--- title: Credentials url: https://platform.claude.com/docs/en/api/cli/beta/vaults/credentials --- # Credentials ## Create a Credential `$ ant beta:vaults:credentials create` **POST** `/v1/vaults/{vault_id}/credentials` Create a Credential ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault to create the credential in. - `--auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams` Authentication configuration for the credential. - `--display-name: optional string` Human-readable name for the credential. Up to 255 characters. maxLength: 255 - `--metadata: optional map[string]` Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. ### Example ```bash ant beta:vaults:credentials create \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --auth '{token: bearer_exampletoken, mcp_server_url: https://example-server.modelcontextprotocol.io/sse, type: static_bearer}' ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## List Credentials `$ ant beta:vaults:credentials list` **GET** `/v1/vaults/{vault_id}/credentials` List Credentials ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault to list credentials for. - `--include-archived: optional boolean` (query parameter) Whether to include archived credentials in the results. Defaults to `false`. - `--limit: optional number` (query parameter) Maximum number of credentials to return per page. Defaults to 20, maximum 100. format: int32 - `--page: optional string` (query parameter) The `next_page` value from a previous [List Credentials](https://platform.claude.com/docs/en/api/beta/vaults/credentials/list?sdk_languages=cli) response, to get the next page. Leave it out to get the first page. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `BetaManagedAgentsListCredentialsResponse: object` Response containing a paginated list of credentials. - `data: optional array of BetaManagedAgentsCredential` The credentials on this page, newest first. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. - `next_page: optional string` Pagination token for the next page, or null if no more results. ### Example ```bash ant beta:vaults:credentials list \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv ``` #### Response (200) ```json { "data": [ { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ], "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo=" } ``` ## Retrieve a Credential `$ ant beta:vaults:credentials retrieve` **GET** `/v1/vaults/{vault_id}/credentials/{credential_id}` Retrieve a Credential ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to retrieve. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. ### Example ```bash ant beta:vaults:credentials retrieve \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## Update a Credential `$ ant beta:vaults:credentials update` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}` Update a Credential ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to update. - `--auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams` New authentication settings for the credential. The `type` must match the credential's current type, which can't be changed. - `--display-name: optional string` Updated human-readable name for the credential. 1-255 characters. minLength: 1, maxLength: 255 - `--metadata: optional map[string]` Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. ### Example ```bash ant beta:vaults:credentials update \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## Delete a Credential `$ ant beta:vaults:credentials delete` **DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}` Delete a Credential ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to delete. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_deleted_credential: object` Confirmation of a deleted credential. - `type: "vault_credential_deleted"` - `id: string` The unique ID of the deleted credential (`vcrd_...`). ### Example ```bash ant beta:vaults:credentials delete \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "type": "vault_credential_deleted" } ``` ## Archive a Credential `$ ant beta:vaults:credentials archive` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive` Archive a Credential ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to archive. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. ### Example ```bash ant beta:vaults:credentials archive \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` #### Response (200) ```json { "id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "archived_at": null, "auth": { "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse", "type": "static_bearer" }, "created_at": "2026-03-15T10:00:00Z", "metadata": { "environment": "production" }, "type": "vault_credential", "updated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv", "display_name": "Example credential" } ``` ## Validate an MCP OAuth Credential `$ ant beta:vaults:credentials mcp-oauth-validate` **POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate` Validate an MCP OAuth Credential ### Parameters - `--vault-id: string` (path parameter) Identifier of the vault containing the credential. - `--credential-id: string` (path parameter) Unique identifier of the credential to validate. - `--beta: optional array of AnthropicBeta` (header parameter) This endpoint is in beta: requests must send `managed-agents-2026-04-01` in this header. - `--workspace-id: optional string` (header parameter) Optional header to select the Workspace for this request. The value is a Workspace ID (for example, `wrkspc_011CZkZaBF1tNoB5wlCeusgy`). Only needed for credentials that can act on more than one Workspace. A credential that belongs to a specific Workspace may omit it; if sent, it must match that Workspace. ### Returns - `beta_managed_agents_credential_validation: object` Result of live-probing a credential against its configured MCP server. - `type: "vault_credential_validation"` - `credential_id: string` Unique identifier of the credential that was validated. - `has_refresh_token: boolean` Whether the credential has a refresh token configured. - `mcp_probe: object` Details of the MCP probe step that failed, or `null` if the probe succeeded or there was no access token to test. - `http_response: object` The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `method: string` The MCP method that failed (for example `initialize` or `tools/list`). - `refresh: object` Details of the refresh-token exchange attempted on a 401. Null when no refresh was attempted. - `http_response: object` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"` Outcome of the refresh attempt. - `"succeeded"` The token endpoint returned a new access token. - `"failed"` The token endpoint returned an error response. See `http_response` for detail. - `"connect_error"` The token endpoint could not be reached (DNS, TLS, or connection error). - `"no_refresh_token"` No refresh token is stored for the credential, so no exchange was attempted. - `status: "valid" or "invalid" or "unknown"` Overall verdict of the validation probe. - `"valid"` The credential successfully authenticated against its MCP server. - `"invalid"` The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again. - `"unknown"` The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out. - `validated_at: string` When the validation probe was performed. format: date-time - `vault_id: string` Identifier of the vault containing the credential. ### Example ```bash ant beta:vaults:credentials mcp-oauth-validate \ --api-key my-anthropic-api-key \ --vault-id vlt_011CZkZDLs7fYzm1hXNPeRjv \ --credential-id vcrd_011CZkZEMt8gZan2iYPQfSkw ``` #### Response (200) ```json { "credential_id": "vcrd_011CZkZEMt8gZan2iYPQfSkw", "has_refresh_token": true, "mcp_probe": { "http_response": { "body": "body", "body_truncated": true, "content_type": "content_type", "status_code": 0 }, "method": "method" }, "refresh": { "http_response": { "body": "body", "body_truncated": true, "content_type": "content_type", "status_code": 0 }, "status": "succeeded" }, "status": "valid", "type": "vault_credential_validation", "validated_at": "2026-03-15T10:00:00Z", "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv" } ``` ## Domain types ### Beta Managed Agents Credential - `beta_managed_agents_credential: object` A credential stored in a vault. Sensitive fields are never returned in responses. - `type: "vault_credential"` - `id: string` The unique ID of the credential (`vcrd_...`). - `archived_at: string` When the credential was archived. Null if not archived. format: date-time - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse` Authentication configuration for this credential. - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. - `created_at: string` A timestamp in RFC 3339 format format: date-time - `metadata: map[string]` Arbitrary key-value metadata attached to the credential. - `updated_at: string` A timestamp in RFC 3339 format format: date-time - `vault_id: string` Identifier of the vault this credential belongs to. - `display_name: optional string` Human-readable name for the credential. ### Beta Managed Agents Credential Networking Params - `beta_managed_agents_credential_networking_params: BetaManagedAgentsUnrestrictedCredentialNetworkingParams or BetaManagedAgentsLimitedCredentialNetworkingParams` - `beta_managed_agents_unrestricted_credential_networking_params: object` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_params: object` Substitute the secret only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries. ### Beta Managed Agents Credential Validation - `beta_managed_agents_credential_validation: object` Result of live-probing a credential against its configured MCP server. - `type: "vault_credential_validation"` - `credential_id: string` Unique identifier of the credential that was validated. - `has_refresh_token: boolean` Whether the credential has a refresh token configured. - `mcp_probe: object` Details of the MCP probe step that failed, or `null` if the probe succeeded or there was no access token to test. - `http_response: object` The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `method: string` The MCP method that failed (for example `initialize` or `tools/list`). - `refresh: object` Details of the refresh-token exchange attempted on a 401. Null when no refresh was attempted. - `http_response: object` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"` Outcome of the refresh attempt. - `"succeeded"` The token endpoint returned a new access token. - `"failed"` The token endpoint returned an error response. See `http_response` for detail. - `"connect_error"` The token endpoint could not be reached (DNS, TLS, or connection error). - `"no_refresh_token"` No refresh token is stored for the credential, so no exchange was attempted. - `status: "valid" or "invalid" or "unknown"` Overall verdict of the validation probe. - `"valid"` The credential successfully authenticated against its MCP server. - `"invalid"` The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again. - `"unknown"` The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out. - `validated_at: string` When the validation probe was performed. format: date-time - `vault_id: string` Identifier of the vault containing the credential. ### Beta Managed Agents Credential Validation Status - `beta_managed_agents_credential_validation_status: "valid" or "invalid" or "unknown"` Overall verdict of a credential validation probe. - `"valid"` The credential successfully authenticated against its MCP server. - `"invalid"` The probe reached the MCP server and the server rejected the credential, or no access token is stored. A refresh, if one was tried, didn't recover it. Usually the end user needs to authorize again. - `"unknown"` The probe couldn't tell whether the credential works, for example because of a network error or because a refresh succeeded but the new access token wasn't tested. Validate the credential again to find out. ### Beta Managed Agents Deleted Credential - `beta_managed_agents_deleted_credential: object` Confirmation of a deleted credential. - `type: "vault_credential_deleted"` - `id: string` The unique ID of the deleted credential (`vcrd_...`). ### Beta Managed Agents Environment Variable Auth Response - `beta_managed_agents_environment_variable_auth_response: object` Environment variable credential details. The secret value is never returned. - `type: "environment_variable"` - `injection_location: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. - `secret_name: string` Name of the environment variable. ### Beta Managed Agents Environment Variable Create Params - `beta_managed_agents_environment_variable_create_params: object` Parameters for creating an environment variable credential. - `type: "environment_variable"` - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingParams or BetaManagedAgentsLimitedCredentialNetworkingParams` Outbound hosts the secret value is substituted on. - `beta_managed_agents_unrestricted_credential_networking_params: object` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_params: object` Substitute the secret only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries. - `secret_name: string` Name of the environment variable. Immutable after create. minLength: 1, maxLength: 255 - `secret_value: string` The secret to substitute into the agent's outbound requests. It's write-only and never returned in responses. minLength: 1, maxLength: 4096 - `injection_location: optional object` Where in the outbound request the secret value may be substituted. - `body: optional boolean` Substitute when the placeholder appears in the request body. - `header: optional boolean` Substitute when the placeholder appears in a request header value. ### Beta Managed Agents Environment Variable Update Params - `beta_managed_agents_environment_variable_update_params: object` Parameters for updating an environment variable credential. `secret_name` is immutable. - `type: "environment_variable"` - `injection_location: optional object` Updated injection location. - `body: optional boolean` Substitute when the placeholder appears in the request body. - `header: optional boolean` Substitute when the placeholder appears in a request header value. - `networking: optional BetaManagedAgentsUnrestrictedCredentialNetworkingParams or BetaManagedAgentsLimitedCredentialNetworkingParams` The new networking scope, which replaces the stored one as a whole. - `beta_managed_agents_unrestricted_credential_networking_params: object` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: "unrestricted"` - `beta_managed_agents_limited_credential_networking_params: object` Substitute the secret only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries. - `secret_value: optional string` The new secret value to replace the stored one. minLength: 1, maxLength: 4096 ### Beta Managed Agents Injection Location Params - `beta_managed_agents_injection_location_params: object` Where in the outbound request the secret value may be substituted. - `body: optional boolean` Substitute when the placeholder appears in the request body. - `header: optional boolean` Substitute when the placeholder appears in a request header value. ### Beta Managed Agents Injection Location Response - `beta_managed_agents_injection_location_response: object` Where in the outbound request the secret value is substituted. - `body: boolean` Whether the placeholder is substituted in the request body. - `header: boolean` Whether the placeholder is substituted in request header values. ### Beta Managed Agents Injection Location Update Params - `beta_managed_agents_injection_location_update_params: object` Changes which parts of an outbound request the secret is substituted into. A location you leave out keeps its current setting. After the change, at least one location must be enabled. See [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults?sdk_languages=cli#add-a-credential) to learn more about injection locations. - `body: optional boolean` Substitute when the placeholder appears in the request body. - `header: optional boolean` Substitute when the placeholder appears in a request header value. ### Beta Managed Agents Limited Credential Networking Params - `beta_managed_agents_limited_credential_networking_params: object` Substitute the secret only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.` wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses aren't accepted. The list can have up to 16 entries. ### Beta Managed Agents Limited Credential Networking Response - `beta_managed_agents_limited_credential_networking_response: object` The secret is substituted only on requests to the listed hosts. - `type: "limited"` - `allowed_hosts: array of string` The destination hosts of the outbound requests that the credential's secret is substituted into. An entry matches the request host exactly. An entry such as `*.example.com` matches any subdomain of `example.com` but not `example.com` itself. ### Beta Managed Agents MCP OAuth Auth Response - `beta_managed_agents_mcp_oauth_auth_response: object` OAuth credential details for an MCP server. - `type: "mcp_oauth"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Absent if the expiry isn't known. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. ### Beta Managed Agents MCP OAuth Create Params - `beta_managed_agents_mcp_oauth_create_params: object` Parameters for creating an MCP OAuth credential. - `type: "mcp_oauth"` - `access_token: string` The OAuth access token to send to the MCP server. minLength: 1, maxLength: 8192 - `mcp_server_url: string` URL of the MCP server this credential authenticates against. minLength: 1, maxLength: 2047 - `expires_at: optional string` When `access_token` expires, in RFC 3339. Must be in the future. format: date-time - `refresh: optional object` Refresh token configuration, if the credential supports token refresh. - `client_id: string` The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created. minLength: 1, maxLength: 1024 - `refresh_token: string` The OAuth refresh token that the API uses to get a new access token when the current one expires. minLength: 1, maxLength: 8192 - `token_endpoint: string` Token endpoint URL used to refresh the access token. minLength: 1, maxLength: 2047 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam` - `beta_managed_agents_token_endpoint_auth_none_param: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_param: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `client_secret: string` The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication. minLength: 1, maxLength: 512 - `beta_managed_agents_token_endpoint_auth_post_param: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `client_secret: string` The OAuth client secret, sent to `token_endpoint` in the POST body. minLength: 1, maxLength: 512 - `resource: optional string` OAuth resource indicator. minLength: 1, maxLength: 2047 - `scope: optional string` OAuth scope for the refresh request. minLength: 1, maxLength: 8192 ### Beta Managed Agents MCP OAuth Refresh Params - `beta_managed_agents_mcp_oauth_refresh_params: object` OAuth refresh token parameters for creating a credential with refresh support. - `client_id: string` The OAuth client ID to use when refreshing the access token. It can't be changed after the credential is created. minLength: 1, maxLength: 1024 - `refresh_token: string` The OAuth refresh token that the API uses to get a new access token when the current one expires. minLength: 1, maxLength: 8192 - `token_endpoint: string` Token endpoint URL used to refresh the access token. minLength: 1, maxLength: 2047 - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam` - `beta_managed_agents_token_endpoint_auth_none_param: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_param: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `client_secret: string` The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication. minLength: 1, maxLength: 512 - `beta_managed_agents_token_endpoint_auth_post_param: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `client_secret: string` The OAuth client secret, sent to `token_endpoint` in the POST body. minLength: 1, maxLength: 512 - `resource: optional string` OAuth resource indicator. minLength: 1, maxLength: 2047 - `scope: optional string` OAuth scope for the refresh request. minLength: 1, maxLength: 8192 ### Beta Managed Agents MCP OAuth Refresh Response - `beta_managed_agents_mcp_oauth_refresh_response: object` OAuth refresh token configuration returned in credential responses. - `client_id: string` The OAuth client ID used when refreshing the access token. - `token_endpoint: string` Token endpoint URL used to refresh the access token. - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse` - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `resource: optional string` OAuth resource indicator. - `scope: optional string` OAuth scope for the refresh request. ### Beta Managed Agents MCP OAuth Refresh Update Params - `beta_managed_agents_mcp_oauth_refresh_update_params: object` Parameters for updating OAuth refresh token configuration. - `refresh_token: optional string` The new OAuth refresh token to replace the stored one. minLength: 1, maxLength: 8192 - `scope: optional string` The new OAuth scope for refresh requests. Send an empty string to clear the stored scope. maxLength: 8192 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam` - `beta_managed_agents_token_endpoint_auth_basic_update_param: object` Updated HTTP Basic authentication parameters for the token endpoint. - `type: "client_secret_basic"` - `client_secret: optional string` A new OAuth client secret to replace the stored one. The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one. minLength: 1, maxLength: 512 - `beta_managed_agents_token_endpoint_auth_post_update_param: object` Updated POST body authentication parameters for the token endpoint. - `type: "client_secret_post"` - `client_secret: optional string` A new OAuth client secret to replace the stored one. The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one. minLength: 1, maxLength: 512 ### Beta Managed Agents MCP OAuth Update Params - `beta_managed_agents_mcp_oauth_update_params: object` Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable. - `type: "mcp_oauth"` - `access_token: optional string` The new OAuth access token to replace the stored one. minLength: 1, maxLength: 8192 - `expires_at: optional string` When the credential's access token expires, in RFC 3339. Leave it out to keep the stored expiry. If you send a new `access_token`, send its `expires_at` too, or the new token keeps the old expiry. Must be in the future. format: date-time - `refresh: optional object` Updated refresh token configuration. - `refresh_token: optional string` The new OAuth refresh token to replace the stored one. minLength: 1, maxLength: 8192 - `scope: optional string` The new OAuth scope for refresh requests. Send an empty string to clear the stored scope. maxLength: 8192 - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam` - `beta_managed_agents_token_endpoint_auth_basic_update_param: object` Updated HTTP Basic authentication parameters for the token endpoint. - `type: "client_secret_basic"` - `client_secret: optional string` A new OAuth client secret to replace the stored one. The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one. minLength: 1, maxLength: 512 - `beta_managed_agents_token_endpoint_auth_post_update_param: object` Updated POST body authentication parameters for the token endpoint. - `type: "client_secret_post"` - `client_secret: optional string` A new OAuth client secret to replace the stored one. The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one. minLength: 1, maxLength: 512 ### Beta Managed Agents MCP Probe - `beta_managed_agents_mcp_probe: object` The failing step of an MCP validation probe. - `http_response: object` The HTTP error response from the MCP server, or `null` if the MCP server didn't return one for the failing step, for example after a timeout or a DNS or TLS failure. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `method: string` The MCP method that failed (for example `initialize` or `tools/list`). ### Beta Managed Agents Refresh HTTP Response - `beta_managed_agents_refresh_http_response: object` An HTTP response captured during a credential validation probe. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 ### Beta Managed Agents Refresh Object - `beta_managed_agents_refresh_object: object` Outcome of a refresh-token exchange attempted during credential validation. - `http_response: object` The captured HTTP error response from the token endpoint. Populated only when `status` is `failed`. - `body: string` Response body. May be truncated and has sensitive values scrubbed. - `body_truncated: boolean` Whether `body` was truncated. - `content_type: string` Value of the `Content-Type` response header. - `status_code: number` HTTP status code. format: int32 - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"` Outcome of the refresh attempt. - `"succeeded"` The token endpoint returned a new access token. - `"failed"` The token endpoint returned an error response. See `http_response` for detail. - `"connect_error"` The token endpoint could not be reached (DNS, TLS, or connection error). - `"no_refresh_token"` No refresh token is stored for the credential, so no exchange was attempted. ### Beta Managed Agents Static Bearer Auth Response - `beta_managed_agents_static_bearer_auth_response: object` Static bearer token credential details for an MCP server. - `type: "static_bearer"` - `mcp_server_url: string` URL of the MCP server this credential authenticates against. ### Beta Managed Agents Static Bearer Create Params - `beta_managed_agents_static_bearer_create_params: object` Parameters for creating a static bearer token credential. - `type: "static_bearer"` - `token: string` The static bearer token to send to the MCP server, such as an API key or personal access token. minLength: 1, maxLength: 8192 - `mcp_server_url: string` URL of the MCP server this credential authenticates against. minLength: 1, maxLength: 2047 ### Beta Managed Agents Static Bearer Update Params - `beta_managed_agents_static_bearer_update_params: object` Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable. - `type: "static_bearer"` - `token: optional string` The new static bearer token to replace the stored one. minLength: 1, maxLength: 8192 ### Beta Managed Agents Token Endpoint Auth Basic Param - `beta_managed_agents_token_endpoint_auth_basic_param: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` - `client_secret: string` The OAuth client secret, sent to `token_endpoint` with HTTP Basic authentication. minLength: 1, maxLength: 512 ### Beta Managed Agents Token Endpoint Auth Basic Response - `beta_managed_agents_token_endpoint_auth_basic_response: object` Token endpoint uses HTTP Basic authentication with client credentials. - `type: "client_secret_basic"` ### Beta Managed Agents Token Endpoint Auth Basic Update Param - `beta_managed_agents_token_endpoint_auth_basic_update_param: object` Updated HTTP Basic authentication parameters for the token endpoint. - `type: "client_secret_basic"` - `client_secret: optional string` A new OAuth client secret to replace the stored one. The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one. minLength: 1, maxLength: 512 ### Beta Managed Agents Token Endpoint Auth None Param - `beta_managed_agents_token_endpoint_auth_none_param: object` Token endpoint requires no client authentication. - `type: "none"` ### Beta Managed Agents Token Endpoint Auth None Response - `beta_managed_agents_token_endpoint_auth_none_response: object` Token endpoint requires no client authentication. - `type: "none"` ### Beta Managed Agents Token Endpoint Auth Post Param - `beta_managed_agents_token_endpoint_auth_post_param: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` - `client_secret: string` The OAuth client secret, sent to `token_endpoint` in the POST body. minLength: 1, maxLength: 512 ### Beta Managed Agents Token Endpoint Auth Post Response - `beta_managed_agents_token_endpoint_auth_post_response: object` Token endpoint uses POST body authentication with client credentials. - `type: "client_secret_post"` ### Beta Managed Agents Token Endpoint Auth Post Update Param - `beta_managed_agents_token_endpoint_auth_post_update_param: object` Updated POST body authentication parameters for the token endpoint. - `type: "client_secret_post"` - `client_secret: optional string` A new OAuth client secret to replace the stored one. The credential must already use `client_secret_basic` or `client_secret_post`. It keeps its current `token_endpoint_auth` type, even if the `type` sent with this secret is the other one. minLength: 1, maxLength: 512 ### Beta Managed Agents Unrestricted Credential Networking Params - `beta_managed_agents_unrestricted_credential_networking_params: object` Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach. - `type: "unrestricted"` ### Beta Managed Agents Unrestricted Credential Networking Response - `beta_managed_agents_unrestricted_credential_networking_response: object` The secret is substituted on any host the session's Environment network policy permits egress to. - `type: "unrestricted"`