--- title: Vaults url: https://platform.claude.com/docs/en/api/cli/beta/vaults --- # Vaults ## Create a Vault `$ ant beta:vaults create` **POST** `/v1/vaults` Create a Vault ### Parameters - `--display-name: string` Human-readable name for the vault. 1-255 characters. minLength: 1, maxLength: 255 - `--metadata: optional map[string]` Arbitrary key-value metadata to attach to the vault. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_vault: object` A vault that stores credentials for use by agents during sessions. - `type: "vault"` - `id: string` The unique ID of the vault (`vlt_...`). - `archived_at: string` When the vault was archived. Null if not archived. format: date-time - `created_at: string` A timestamp in RFC 3339 format format: date-time - `display_name: string` Human-readable name for the vault. - `metadata: map[string]` Arbitrary key-value metadata attached to the vault. - `updated_at: string` A timestamp in RFC 3339 format format: date-time ### Example ```bash ant beta:vaults create \ --api-key my-anthropic-api-key \ --display-name 'Example vault' ``` #### Response (200) ```json { "id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "archived_at": null, "created_at": "2026-03-15T10:00:00Z", "display_name": "Example vault", "metadata": { "environment": "production" }, "type": "vault", "updated_at": "2026-03-15T10:00:00Z" } ``` ## List Vaults `$ ant beta:vaults list` **GET** `/v1/vaults` List Vaults ### Parameters - `--include-archived: optional boolean` (query parameter) Whether to include archived vaults in the results. Defaults to `false`. - `--limit: optional number` (query parameter) Maximum number of vaults to return per page. Defaults to 20, maximum 100. format: int32 - `--page: optional string` (query parameter) The `next_page` value from a previous [List Vaults](https://platform.claude.com/docs/en/api/beta/vaults/list?sdk_languages=cli) response, to get the next page. Leave it out to get the first page. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `BetaManagedAgentsListVaultsResponse: object` Response containing a paginated list of vaults. - `data: optional array of BetaManagedAgentsVault` The vaults on this page, newest first. - `type: "vault"` - `id: string` The unique ID of the vault (`vlt_...`). - `archived_at: string` When the vault was archived. Null if not archived. format: date-time - `created_at: string` A timestamp in RFC 3339 format format: date-time - `display_name: string` Human-readable name for the vault. - `metadata: map[string]` Arbitrary key-value metadata attached to the vault. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `next_page: optional string` Pagination token for the next page, or null if no more results. ### Example ```bash ant beta:vaults list \ --api-key my-anthropic-api-key ``` #### Response (200) ```json { "data": [ { "id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "archived_at": null, "created_at": "2026-03-15T10:00:00Z", "display_name": "Example vault", "metadata": { "environment": "production" }, "type": "vault", "updated_at": "2026-03-15T10:00:00Z" } ], "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo=" } ``` ## Retrieve a Vault `$ ant beta:vaults retrieve` **GET** `/v1/vaults/{vault_id}` Retrieve a Vault ### Parameters - `--vault-id: string` (path parameter) Unique identifier of the vault to retrieve. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_vault: object` A vault that stores credentials for use by agents during sessions. - `type: "vault"` - `id: string` The unique ID of the vault (`vlt_...`). - `archived_at: string` When the vault was archived. Null if not archived. format: date-time - `created_at: string` A timestamp in RFC 3339 format format: date-time - `display_name: string` Human-readable name for the vault. - `metadata: map[string]` Arbitrary key-value metadata attached to the vault. - `updated_at: string` A timestamp in RFC 3339 format format: date-time ### Example ```bash ant beta:vaults retrieve \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv ``` #### Response (200) ```json { "id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "archived_at": null, "created_at": "2026-03-15T10:00:00Z", "display_name": "Example vault", "metadata": { "environment": "production" }, "type": "vault", "updated_at": "2026-03-15T10:00:00Z" } ``` ## Update a Vault `$ ant beta:vaults update` **POST** `/v1/vaults/{vault_id}` Update a Vault ### Parameters - `--vault-id: string` (path parameter) Unique identifier of the vault to update. - `--display-name: optional string` Updated human-readable name for the vault. 1-255 characters. minLength: 1, maxLength: 255 - `--metadata: optional map[string]` Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_vault: object` A vault that stores credentials for use by agents during sessions. - `type: "vault"` - `id: string` The unique ID of the vault (`vlt_...`). - `archived_at: string` When the vault was archived. Null if not archived. format: date-time - `created_at: string` A timestamp in RFC 3339 format format: date-time - `display_name: string` Human-readable name for the vault. - `metadata: map[string]` Arbitrary key-value metadata attached to the vault. - `updated_at: string` A timestamp in RFC 3339 format format: date-time ### Example ```bash ant beta:vaults update \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv ``` #### Response (200) ```json { "id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "archived_at": null, "created_at": "2026-03-15T10:00:00Z", "display_name": "Example vault", "metadata": { "environment": "production" }, "type": "vault", "updated_at": "2026-03-15T10:00:00Z" } ``` ## Delete a Vault `$ ant beta:vaults delete` **DELETE** `/v1/vaults/{vault_id}` Delete a Vault ### Parameters - `--vault-id: string` (path parameter) Unique identifier of the vault to delete. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_deleted_vault: object` Confirmation of a deleted vault. - `type: "vault_deleted"` - `id: string` The unique ID of the deleted vault (`vlt_...`). ### Example ```bash ant beta:vaults delete \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv ``` #### Response (200) ```json { "id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "type": "vault_deleted" } ``` ## Archive a Vault `$ ant beta:vaults archive` **POST** `/v1/vaults/{vault_id}/archive` Archive a Vault ### Parameters - `--vault-id: string` (path parameter) Unique identifier of the vault to archive. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_vault: object` A vault that stores credentials for use by agents during sessions. - `type: "vault"` - `id: string` The unique ID of the vault (`vlt_...`). - `archived_at: string` When the vault was archived. Null if not archived. format: date-time - `created_at: string` A timestamp in RFC 3339 format format: date-time - `display_name: string` Human-readable name for the vault. - `metadata: map[string]` Arbitrary key-value metadata attached to the vault. - `updated_at: string` A timestamp in RFC 3339 format format: date-time ### Example ```bash ant beta:vaults archive \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv ``` #### Response (200) ```json { "id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "archived_at": null, "created_at": "2026-03-15T10:00:00Z", "display_name": "Example vault", "metadata": { "environment": "production" }, "type": "vault", "updated_at": "2026-03-15T10:00:00Z" } ``` ## Domain types ### Beta Managed Agents Deleted Vault - `beta_managed_agents_deleted_vault: object` Confirmation of a deleted vault. - `type: "vault_deleted"` - `id: string` The unique ID of the deleted vault (`vlt_...`). ### Beta Managed Agents Vault - `beta_managed_agents_vault: object` A vault that stores credentials for use by agents during sessions. - `type: "vault"` - `id: string` The unique ID of the vault (`vlt_...`). - `archived_at: string` When the vault was archived. Null if not archived. format: date-time - `created_at: string` A timestamp in RFC 3339 format format: date-time - `display_name: string` Human-readable name for the vault. - `metadata: map[string]` Arbitrary key-value metadata attached to the vault. - `updated_at: string` A timestamp in RFC 3339 format format: date-time ## Vaults › Credentials ### Create a Credential `$ ant beta:vaults:credentials create` **POST** `/v1/vaults/{vault_id}/credentials` Create a Credential #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault to create the credential in. - `--auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams` Authentication configuration for the credential. - `--display-name: optional string` Human-readable name for the credential. Up to 255 characters. maxLength: 255 - `--metadata: optional map[string]` Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. #### Example ```bash ant beta:vaults:credentials create \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --auth '{token: bearer_exampletoken, mcp_server_url: https://example-server.modelcontextprotocol.io/sse, type: static_bearer}' ``` ##### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ### List Credentials `$ ant beta:vaults:credentials list` **GET** `/v1/vaults/{vault_id}/credentials` List Credentials #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault to list credentials for. - `--include-archived: optional boolean` (query parameter) Whether to include archived credentials in the results. Defaults to `false`. - `--limit: optional number` (query parameter) Maximum number of credentials to return per page. Defaults to 20, maximum 100. format: int32 - `--page: optional string` (query parameter) The `next_page` value from a previous [List Credentials](https://platform.claude.com/docs/en/api/beta/vaults/credentials/list?sdk_languages=cli) response, to get the next page. Leave it out to get the first page. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `BetaManagedAgentsListCredentialsResponse: object` Response containing a paginated list of credentials. - `data: optional array of BetaManagedAgentsCredential` The credentials on this page, newest first. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. - `next_page: optional string` Pagination token for the next page, or null if no more results. #### Example ```bash ant beta:vaults:credentials list \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv ``` ##### Response (200) ```json { "data": [ { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ], "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo=" } ``` ### Retrieve a Credential `$ ant beta:vaults:credentials retrieve` **GET** `/v1/vaults/{vault_id}/credentials/{credential_id}` Retrieve a Credential #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to retrieve. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. #### Example ```bash ant beta:vaults:credentials retrieve \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` ##### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ### Update a Credential `$ ant beta:vaults:credentials update` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}` Update a Credential #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to update. - `--auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams` New authentication settings for the credential. The `type` must match the credential's current type, which can't be changed. - `--display-name: optional string` Updated human-readable name for the credential. 1-255 characters. minLength: 1, maxLength: 255 - `--metadata: optional map[string]` Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. #### Example ```bash ant beta:vaults:credentials update \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` ##### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ### Delete a Credential `$ ant beta:vaults:credentials delete` **DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}` Delete a Credential #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to delete. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `beta_managed_agents_deleted_credential: object` Confirmation of a deleted credential. - `type: "vault_credential_deleted"` - `id: string` The unique ID of the deleted credential (`vcrd_...`). #### Example ```bash ant beta:vaults:credentials delete \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` ##### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "type": "vault_credential_deleted" } ``` ### Archive a Credential `$ ant beta:vaults:credentials archive` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive` Archive a Credential #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to archive. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. #### Example ```bash ant beta:vaults:credentials archive \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` ##### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ### Validate an MCP OAuth Credential `$ ant beta:vaults:credentials mcp-oauth-validate` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate` Validate an MCP OAuth Credential #### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to validate. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. #### Returns - `beta_managed_agents_credential_validation: object` Result of live-probing a credential against its configured MCP server. - `type: "vault_credential_validation"` - `credential_id: string` Unique identifier of the credential that was validated. - `has_refresh_token: boolean` Whether the credential has a refresh token configured. - `mcp_probe: object` Details of the MCP probe step that failed, or `null` if the probe succeeded or there was no access token to test. - `http_response: object` The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `method: string` The MCP method that failed (for example `initialize` or `tools/list`). - `refresh: object` Details of the refresh-token exchange attempted on a 401. Null when no refresh was attempted. - `http_response: object` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"` Outcome of the refresh attempt. - `"succeeded"` The token endpoint returned a new access token. - `"failed"` The token endpoint returned an error response. See `http_response` for detail. - `"connect_error"` The token endpoint could not be reached (DNS, TLS, or connection error). - `"no_refresh_token"` No refresh token is stored for the credential, so no exchange was attempted. - `status: "valid" or "invalid" or "unknown"` Overall verdict of the validation probe. - `"valid"` The credential successfully authenticated against its MCP server. - `"invalid"` The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again. - `"unknown"` The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out. - `validated_at: string` When the validation probe was performed. format: date-time - `vault_id: string` Identifier of the vault containing the credential. #### Example ```bash ant beta:vaults:credentials mcp-oauth-validate \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` ##### Response (200) ```json { "credential_id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "has_refresh_token": true, "mcp_probe": { "http_response": { "body": "body", "body_truncated": true, "content_type": "content_type", "status_code": 0 }, "method": "method" }, "refresh": { "http_response": { "body": "body", "body_truncated": true, "content_type": "content_type", "status_code": 0 }, "status": "succeeded" }, "status": "valid", "type": "vault_credential_validation", "validated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv" } ```