 
2570 - `type: "limited"`
2571 
25722607 - `secret_name: string`
25732608 
25742609 Name of the environment variable. Immutable after create.
from line 2616
25812616 
25822617 minLength: 1, maxLength: 4096
25832618 
2584 - `type: "environment_variable"`
2585 
25862619 - `injection_location: optional BetaManagedAgentsInjectionLocationParams`
25872620 
25882621 Where in the outbound request the secret value may be substituted.
from line 2662
26292662 
26302663 Substitute the secret only on requests to the listed hosts.
26312664 
2665 - `type: "limited"`
2666 
26322667 - `allowed_hosts: array of string`
26332668 
26342669 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
26352670 
2636 - `type: "limited"`
2637 
26382671 - `secret_value: optional string or null`
26392672 
26402673 Updated secret value.
from line 2722
26892722 
26902723 Substitute the secret only on requests to the listed hosts.
26912724 
2725 - `type: "limited"`
2726 
26922727 - `allowed_hosts: array of string`
26932728 
26942729 Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.
26952730 
2696 - `type: "limited"`
2697 
26982731### Beta Managed Agents Limited Credential Networking Response
26992732 
27002733- `BetaManagedAgentsLimitedCredentialNetworkingResponse object`
from line 2734
27012734 
27022735 The secret is substituted only on requests to the listed hosts.
27032736 
2737 - `type: "limited"`
2738 
27042739 - `allowed_hosts: array of string`
27052740 
27062741 Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.
27072742 
2708 - `type: "limited"`
2709 
27102743### Beta Managed Agents MCP OAuth Auth Response
27112744 
27122745- `BetaManagedAgentsMCPOAuthAuthResponse object`
from line 2746
27132746 
27142747 OAuth credential details for an MCP server.
27152748 
2749 - `type: "mcp_oauth"`
2750 
27162751 - `mcp_server_url: string`
27172752 
27182753 URL of the MCP server this credential authenticates against.
27192754 
2720 - `type: "mcp_oauth"`
2721 
27222755 - `expires_at: optional string or null`
27232756 
27242757 A timestamp in RFC 3339 format
from line 2806
27732806 
27742807 Parameters for creating an MCP OAuth credential.
27752808 
2809 - `type: "mcp_oauth"`
2810 
27762811 - `access_token: string`
27772812 
27782813 OAuth access token.
from line 2820
27852820 
27862821 minLength: 1, maxLength: 2047
27872822 
2788 - `type: "mcp_oauth"`
2789 
27902823 - `expires_at: optional string or null`
27912824 
27922825 A timestamp in RFC 3339 format
from line 2840
28072840 
28082841 OAuth refresh token.
28092842 
2810 minLength: 1, maxLength: 4096
2843 minLength: 1, maxLength: 8192
28112844 
28122845 - `token_endpoint: string`
28132846 
from line 2862
28292862 
28302863 Token endpoint uses HTTP Basic authentication with client credentials.
28312864 
2865 - `type: "client_secret_basic"`
2866 
28322867 - `client_secret: string`
28332868 
28342869 OAuth client secret.
from line 2870
28352870 
28362871 minLength: 1, maxLength: 512
28372872 
2838 - `type: "client_secret_basic"`
2839 
28402873 - `BetaManagedAgentsTokenEndpointAuthPostParam object`
28412874 
28422875 Token endpoint uses POST body authentication with client credentials.
28432876 
2877 - `type: "client_secret_post"`
2878 
28442879 - `client_secret: string`
28452880 
28462881 OAuth client secret.
from line 2882
28472882 
28482883 minLength: 1, maxLength: 512
28492884 
2850 - `type: "client_secret_post"`
2851 
28522885 - `resource: optional string or null`
28532886 
28542887 OAuth resource indicator.
from line 2910
28772910 
28782911 OAuth refresh token.
28792912 
2880 minLength: 1, maxLength: 4096
2913 minLength: 1, maxLength: 8192
28812914 
28822915 - `token_endpoint: string`
28832916 
from line 2932
28992932 
29002933 Token endpoint uses HTTP Basic authentication with client credentials.
29012934 
2935 - `type: "client_secret_basic"`
2936 
29022937 - `client_secret: string`
29032938 
29042939 OAuth client secret.
from line 2940
29052940 
29062941 minLength: 1, maxLength: 512
29072942 
2908 - `type: "client_secret_basic"`
2909 
29102943 - `BetaManagedAgentsTokenEndpointAuthPostParam object`
29112944 
29122945 Token endpoint uses POST body authentication with client credentials.
29132946 
2947 - `type: "client_secret_post"`
2948 
29142949 - `client_secret: string`
29152950 
29162951 OAuth client secret.
from line 2952
29172952 
29182953 minLength: 1, maxLength: 512
29192954 
2920 - `type: "client_secret_post"`
2921 
29222955 - `resource: optional string or null`
29232956 
29242957 OAuth resource indicator.
from line 3018
29853018 
29863019 Updated OAuth refresh token.
29873020 
2988 minLength: 1, maxLength: 4096
3021 minLength: 1, maxLength: 8192
29893022 
29903023 - `scope: optional string or null`
29913024 
from line 3082
30493082 
30503083 Updated OAuth refresh token.
30513084 
3052 minLength: 1, maxLength: 4096
3085 minLength: 1, maxLength: 8192
30533086 
30543087 - `scope: optional string or null`
30553088 
from line 3220
31873220 
31883221 Static bearer token credential details for an MCP server.
31893222 
3223 - `type: "static_bearer"`
3224 
31903225 - `mcp_server_url: string`
31913226 
31923227 URL of the MCP server this credential authenticates against.
31933228 
3194 - `type: "static_bearer"`
3195 
31963229### Beta Managed Agents Static Bearer Create Params
31973230 
31983231- `BetaManagedAgentsStaticBearerCreateParams object`
from line 3232
31993232 
32003233 Parameters for creating a static bearer token credential.
32013234 
3235 - `type: "static_bearer"`
3236 
32023237 - `token: string`
32033238 
32043239 Static bearer token value.
from line 3246
32113246 
32123247 minLength: 1, maxLength: 2047
32133248 
3214 - `type: "static_bearer"`
3215 
32163249### Beta Managed Agents Static Bearer Update Params
32173250 
32183251- `BetaManagedAgentsStaticBearerUpdateParams object`
from line 3266
32333266 
32343267 Token endpoint uses HTTP Basic authentication with client credentials.
32353268 
3269 - `type: "client_secret_basic"`
3270 
32363271 - `client_secret: string`
32373272 
32383273 OAuth client secret.
from line 3274
32393274 
32403275 minLength: 1, maxLength: 512
32413276 
3242 - `type: "client_secret_basic"`
3243 
32443277### Beta Managed Agents Token Endpoint Auth Basic Response
32453278 
32463279- `BetaManagedAgentsTokenEndpointAuthBasicResponse object`
from line 3318
32853318 
32863319 Token endpoint uses POST body authentication with client credentials.
32873320 
3321 - `type: "client_secret_post"`
3322 
32883323 - `client_secret: string`
32893324 
32903325 OAuth client secret.
32913326 
32923327 minLength: 1, maxLength: 512
3293 
3294 - `type: "client_secret_post"`
32953328 
32963329### Beta Managed Agents Token Endpoint Auth Post Response
32973330