spb/doc-api

1---2title: Credentials3url: https://platform.claude.com/docs/en/api/beta/vaults/credentials4---56# Credentials78## Create Credential910**POST** `/v1/vaults/{vault_id}/credentials`1112Create Credential1314### Path parameters1516- `vault_id: string`1718### Headers1920- `"anthropic-beta": optional array of AnthropicBeta`2122  Optional header to specify the beta version(s) you want to use.2324  - `string`2526  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`2728    - `"message-batches-2024-09-24"`2930    - `"prompt-caching-2024-07-31"`3132    - `"computer-use-2024-10-22"`3334    - `"computer-use-2025-01-24"`3536    - `"pdfs-2024-09-25"`3738    - `"token-counting-2024-11-01"`3940    - `"token-efficient-tools-2025-02-19"`4142    - `"output-128k-2025-02-19"`4344    - `"files-api-2025-04-14"`4546    - `"mcp-client-2025-04-04"`4748    - `"mcp-client-2025-11-20"`4950    - `"dev-full-thinking-2025-05-14"`5152    - `"interleaved-thinking-2025-05-14"`5354    - `"code-execution-2025-05-22"`5556    - `"extended-cache-ttl-2025-04-11"`5758    - `"context-1m-2025-08-07"`5960    - `"context-management-2025-06-27"`6162    - `"model-context-window-exceeded-2025-08-26"`6364    - `"skills-2025-10-02"`6566    - `"fast-mode-2026-02-01"`6768    - `"output-300k-2026-03-24"`6970    - `"user-profiles-2026-03-24"`7172    - `"user-profiles-2026-08-18"`7374    - `"user-profiles-2026-09-04"`7576    - `"advisor-tool-2026-03-01"`7778    - `"managed-agents-2026-04-01"`7980    - `"cache-diagnosis-2026-04-07"`8182    - `"dreaming-2026-04-21"`8384    - `"thinking-token-count-2026-05-13"`8586    - `"server-side-fallback-2026-06-01"`8788    - `"server-side-fallback-2026-07-01"`8990    - `"fallback-credit-2026-06-01"`9192    - `"fallback-credit-2026-07-01"`9394    - `"agent-memory-2026-07-22"`9596    - `"mid-conversation-tool-changes-2026-07-01"`9798    - `"compact-2026-01-12"`99100    - `"computer-use-2025-11-24"`101102    - `"mcp-tunnels-2026-06-22"`103104    - `"structured-outputs-2025-11-13"`105106    - `"task-budgets-2026-03-13"`107108    - `"thinking-display-updates-2026-08-18"`109110    - `"ce-user-management-2026-07-13"`111112    - `"mid-conversation-output-config-2026-07-01"`113114    - `"thinking-binding-controls-2026-08-01"`115116    - `"mid-conversation-system-clear-at-2026-08-21"`117118    - `"compact-2026-09-04"`119120- `"anthropic-workspace-id": optional string`121122### Body parameters123124- `auth: BetaManagedAgentsMCPOAuthCreateParams or BetaManagedAgentsStaticBearerCreateParams or BetaManagedAgentsEnvironmentVariableCreateParams`125126  Authentication details for creating a credential.127128  - `BetaManagedAgentsMCPOAuthCreateParams object`129130    Parameters for creating an MCP OAuth credential.131132    - `type: "mcp_oauth"`133134    - `access_token: string`135136      OAuth access token.137138      minLength: 1, maxLength: 8192139140    - `mcp_server_url: string`141142      URL of the MCP server this credential authenticates against.143144      minLength: 1, maxLength: 2047145146    - `expires_at: optional string or null`147148      A timestamp in RFC 3339 format149150      format: date-time151152    - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`153154      OAuth refresh token parameters for creating a credential with refresh support.155156      - `client_id: string`157158        OAuth client ID.159160        minLength: 1, maxLength: 1024161162      - `refresh_token: string`163164        OAuth refresh token.165166        minLength: 1, maxLength: 8192167168      - `token_endpoint: string`169170        Token endpoint URL used to refresh the access token.171172        minLength: 1, maxLength: 2047173174      - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`175176        - `BetaManagedAgentsTokenEndpointAuthNoneParam object`177178          Token endpoint requires no client authentication.179180          - `type: "none"`181182        - `BetaManagedAgentsTokenEndpointAuthBasicParam object`183184          Token endpoint uses HTTP Basic authentication with client credentials.185186          - `type: "client_secret_basic"`187188          - `client_secret: string`189190            OAuth client secret.191192            minLength: 1, maxLength: 512193194        - `BetaManagedAgentsTokenEndpointAuthPostParam object`195196          Token endpoint uses POST body authentication with client credentials.197198          - `type: "client_secret_post"`199200          - `client_secret: string`201202            OAuth client secret.203204            minLength: 1, maxLength: 512205206      - `resource: optional string or null`207208        OAuth resource indicator.209210        minLength: 1, maxLength: 2047211212      - `scope: optional string or null`213214        OAuth scope for the refresh request.215216        minLength: 1, maxLength: 8192217218  - `BetaManagedAgentsStaticBearerCreateParams object`219220    Parameters for creating a static bearer token credential.221222    - `type: "static_bearer"`223224    - `token: string`225226      Static bearer token value.227228      minLength: 1, maxLength: 8192229230    - `mcp_server_url: string`231232      URL of the MCP server this credential authenticates against.233234      minLength: 1, maxLength: 2047235236  - `BetaManagedAgentsEnvironmentVariableCreateParams object`237238    Parameters for creating an environment variable credential.239240    - `type: "environment_variable"`241242    - `networking: BetaManagedAgentsCredentialNetworkingParams`243244      Outbound hosts the secret value is substituted on.245246      - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`247248        Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.249250        - `type: "unrestricted"`251252      - `BetaManagedAgentsLimitedCredentialNetworkingParams object`253254        Substitute the secret only on requests to the listed hosts.255256        - `type: "limited"`257258        - `allowed_hosts: array of string`259260          Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.261262    - `secret_name: string`263264      Name of the environment variable. Immutable after create.265266      minLength: 1, maxLength: 255267268    - `secret_value: string`269270      Secret value. Write-only; never returned in responses.271272      minLength: 1, maxLength: 4096273274    - `injection_location: optional BetaManagedAgentsInjectionLocationParams`275276      Where in the outbound request the secret value may be substituted.277278      - `body: optional boolean`279280        Substitute when the placeholder appears in the request body.281282      - `header: optional boolean`283284        Substitute when the placeholder appears in a request header value.285286- `display_name: optional string or null`287288  Human-readable name for the credential. Up to 255 characters.289290  maxLength: 255291292- `metadata: optional map[string]`293294  Arbitrary key-value metadata to attach to the credential. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.295296### Returns297298- `BetaManagedAgentsCredential object`299300  A credential stored in a vault. Sensitive fields are never returned in responses.301302  - `type: "vault_credential"`303304  - `id: string`305306    Unique identifier for the credential.307308  - `archived_at: string or null`309310    A timestamp in RFC 3339 format311312    format: date-time313314  - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`315316    Authentication details for a credential.317318    - `BetaManagedAgentsMCPOAuthAuthResponse object`319320      OAuth credential details for an MCP server.321322      - `type: "mcp_oauth"`323324      - `mcp_server_url: string`325326        URL of the MCP server this credential authenticates against.327328      - `expires_at: optional string or null`329330        A timestamp in RFC 3339 format331332        format: date-time333334      - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`335336        OAuth refresh token configuration returned in credential responses.337338        - `client_id: string`339340          OAuth client ID.341342        - `token_endpoint: string`343344          Token endpoint URL used to refresh the access token.345346        - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`347348          - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`349350            Token endpoint requires no client authentication.351352            - `type: "none"`353354          - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`355356            Token endpoint uses HTTP Basic authentication with client credentials.357358            - `type: "client_secret_basic"`359360          - `BetaManagedAgentsTokenEndpointAuthPostResponse object`361362            Token endpoint uses POST body authentication with client credentials.363364            - `type: "client_secret_post"`365366        - `resource: optional string or null`367368          OAuth resource indicator.369370        - `scope: optional string or null`371372          OAuth scope for the refresh request.373374    - `BetaManagedAgentsStaticBearerAuthResponse object`375376      Static bearer token credential details for an MCP server.377378      - `type: "static_bearer"`379380      - `mcp_server_url: string`381382        URL of the MCP server this credential authenticates against.383384    - `BetaManagedAgentsEnvironmentVariableAuthResponse object`385386      Environment variable credential details. The secret value is never returned.387388      - `type: "environment_variable"`389390      - `injection_location: BetaManagedAgentsInjectionLocationResponse`391392        Where in the outbound request the secret value is substituted.393394        - `body: boolean`395396          Whether the placeholder is substituted in the request body.397398        - `header: boolean`399400          Whether the placeholder is substituted in request header values.401402      - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`403404        Outbound hosts the secret value is substituted on.405406        - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`407408          The secret is substituted on any host the session's Environment network policy permits egress to.409410          - `type: "unrestricted"`411412        - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`413414          The secret is substituted only on requests to the listed hosts.415416          - `type: "limited"`417418          - `allowed_hosts: array of string`419420            Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.421422      - `secret_name: string`423424        Name of the environment variable.425426  - `created_at: string`427428    A timestamp in RFC 3339 format429430    format: date-time431432  - `metadata: map[string]`433434    Arbitrary key-value metadata attached to the credential.435436  - `updated_at: string`437438    A timestamp in RFC 3339 format439440    format: date-time441442  - `vault_id: string`443444    Identifier of the vault this credential belongs to.445446  - `display_name: optional string or null`447448    Human-readable name for the credential.449450### Example451452```bash453curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \454    -H 'Content-Type: application/json' \455    -H 'anthropic-version: 2023-06-01' \456    -H 'anthropic-beta: managed-agents-2026-04-01' \457    -H "X-Api-Key: $ANTHROPIC_API_KEY" \458    -d '{459          "auth": {460            "token": "bearer_exampletoken",461            "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",462            "type": "static_bearer"463          },464          "display_name": "Example credential",465          "metadata": {466            "environment": "production"467          }468        }'469```470471#### Response (200)472473```json474{475  "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",476  "archived_at": null,477  "auth": {478    "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",479    "type": "static_bearer"480  },481  "created_at": "2026-03-15T10:00:00Z",482  "metadata": {483    "environment": "production"484  },485  "type": "vault_credential",486  "updated_at": "2026-03-15T10:00:00Z",487  "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",488  "display_name": "Example credential"489}490```491492## List Credentials493494**GET** `/v1/vaults/{vault_id}/credentials`495496List Credentials497498### Path parameters499500- `vault_id: string`501502### Query parameters503504- `include_archived: optional boolean`505506  Whether to include archived credentials in the results.507508- `limit: optional number`509510  Maximum number of credentials to return per page. Defaults to 20, maximum 100.511512  format: int32513514- `page: optional string`515516  Opaque pagination token from a previous `list_credentials` response.517518### Headers519520- `"anthropic-beta": optional array of AnthropicBeta`521522  Optional header to specify the beta version(s) you want to use.523524  - `string`525526  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`527528    - `"message-batches-2024-09-24"`529530    - `"prompt-caching-2024-07-31"`531532    - `"computer-use-2024-10-22"`533534    - `"computer-use-2025-01-24"`535536    - `"pdfs-2024-09-25"`537538    - `"token-counting-2024-11-01"`539540    - `"token-efficient-tools-2025-02-19"`541542    - `"output-128k-2025-02-19"`543544    - `"files-api-2025-04-14"`545546    - `"mcp-client-2025-04-04"`547548    - `"mcp-client-2025-11-20"`549550    - `"dev-full-thinking-2025-05-14"`551552    - `"interleaved-thinking-2025-05-14"`553554    - `"code-execution-2025-05-22"`555556    - `"extended-cache-ttl-2025-04-11"`557558    - `"context-1m-2025-08-07"`559560    - `"context-management-2025-06-27"`561562    - `"model-context-window-exceeded-2025-08-26"`563564    - `"skills-2025-10-02"`565566    - `"fast-mode-2026-02-01"`567568    - `"output-300k-2026-03-24"`569570    - `"user-profiles-2026-03-24"`571572    - `"user-profiles-2026-08-18"`573574    - `"user-profiles-2026-09-04"`575576    - `"advisor-tool-2026-03-01"`577578    - `"managed-agents-2026-04-01"`579580    - `"cache-diagnosis-2026-04-07"`581582    - `"dreaming-2026-04-21"`583584    - `"thinking-token-count-2026-05-13"`585586    - `"server-side-fallback-2026-06-01"`587588    - `"server-side-fallback-2026-07-01"`589590    - `"fallback-credit-2026-06-01"`591592    - `"fallback-credit-2026-07-01"`593594    - `"agent-memory-2026-07-22"`595596    - `"mid-conversation-tool-changes-2026-07-01"`597598    - `"compact-2026-01-12"`599600    - `"computer-use-2025-11-24"`601602    - `"mcp-tunnels-2026-06-22"`603604    - `"structured-outputs-2025-11-13"`605606    - `"task-budgets-2026-03-13"`607608    - `"thinking-display-updates-2026-08-18"`609610    - `"ce-user-management-2026-07-13"`611612    - `"mid-conversation-output-config-2026-07-01"`613614    - `"thinking-binding-controls-2026-08-01"`615616    - `"mid-conversation-system-clear-at-2026-08-21"`617618    - `"compact-2026-09-04"`619620- `"anthropic-workspace-id": optional string`621622### Returns623624- `data: optional array of BetaManagedAgentsCredential`625626  List of credentials.627628  - `type: "vault_credential"`629630  - `id: string`631632    Unique identifier for the credential.633634  - `archived_at: string or null`635636    A timestamp in RFC 3339 format637638    format: date-time639640  - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`641642    Authentication details for a credential.643644    - `BetaManagedAgentsMCPOAuthAuthResponse object`645646      OAuth credential details for an MCP server.647648      - `type: "mcp_oauth"`649650      - `mcp_server_url: string`651652        URL of the MCP server this credential authenticates against.653654      - `expires_at: optional string or null`655656        A timestamp in RFC 3339 format657658        format: date-time659660      - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`661662        OAuth refresh token configuration returned in credential responses.663664        - `client_id: string`665666          OAuth client ID.667668        - `token_endpoint: string`669670          Token endpoint URL used to refresh the access token.671672        - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`673674          - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`675676            Token endpoint requires no client authentication.677678            - `type: "none"`679680          - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`681682            Token endpoint uses HTTP Basic authentication with client credentials.683684            - `type: "client_secret_basic"`685686          - `BetaManagedAgentsTokenEndpointAuthPostResponse object`687688            Token endpoint uses POST body authentication with client credentials.689690            - `type: "client_secret_post"`691692        - `resource: optional string or null`693694          OAuth resource indicator.695696        - `scope: optional string or null`697698          OAuth scope for the refresh request.699700    - `BetaManagedAgentsStaticBearerAuthResponse object`701702      Static bearer token credential details for an MCP server.703704      - `type: "static_bearer"`705706      - `mcp_server_url: string`707708        URL of the MCP server this credential authenticates against.709710    - `BetaManagedAgentsEnvironmentVariableAuthResponse object`711712      Environment variable credential details. The secret value is never returned.713714      - `type: "environment_variable"`715716      - `injection_location: BetaManagedAgentsInjectionLocationResponse`717718        Where in the outbound request the secret value is substituted.719720        - `body: boolean`721722          Whether the placeholder is substituted in the request body.723724        - `header: boolean`725726          Whether the placeholder is substituted in request header values.727728      - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`729730        Outbound hosts the secret value is substituted on.731732        - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`733734          The secret is substituted on any host the session's Environment network policy permits egress to.735736          - `type: "unrestricted"`737738        - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`739740          The secret is substituted only on requests to the listed hosts.741742          - `type: "limited"`743744          - `allowed_hosts: array of string`745746            Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.747748      - `secret_name: string`749750        Name of the environment variable.751752  - `created_at: string`753754    A timestamp in RFC 3339 format755756    format: date-time757758  - `metadata: map[string]`759760    Arbitrary key-value metadata attached to the credential.761762  - `updated_at: string`763764    A timestamp in RFC 3339 format765766    format: date-time767768  - `vault_id: string`769770    Identifier of the vault this credential belongs to.771772  - `display_name: optional string or null`773774    Human-readable name for the credential.775776- `next_page: optional string or null`777778  Pagination token for the next page, or null if no more results.779780### Example781782```bash783curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials \784    -H 'anthropic-version: 2023-06-01' \785    -H 'anthropic-beta: managed-agents-2026-04-01' \786    -H "X-Api-Key: $ANTHROPIC_API_KEY"787```788789#### Response (200)790791```json792{793  "data": [794    {795      "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",796      "archived_at": null,797      "auth": {798        "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",799        "type": "static_bearer"800      },801      "created_at": "2026-03-15T10:00:00Z",802      "metadata": {803        "environment": "production"804      },805      "type": "vault_credential",806      "updated_at": "2026-03-15T10:00:00Z",807      "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",808      "display_name": "Example credential"809    }810  ],811  "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="812}813```814815## Get Credential816817**GET** `/v1/vaults/{vault_id}/credentials/{credential_id}`818819Get Credential820821### Path parameters822823- `vault_id: string`824825- `credential_id: string`826827### Headers828829- `"anthropic-beta": optional array of AnthropicBeta`830831  Optional header to specify the beta version(s) you want to use.832833  - `string`834835  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`836837    - `"message-batches-2024-09-24"`838839    - `"prompt-caching-2024-07-31"`840841    - `"computer-use-2024-10-22"`842843    - `"computer-use-2025-01-24"`844845    - `"pdfs-2024-09-25"`846847    - `"token-counting-2024-11-01"`848849    - `"token-efficient-tools-2025-02-19"`850851    - `"output-128k-2025-02-19"`852853    - `"files-api-2025-04-14"`854855    - `"mcp-client-2025-04-04"`856857    - `"mcp-client-2025-11-20"`858859    - `"dev-full-thinking-2025-05-14"`860861    - `"interleaved-thinking-2025-05-14"`862863    - `"code-execution-2025-05-22"`864865    - `"extended-cache-ttl-2025-04-11"`866867    - `"context-1m-2025-08-07"`868869    - `"context-management-2025-06-27"`870871    - `"model-context-window-exceeded-2025-08-26"`872873    - `"skills-2025-10-02"`874875    - `"fast-mode-2026-02-01"`876877    - `"output-300k-2026-03-24"`878879    - `"user-profiles-2026-03-24"`880881    - `"user-profiles-2026-08-18"`882883    - `"user-profiles-2026-09-04"`884885    - `"advisor-tool-2026-03-01"`886887    - `"managed-agents-2026-04-01"`888889    - `"cache-diagnosis-2026-04-07"`890891    - `"dreaming-2026-04-21"`892893    - `"thinking-token-count-2026-05-13"`894895    - `"server-side-fallback-2026-06-01"`896897    - `"server-side-fallback-2026-07-01"`898899    - `"fallback-credit-2026-06-01"`900901    - `"fallback-credit-2026-07-01"`902903    - `"agent-memory-2026-07-22"`904905    - `"mid-conversation-tool-changes-2026-07-01"`906907    - `"compact-2026-01-12"`908909    - `"computer-use-2025-11-24"`910911    - `"mcp-tunnels-2026-06-22"`912913    - `"structured-outputs-2025-11-13"`914915    - `"task-budgets-2026-03-13"`916917    - `"thinking-display-updates-2026-08-18"`918919    - `"ce-user-management-2026-07-13"`920921    - `"mid-conversation-output-config-2026-07-01"`922923    - `"thinking-binding-controls-2026-08-01"`924925    - `"mid-conversation-system-clear-at-2026-08-21"`926927    - `"compact-2026-09-04"`928929- `"anthropic-workspace-id": optional string`930931### Returns932933- `BetaManagedAgentsCredential object`934935  A credential stored in a vault. Sensitive fields are never returned in responses.936937  - `type: "vault_credential"`938939  - `id: string`940941    Unique identifier for the credential.942943  - `archived_at: string or null`944945    A timestamp in RFC 3339 format946947    format: date-time948949  - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`950951    Authentication details for a credential.952953    - `BetaManagedAgentsMCPOAuthAuthResponse object`954955      OAuth credential details for an MCP server.956957      - `type: "mcp_oauth"`958959      - `mcp_server_url: string`960961        URL of the MCP server this credential authenticates against.962963      - `expires_at: optional string or null`964965        A timestamp in RFC 3339 format966967        format: date-time968969      - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`970971        OAuth refresh token configuration returned in credential responses.972973        - `client_id: string`974975          OAuth client ID.976977        - `token_endpoint: string`978979          Token endpoint URL used to refresh the access token.980981        - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`982983          - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`984985            Token endpoint requires no client authentication.986987            - `type: "none"`988989          - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`990991            Token endpoint uses HTTP Basic authentication with client credentials.992993            - `type: "client_secret_basic"`994995          - `BetaManagedAgentsTokenEndpointAuthPostResponse object`996997            Token endpoint uses POST body authentication with client credentials.998999            - `type: "client_secret_post"`10001001        - `resource: optional string or null`10021003          OAuth resource indicator.10041005        - `scope: optional string or null`10061007          OAuth scope for the refresh request.10081009    - `BetaManagedAgentsStaticBearerAuthResponse object`10101011      Static bearer token credential details for an MCP server.10121013      - `type: "static_bearer"`10141015      - `mcp_server_url: string`10161017        URL of the MCP server this credential authenticates against.10181019    - `BetaManagedAgentsEnvironmentVariableAuthResponse object`10201021      Environment variable credential details. The secret value is never returned.10221023      - `type: "environment_variable"`10241025      - `injection_location: BetaManagedAgentsInjectionLocationResponse`10261027        Where in the outbound request the secret value is substituted.10281029        - `body: boolean`10301031          Whether the placeholder is substituted in the request body.10321033        - `header: boolean`10341035          Whether the placeholder is substituted in request header values.10361037      - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`10381039        Outbound hosts the secret value is substituted on.10401041        - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`10421043          The secret is substituted on any host the session's Environment network policy permits egress to.10441045          - `type: "unrestricted"`10461047        - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`10481049          The secret is substituted only on requests to the listed hosts.10501051          - `type: "limited"`10521053          - `allowed_hosts: array of string`10541055            Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.10561057      - `secret_name: string`10581059        Name of the environment variable.10601061  - `created_at: string`10621063    A timestamp in RFC 3339 format10641065    format: date-time10661067  - `metadata: map[string]`10681069    Arbitrary key-value metadata attached to the credential.10701071  - `updated_at: string`10721073    A timestamp in RFC 3339 format10741075    format: date-time10761077  - `vault_id: string`10781079    Identifier of the vault this credential belongs to.10801081  - `display_name: optional string or null`10821083    Human-readable name for the credential.10841085### Example10861087```bash1088curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \1089    -H 'anthropic-version: 2023-06-01' \1090    -H 'anthropic-beta: managed-agents-2026-04-01' \1091    -H "X-Api-Key: $ANTHROPIC_API_KEY"1092```10931094#### Response (200)10951096```json1097{1098  "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",1099  "archived_at": null,1100  "auth": {1101    "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",1102    "type": "static_bearer"1103  },1104  "created_at": "2026-03-15T10:00:00Z",1105  "metadata": {1106    "environment": "production"1107  },1108  "type": "vault_credential",1109  "updated_at": "2026-03-15T10:00:00Z",1110  "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",1111  "display_name": "Example credential"1112}1113```11141115## Update Credential11161117**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}`11181119Update Credential11201121### Path parameters11221123- `vault_id: string`11241125- `credential_id: string`11261127### Headers11281129- `"anthropic-beta": optional array of AnthropicBeta`11301131  Optional header to specify the beta version(s) you want to use.11321133  - `string`11341135  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`11361137    - `"message-batches-2024-09-24"`11381139    - `"prompt-caching-2024-07-31"`11401141    - `"computer-use-2024-10-22"`11421143    - `"computer-use-2025-01-24"`11441145    - `"pdfs-2024-09-25"`11461147    - `"token-counting-2024-11-01"`11481149    - `"token-efficient-tools-2025-02-19"`11501151    - `"output-128k-2025-02-19"`11521153    - `"files-api-2025-04-14"`11541155    - `"mcp-client-2025-04-04"`11561157    - `"mcp-client-2025-11-20"`11581159    - `"dev-full-thinking-2025-05-14"`11601161    - `"interleaved-thinking-2025-05-14"`11621163    - `"code-execution-2025-05-22"`11641165    - `"extended-cache-ttl-2025-04-11"`11661167    - `"context-1m-2025-08-07"`11681169    - `"context-management-2025-06-27"`11701171    - `"model-context-window-exceeded-2025-08-26"`11721173    - `"skills-2025-10-02"`11741175    - `"fast-mode-2026-02-01"`11761177    - `"output-300k-2026-03-24"`11781179    - `"user-profiles-2026-03-24"`11801181    - `"user-profiles-2026-08-18"`11821183    - `"user-profiles-2026-09-04"`11841185    - `"advisor-tool-2026-03-01"`11861187    - `"managed-agents-2026-04-01"`11881189    - `"cache-diagnosis-2026-04-07"`11901191    - `"dreaming-2026-04-21"`11921193    - `"thinking-token-count-2026-05-13"`11941195    - `"server-side-fallback-2026-06-01"`11961197    - `"server-side-fallback-2026-07-01"`11981199    - `"fallback-credit-2026-06-01"`12001201    - `"fallback-credit-2026-07-01"`12021203    - `"agent-memory-2026-07-22"`12041205    - `"mid-conversation-tool-changes-2026-07-01"`12061207    - `"compact-2026-01-12"`12081209    - `"computer-use-2025-11-24"`12101211    - `"mcp-tunnels-2026-06-22"`12121213    - `"structured-outputs-2025-11-13"`12141215    - `"task-budgets-2026-03-13"`12161217    - `"thinking-display-updates-2026-08-18"`12181219    - `"ce-user-management-2026-07-13"`12201221    - `"mid-conversation-output-config-2026-07-01"`12221223    - `"thinking-binding-controls-2026-08-01"`12241225    - `"mid-conversation-system-clear-at-2026-08-21"`12261227    - `"compact-2026-09-04"`12281229- `"anthropic-workspace-id": optional string`12301231### Body parameters12321233- `auth: optional BetaManagedAgentsMCPOAuthUpdateParams or BetaManagedAgentsStaticBearerUpdateParams or BetaManagedAgentsEnvironmentVariableUpdateParams`12341235  Updated authentication details for a credential.12361237  - `BetaManagedAgentsMCPOAuthUpdateParams object`12381239    Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.12401241    - `type: "mcp_oauth"`12421243    - `access_token: optional string or null`12441245      Updated OAuth access token.12461247      minLength: 1, maxLength: 819212481249    - `expires_at: optional string or null`12501251      A timestamp in RFC 3339 format12521253      format: date-time12541255    - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`12561257      Parameters for updating OAuth refresh token configuration.12581259      - `refresh_token: optional string or null`12601261        Updated OAuth refresh token.12621263        minLength: 1, maxLength: 819212641265      - `scope: optional string or null`12661267        Updated OAuth scope for the refresh request.12681269        maxLength: 819212701271      - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`12721273        - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`12741275          Updated HTTP Basic authentication parameters for the token endpoint.12761277          - `type: "client_secret_basic"`12781279          - `client_secret: optional string or null`12801281            Updated OAuth client secret.12821283            minLength: 1, maxLength: 51212841285        - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`12861287          Updated POST body authentication parameters for the token endpoint.12881289          - `type: "client_secret_post"`12901291          - `client_secret: optional string or null`12921293            Updated OAuth client secret.12941295            minLength: 1, maxLength: 51212961297  - `BetaManagedAgentsStaticBearerUpdateParams object`12981299    Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.13001301    - `type: "static_bearer"`13021303    - `token: optional string or null`13041305      Updated static bearer token value.13061307      minLength: 1, maxLength: 819213081309  - `BetaManagedAgentsEnvironmentVariableUpdateParams object`13101311    Parameters for updating an environment variable credential. `secret_name` is immutable.13121313    - `type: "environment_variable"`13141315    - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`13161317      Updated injection location.13181319      - `body: optional boolean`13201321        Substitute when the placeholder appears in the request body.13221323      - `header: optional boolean`13241325        Substitute when the placeholder appears in a request header value.13261327    - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`13281329      Updated networking scope. Full replacement.13301331      - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`13321333        Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.13341335        - `type: "unrestricted"`13361337      - `BetaManagedAgentsLimitedCredentialNetworkingParams object`13381339        Substitute the secret only on requests to the listed hosts.13401341        - `type: "limited"`13421343        - `allowed_hosts: array of string`13441345          Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.13461347    - `secret_value: optional string or null`13481349      Updated secret value.13501351      minLength: 1, maxLength: 409613521353- `display_name: optional string or null`13541355  Updated human-readable name for the credential. 1-255 characters.13561357  minLength: 1, maxLength: 25513581359- `metadata: optional map[string] or null`13601361  Metadata patch. Set a key to a string to upsert it, or to null to delete it. Omitted keys are preserved.13621363### Returns13641365- `BetaManagedAgentsCredential object`13661367  A credential stored in a vault. Sensitive fields are never returned in responses.13681369  - `type: "vault_credential"`13701371  - `id: string`13721373    Unique identifier for the credential.13741375  - `archived_at: string or null`13761377    A timestamp in RFC 3339 format13781379    format: date-time13801381  - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`13821383    Authentication details for a credential.13841385    - `BetaManagedAgentsMCPOAuthAuthResponse object`13861387      OAuth credential details for an MCP server.13881389      - `type: "mcp_oauth"`13901391      - `mcp_server_url: string`13921393        URL of the MCP server this credential authenticates against.13941395      - `expires_at: optional string or null`13961397        A timestamp in RFC 3339 format13981399        format: date-time14001401      - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`14021403        OAuth refresh token configuration returned in credential responses.14041405        - `client_id: string`14061407          OAuth client ID.14081409        - `token_endpoint: string`14101411          Token endpoint URL used to refresh the access token.14121413        - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`14141415          - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`14161417            Token endpoint requires no client authentication.14181419            - `type: "none"`14201421          - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`14221423            Token endpoint uses HTTP Basic authentication with client credentials.14241425            - `type: "client_secret_basic"`14261427          - `BetaManagedAgentsTokenEndpointAuthPostResponse object`14281429            Token endpoint uses POST body authentication with client credentials.14301431            - `type: "client_secret_post"`14321433        - `resource: optional string or null`14341435          OAuth resource indicator.14361437        - `scope: optional string or null`14381439          OAuth scope for the refresh request.14401441    - `BetaManagedAgentsStaticBearerAuthResponse object`14421443      Static bearer token credential details for an MCP server.14441445      - `type: "static_bearer"`14461447      - `mcp_server_url: string`14481449        URL of the MCP server this credential authenticates against.14501451    - `BetaManagedAgentsEnvironmentVariableAuthResponse object`14521453      Environment variable credential details. The secret value is never returned.14541455      - `type: "environment_variable"`14561457      - `injection_location: BetaManagedAgentsInjectionLocationResponse`14581459        Where in the outbound request the secret value is substituted.14601461        - `body: boolean`14621463          Whether the placeholder is substituted in the request body.14641465        - `header: boolean`14661467          Whether the placeholder is substituted in request header values.14681469      - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`14701471        Outbound hosts the secret value is substituted on.14721473        - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`14741475          The secret is substituted on any host the session's Environment network policy permits egress to.14761477          - `type: "unrestricted"`14781479        - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`14801481          The secret is substituted only on requests to the listed hosts.14821483          - `type: "limited"`14841485          - `allowed_hosts: array of string`14861487            Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.14881489      - `secret_name: string`14901491        Name of the environment variable.14921493  - `created_at: string`14941495    A timestamp in RFC 3339 format14961497    format: date-time14981499  - `metadata: map[string]`15001501    Arbitrary key-value metadata attached to the credential.15021503  - `updated_at: string`15041505    A timestamp in RFC 3339 format15061507    format: date-time15081509  - `vault_id: string`15101511    Identifier of the vault this credential belongs to.15121513  - `display_name: optional string or null`15141515    Human-readable name for the credential.15161517### Example15181519```bash1520curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \1521    -H 'Content-Type: application/json' \1522    -H 'anthropic-version: 2023-06-01' \1523    -H 'anthropic-beta: managed-agents-2026-04-01' \1524    -H "X-Api-Key: $ANTHROPIC_API_KEY" \1525    -d '{1526          "display_name": "Example credential",1527          "metadata": {1528            "environment": "production"1529          }1530        }'1531```15321533#### Response (200)15341535```json1536{1537  "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",1538  "archived_at": null,1539  "auth": {1540    "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",1541    "type": "static_bearer"1542  },1543  "created_at": "2026-03-15T10:00:00Z",1544  "metadata": {1545    "environment": "production"1546  },1547  "type": "vault_credential",1548  "updated_at": "2026-03-15T10:00:00Z",1549  "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",1550  "display_name": "Example credential"1551}1552```15531554## Delete Credential15551556**DELETE** `/v1/vaults/{vault_id}/credentials/{credential_id}`15571558Delete Credential15591560### Path parameters15611562- `vault_id: string`15631564- `credential_id: string`15651566### Headers15671568- `"anthropic-beta": optional array of AnthropicBeta`15691570  Optional header to specify the beta version(s) you want to use.15711572  - `string`15731574  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`15751576    - `"message-batches-2024-09-24"`15771578    - `"prompt-caching-2024-07-31"`15791580    - `"computer-use-2024-10-22"`15811582    - `"computer-use-2025-01-24"`15831584    - `"pdfs-2024-09-25"`15851586    - `"token-counting-2024-11-01"`15871588    - `"token-efficient-tools-2025-02-19"`15891590    - `"output-128k-2025-02-19"`15911592    - `"files-api-2025-04-14"`15931594    - `"mcp-client-2025-04-04"`15951596    - `"mcp-client-2025-11-20"`15971598    - `"dev-full-thinking-2025-05-14"`15991600    - `"interleaved-thinking-2025-05-14"`16011602    - `"code-execution-2025-05-22"`16031604    - `"extended-cache-ttl-2025-04-11"`16051606    - `"context-1m-2025-08-07"`16071608    - `"context-management-2025-06-27"`16091610    - `"model-context-window-exceeded-2025-08-26"`16111612    - `"skills-2025-10-02"`16131614    - `"fast-mode-2026-02-01"`16151616    - `"output-300k-2026-03-24"`16171618    - `"user-profiles-2026-03-24"`16191620    - `"user-profiles-2026-08-18"`16211622    - `"user-profiles-2026-09-04"`16231624    - `"advisor-tool-2026-03-01"`16251626    - `"managed-agents-2026-04-01"`16271628    - `"cache-diagnosis-2026-04-07"`16291630    - `"dreaming-2026-04-21"`16311632    - `"thinking-token-count-2026-05-13"`16331634    - `"server-side-fallback-2026-06-01"`16351636    - `"server-side-fallback-2026-07-01"`16371638    - `"fallback-credit-2026-06-01"`16391640    - `"fallback-credit-2026-07-01"`16411642    - `"agent-memory-2026-07-22"`16431644    - `"mid-conversation-tool-changes-2026-07-01"`16451646    - `"compact-2026-01-12"`16471648    - `"computer-use-2025-11-24"`16491650    - `"mcp-tunnels-2026-06-22"`16511652    - `"structured-outputs-2025-11-13"`16531654    - `"task-budgets-2026-03-13"`16551656    - `"thinking-display-updates-2026-08-18"`16571658    - `"ce-user-management-2026-07-13"`16591660    - `"mid-conversation-output-config-2026-07-01"`16611662    - `"thinking-binding-controls-2026-08-01"`16631664    - `"mid-conversation-system-clear-at-2026-08-21"`16651666    - `"compact-2026-09-04"`16671668- `"anthropic-workspace-id": optional string`16691670### Returns16711672- `BetaManagedAgentsDeletedCredential object`16731674  Confirmation of a deleted credential.16751676  - `type: "vault_credential_deleted"`16771678  - `id: string`16791680    Unique identifier of the deleted credential.16811682### Example16831684```bash1685curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID \1686    -X DELETE \1687    -H 'anthropic-version: 2023-06-01' \1688    -H 'anthropic-beta: managed-agents-2026-04-01' \1689    -H "X-Api-Key: $ANTHROPIC_API_KEY"1690```16911692#### Response (200)16931694```json1695{1696  "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",1697  "type": "vault_credential_deleted"1698}1699```17001701## Archive Credential17021703**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/archive`17041705Archive Credential17061707### Path parameters17081709- `vault_id: string`17101711- `credential_id: string`17121713### Headers17141715- `"anthropic-beta": optional array of AnthropicBeta`17161717  Optional header to specify the beta version(s) you want to use.17181719  - `string`17201721  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`17221723    - `"message-batches-2024-09-24"`17241725    - `"prompt-caching-2024-07-31"`17261727    - `"computer-use-2024-10-22"`17281729    - `"computer-use-2025-01-24"`17301731    - `"pdfs-2024-09-25"`17321733    - `"token-counting-2024-11-01"`17341735    - `"token-efficient-tools-2025-02-19"`17361737    - `"output-128k-2025-02-19"`17381739    - `"files-api-2025-04-14"`17401741    - `"mcp-client-2025-04-04"`17421743    - `"mcp-client-2025-11-20"`17441745    - `"dev-full-thinking-2025-05-14"`17461747    - `"interleaved-thinking-2025-05-14"`17481749    - `"code-execution-2025-05-22"`17501751    - `"extended-cache-ttl-2025-04-11"`17521753    - `"context-1m-2025-08-07"`17541755    - `"context-management-2025-06-27"`17561757    - `"model-context-window-exceeded-2025-08-26"`17581759    - `"skills-2025-10-02"`17601761    - `"fast-mode-2026-02-01"`17621763    - `"output-300k-2026-03-24"`17641765    - `"user-profiles-2026-03-24"`17661767    - `"user-profiles-2026-08-18"`17681769    - `"user-profiles-2026-09-04"`17701771    - `"advisor-tool-2026-03-01"`17721773    - `"managed-agents-2026-04-01"`17741775    - `"cache-diagnosis-2026-04-07"`17761777    - `"dreaming-2026-04-21"`17781779    - `"thinking-token-count-2026-05-13"`17801781    - `"server-side-fallback-2026-06-01"`17821783    - `"server-side-fallback-2026-07-01"`17841785    - `"fallback-credit-2026-06-01"`17861787    - `"fallback-credit-2026-07-01"`17881789    - `"agent-memory-2026-07-22"`17901791    - `"mid-conversation-tool-changes-2026-07-01"`17921793    - `"compact-2026-01-12"`17941795    - `"computer-use-2025-11-24"`17961797    - `"mcp-tunnels-2026-06-22"`17981799    - `"structured-outputs-2025-11-13"`18001801    - `"task-budgets-2026-03-13"`18021803    - `"thinking-display-updates-2026-08-18"`18041805    - `"ce-user-management-2026-07-13"`18061807    - `"mid-conversation-output-config-2026-07-01"`18081809    - `"thinking-binding-controls-2026-08-01"`18101811    - `"mid-conversation-system-clear-at-2026-08-21"`18121813    - `"compact-2026-09-04"`18141815- `"anthropic-workspace-id": optional string`18161817### Returns18181819- `BetaManagedAgentsCredential object`18201821  A credential stored in a vault. Sensitive fields are never returned in responses.18221823  - `type: "vault_credential"`18241825  - `id: string`18261827    Unique identifier for the credential.18281829  - `archived_at: string or null`18301831    A timestamp in RFC 3339 format18321833    format: date-time18341835  - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`18361837    Authentication details for a credential.18381839    - `BetaManagedAgentsMCPOAuthAuthResponse object`18401841      OAuth credential details for an MCP server.18421843      - `type: "mcp_oauth"`18441845      - `mcp_server_url: string`18461847        URL of the MCP server this credential authenticates against.18481849      - `expires_at: optional string or null`18501851        A timestamp in RFC 3339 format18521853        format: date-time18541855      - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`18561857        OAuth refresh token configuration returned in credential responses.18581859        - `client_id: string`18601861          OAuth client ID.18621863        - `token_endpoint: string`18641865          Token endpoint URL used to refresh the access token.18661867        - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`18681869          - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`18701871            Token endpoint requires no client authentication.18721873            - `type: "none"`18741875          - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`18761877            Token endpoint uses HTTP Basic authentication with client credentials.18781879            - `type: "client_secret_basic"`18801881          - `BetaManagedAgentsTokenEndpointAuthPostResponse object`18821883            Token endpoint uses POST body authentication with client credentials.18841885            - `type: "client_secret_post"`18861887        - `resource: optional string or null`18881889          OAuth resource indicator.18901891        - `scope: optional string or null`18921893          OAuth scope for the refresh request.18941895    - `BetaManagedAgentsStaticBearerAuthResponse object`18961897      Static bearer token credential details for an MCP server.18981899      - `type: "static_bearer"`19001901      - `mcp_server_url: string`19021903        URL of the MCP server this credential authenticates against.19041905    - `BetaManagedAgentsEnvironmentVariableAuthResponse object`19061907      Environment variable credential details. The secret value is never returned.19081909      - `type: "environment_variable"`19101911      - `injection_location: BetaManagedAgentsInjectionLocationResponse`19121913        Where in the outbound request the secret value is substituted.19141915        - `body: boolean`19161917          Whether the placeholder is substituted in the request body.19181919        - `header: boolean`19201921          Whether the placeholder is substituted in request header values.19221923      - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`19241925        Outbound hosts the secret value is substituted on.19261927        - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`19281929          The secret is substituted on any host the session's Environment network policy permits egress to.19301931          - `type: "unrestricted"`19321933        - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`19341935          The secret is substituted only on requests to the listed hosts.19361937          - `type: "limited"`19381939          - `allowed_hosts: array of string`19401941            Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.19421943      - `secret_name: string`19441945        Name of the environment variable.19461947  - `created_at: string`19481949    A timestamp in RFC 3339 format19501951    format: date-time19521953  - `metadata: map[string]`19541955    Arbitrary key-value metadata attached to the credential.19561957  - `updated_at: string`19581959    A timestamp in RFC 3339 format19601961    format: date-time19621963  - `vault_id: string`19641965    Identifier of the vault this credential belongs to.19661967  - `display_name: optional string or null`19681969    Human-readable name for the credential.19701971### Example19721973```bash1974curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/archive \1975    -X POST \1976    -H 'anthropic-version: 2023-06-01' \1977    -H 'anthropic-beta: managed-agents-2026-04-01' \1978    -H "X-Api-Key: $ANTHROPIC_API_KEY"1979```19801981#### Response (200)19821983```json1984{1985  "id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",1986  "archived_at": null,1987  "auth": {1988    "mcp_server_url": "https://example-server.modelcontextprotocol.io/sse",1989    "type": "static_bearer"1990  },1991  "created_at": "2026-03-15T10:00:00Z",1992  "metadata": {1993    "environment": "production"1994  },1995  "type": "vault_credential",1996  "updated_at": "2026-03-15T10:00:00Z",1997  "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv",1998  "display_name": "Example credential"1999}2000```20012002## Validate Credential20032004**POST** `/v1/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate`20052006Validate Credential20072008### Path parameters20092010- `vault_id: string`20112012- `credential_id: string`20132014### Headers20152016- `"anthropic-beta": optional array of AnthropicBeta`20172018  Optional header to specify the beta version(s) you want to use.20192020  - `string`20212022  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`20232024    - `"message-batches-2024-09-24"`20252026    - `"prompt-caching-2024-07-31"`20272028    - `"computer-use-2024-10-22"`20292030    - `"computer-use-2025-01-24"`20312032    - `"pdfs-2024-09-25"`20332034    - `"token-counting-2024-11-01"`20352036    - `"token-efficient-tools-2025-02-19"`20372038    - `"output-128k-2025-02-19"`20392040    - `"files-api-2025-04-14"`20412042    - `"mcp-client-2025-04-04"`20432044    - `"mcp-client-2025-11-20"`20452046    - `"dev-full-thinking-2025-05-14"`20472048    - `"interleaved-thinking-2025-05-14"`20492050    - `"code-execution-2025-05-22"`20512052    - `"extended-cache-ttl-2025-04-11"`20532054    - `"context-1m-2025-08-07"`20552056    - `"context-management-2025-06-27"`20572058    - `"model-context-window-exceeded-2025-08-26"`20592060    - `"skills-2025-10-02"`20612062    - `"fast-mode-2026-02-01"`20632064    - `"output-300k-2026-03-24"`20652066    - `"user-profiles-2026-03-24"`20672068    - `"user-profiles-2026-08-18"`20692070    - `"user-profiles-2026-09-04"`20712072    - `"advisor-tool-2026-03-01"`20732074    - `"managed-agents-2026-04-01"`20752076    - `"cache-diagnosis-2026-04-07"`20772078    - `"dreaming-2026-04-21"`20792080    - `"thinking-token-count-2026-05-13"`20812082    - `"server-side-fallback-2026-06-01"`20832084    - `"server-side-fallback-2026-07-01"`20852086    - `"fallback-credit-2026-06-01"`20872088    - `"fallback-credit-2026-07-01"`20892090    - `"agent-memory-2026-07-22"`20912092    - `"mid-conversation-tool-changes-2026-07-01"`20932094    - `"compact-2026-01-12"`20952096    - `"computer-use-2025-11-24"`20972098    - `"mcp-tunnels-2026-06-22"`20992100    - `"structured-outputs-2025-11-13"`21012102    - `"task-budgets-2026-03-13"`21032104    - `"thinking-display-updates-2026-08-18"`21052106    - `"ce-user-management-2026-07-13"`21072108    - `"mid-conversation-output-config-2026-07-01"`21092110    - `"thinking-binding-controls-2026-08-01"`21112112    - `"mid-conversation-system-clear-at-2026-08-21"`21132114    - `"compact-2026-09-04"`21152116- `"anthropic-workspace-id": optional string`21172118### Returns21192120- `BetaManagedAgentsCredentialValidation object`21212122  Result of live-probing a credential against its configured MCP server.21232124  - `type: "vault_credential_validation"`21252126  - `credential_id: string`21272128    Unique identifier of the credential that was validated.21292130  - `has_refresh_token: boolean`21312132    Whether the credential has a refresh token configured.21332134  - `mcp_probe: BetaManagedAgentsMCPProbe or null`21352136    The failing step of an MCP validation probe.21372138    - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`21392140      An HTTP response captured during a credential validation probe.21412142      - `body: string`21432144        Response body. May be truncated and has sensitive values scrubbed.21452146      - `body_truncated: boolean`21472148        Whether `body` was truncated.21492150      - `content_type: string`21512152        Value of the `Content-Type` response header.21532154      - `status_code: number`21552156        HTTP status code.21572158        format: int3221592160    - `method: string`21612162      The MCP method that failed (for example `initialize` or `tools/list`).21632164  - `refresh: BetaManagedAgentsRefreshObject or null`21652166    Outcome of a refresh-token exchange attempted during credential validation.21672168    - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`21692170      An HTTP response captured during a credential validation probe.21712172    - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`21732174      Outcome of a refresh-token exchange attempted during credential validation.21752176      - `"succeeded"`21772178      - `"failed"`21792180      - `"connect_error"`21812182      - `"no_refresh_token"`21832184  - `status: BetaManagedAgentsCredentialValidationStatus`21852186    Overall verdict of a credential validation probe.21872188    - `"valid"`21892190    - `"invalid"`21912192    - `"unknown"`21932194  - `validated_at: string`21952196    A timestamp in RFC 3339 format21972198    format: date-time21992200  - `vault_id: string`22012202    Identifier of the vault containing the credential.22032204### Example22052206```bash2207curl https://api.anthropic.com/v1/vaults/$VAULT_ID/credentials/$CREDENTIAL_ID/mcp_oauth_validate \2208    -X POST \2209    -H 'anthropic-version: 2023-06-01' \2210    -H 'anthropic-beta: managed-agents-2026-04-01' \2211    -H "X-Api-Key: $ANTHROPIC_API_KEY"2212```22132214#### Response (200)22152216```json2217{2218  "credential_id": "vcrd_011CZkZEMt8gZan2iYOQfSkw",2219  "has_refresh_token": true,2220  "mcp_probe": {2221    "http_response": {2222      "body": "body",2223      "body_truncated": true,2224      "content_type": "content_type",2225      "status_code": 02226    },2227    "method": "method"2228  },2229  "refresh": {2230    "http_response": {2231      "body": "body",2232      "body_truncated": true,2233      "content_type": "content_type",2234      "status_code": 02235    },2236    "status": "succeeded"2237  },2238  "status": "valid",2239  "type": "vault_credential_validation",2240  "validated_at": "2026-03-15T10:00:00Z",2241  "vault_id": "vlt_011CZkZDLs7fYzm1hXNPeRjv"2242}2243```22442245## Domain types22462247### Beta Managed Agents Credential22482249- `BetaManagedAgentsCredential object`22502251  A credential stored in a vault. Sensitive fields are never returned in responses.22522253  - `type: "vault_credential"`22542255  - `id: string`22562257    Unique identifier for the credential.22582259  - `archived_at: string or null`22602261    A timestamp in RFC 3339 format22622263    format: date-time22642265  - `auth: BetaManagedAgentsMCPOAuthAuthResponse or BetaManagedAgentsStaticBearerAuthResponse or BetaManagedAgentsEnvironmentVariableAuthResponse`22662267    Authentication details for a credential.22682269    - `BetaManagedAgentsMCPOAuthAuthResponse object`22702271      OAuth credential details for an MCP server.22722273      - `type: "mcp_oauth"`22742275      - `mcp_server_url: string`22762277        URL of the MCP server this credential authenticates against.22782279      - `expires_at: optional string or null`22802281        A timestamp in RFC 3339 format22822283        format: date-time22842285      - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`22862287        OAuth refresh token configuration returned in credential responses.22882289        - `client_id: string`22902291          OAuth client ID.22922293        - `token_endpoint: string`22942295          Token endpoint URL used to refresh the access token.22962297        - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`22982299          - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`23002301            Token endpoint requires no client authentication.23022303            - `type: "none"`23042305          - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`23062307            Token endpoint uses HTTP Basic authentication with client credentials.23082309            - `type: "client_secret_basic"`23102311          - `BetaManagedAgentsTokenEndpointAuthPostResponse object`23122313            Token endpoint uses POST body authentication with client credentials.23142315            - `type: "client_secret_post"`23162317        - `resource: optional string or null`23182319          OAuth resource indicator.23202321        - `scope: optional string or null`23222323          OAuth scope for the refresh request.23242325    - `BetaManagedAgentsStaticBearerAuthResponse object`23262327      Static bearer token credential details for an MCP server.23282329      - `type: "static_bearer"`23302331      - `mcp_server_url: string`23322333        URL of the MCP server this credential authenticates against.23342335    - `BetaManagedAgentsEnvironmentVariableAuthResponse object`23362337      Environment variable credential details. The secret value is never returned.23382339      - `type: "environment_variable"`23402341      - `injection_location: BetaManagedAgentsInjectionLocationResponse`23422343        Where in the outbound request the secret value is substituted.23442345        - `body: boolean`23462347          Whether the placeholder is substituted in the request body.23482349        - `header: boolean`23502351          Whether the placeholder is substituted in request header values.23522353      - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`23542355        Outbound hosts the secret value is substituted on.23562357        - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`23582359          The secret is substituted on any host the session's Environment network policy permits egress to.23602361          - `type: "unrestricted"`23622363        - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`23642365          The secret is substituted only on requests to the listed hosts.23662367          - `type: "limited"`23682369          - `allowed_hosts: array of string`23702371            Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.23722373      - `secret_name: string`23742375        Name of the environment variable.23762377  - `created_at: string`23782379    A timestamp in RFC 3339 format23802381    format: date-time23822383  - `metadata: map[string]`23842385    Arbitrary key-value metadata attached to the credential.23862387  - `updated_at: string`23882389    A timestamp in RFC 3339 format23902391    format: date-time23922393  - `vault_id: string`23942395    Identifier of the vault this credential belongs to.23962397  - `display_name: optional string or null`23982399    Human-readable name for the credential.24002401### Beta Managed Agents Credential Networking Params24022403- `BetaManagedAgentsCredentialNetworkingParams = BetaManagedAgentsUnrestrictedCredentialNetworkingParams or BetaManagedAgentsLimitedCredentialNetworkingParams`24042405  - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`24062407    Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.24082409    - `type: "unrestricted"`24102411  - `BetaManagedAgentsLimitedCredentialNetworkingParams object`24122413    Substitute the secret only on requests to the listed hosts.24142415    - `type: "limited"`24162417    - `allowed_hosts: array of string`24182419      Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.24202421### Beta Managed Agents Credential Validation24222423- `BetaManagedAgentsCredentialValidation object`24242425  Result of live-probing a credential against its configured MCP server.24262427  - `type: "vault_credential_validation"`24282429  - `credential_id: string`24302431    Unique identifier of the credential that was validated.24322433  - `has_refresh_token: boolean`24342435    Whether the credential has a refresh token configured.24362437  - `mcp_probe: BetaManagedAgentsMCPProbe or null`24382439    The failing step of an MCP validation probe.24402441    - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`24422443      An HTTP response captured during a credential validation probe.24442445      - `body: string`24462447        Response body. May be truncated and has sensitive values scrubbed.24482449      - `body_truncated: boolean`24502451        Whether `body` was truncated.24522453      - `content_type: string`24542455        Value of the `Content-Type` response header.24562457      - `status_code: number`24582459        HTTP status code.24602461        format: int3224622463    - `method: string`24642465      The MCP method that failed (for example `initialize` or `tools/list`).24662467  - `refresh: BetaManagedAgentsRefreshObject or null`24682469    Outcome of a refresh-token exchange attempted during credential validation.24702471    - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`24722473      An HTTP response captured during a credential validation probe.24742475    - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`24762477      Outcome of a refresh-token exchange attempted during credential validation.24782479      - `"succeeded"`24802481      - `"failed"`24822483      - `"connect_error"`24842485      - `"no_refresh_token"`24862487  - `status: BetaManagedAgentsCredentialValidationStatus`24882489    Overall verdict of a credential validation probe.24902491    - `"valid"`24922493    - `"invalid"`24942495    - `"unknown"`24962497  - `validated_at: string`24982499    A timestamp in RFC 3339 format25002501    format: date-time25022503  - `vault_id: string`25042505    Identifier of the vault containing the credential.25062507### Beta Managed Agents Credential Validation Status25082509- `BetaManagedAgentsCredentialValidationStatus = "valid" or "invalid" or "unknown"`25102511  Overall verdict of a credential validation probe.25122513  - `"valid"`25142515  - `"invalid"`25162517  - `"unknown"`25182519### Beta Managed Agents Deleted Credential25202521- `BetaManagedAgentsDeletedCredential object`25222523  Confirmation of a deleted credential.25242525  - `type: "vault_credential_deleted"`25262527  - `id: string`25282529    Unique identifier of the deleted credential.25302531### Beta Managed Agents Environment Variable Auth Response25322533- `BetaManagedAgentsEnvironmentVariableAuthResponse object`25342535  Environment variable credential details. The secret value is never returned.25362537  - `type: "environment_variable"`25382539  - `injection_location: BetaManagedAgentsInjectionLocationResponse`25402541    Where in the outbound request the secret value is substituted.25422543    - `body: boolean`25442545      Whether the placeholder is substituted in the request body.25462547    - `header: boolean`25482549      Whether the placeholder is substituted in request header values.25502551  - `networking: BetaManagedAgentsUnrestrictedCredentialNetworkingResponse or BetaManagedAgentsLimitedCredentialNetworkingResponse`25522553    Outbound hosts the secret value is substituted on.25542555    - `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`25562557      The secret is substituted on any host the session's Environment network policy permits egress to.25582559      - `type: "unrestricted"`25602561    - `BetaManagedAgentsLimitedCredentialNetworkingResponse object`25622563      The secret is substituted only on requests to the listed hosts.25642565      - `type: "limited"`25662567      - `allowed_hosts: array of string`25682569        Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.25702571  - `secret_name: string`25722573    Name of the environment variable.25742575### Beta Managed Agents Environment Variable Create Params25762577- `BetaManagedAgentsEnvironmentVariableCreateParams object`25782579  Parameters for creating an environment variable credential.25802581  - `type: "environment_variable"`25822583  - `networking: BetaManagedAgentsCredentialNetworkingParams`25842585    Outbound hosts the secret value is substituted on.25862587    - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`25882589      Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.25902591      - `type: "unrestricted"`25922593    - `BetaManagedAgentsLimitedCredentialNetworkingParams object`25942595      Substitute the secret only on requests to the listed hosts.25962597      - `type: "limited"`25982599      - `allowed_hosts: array of string`26002601        Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.26022603  - `secret_name: string`26042605    Name of the environment variable. Immutable after create.26062607    minLength: 1, maxLength: 25526082609  - `secret_value: string`26102611    Secret value. Write-only; never returned in responses.26122613    minLength: 1, maxLength: 409626142615  - `injection_location: optional BetaManagedAgentsInjectionLocationParams`26162617    Where in the outbound request the secret value may be substituted.26182619    - `body: optional boolean`26202621      Substitute when the placeholder appears in the request body.26222623    - `header: optional boolean`26242625      Substitute when the placeholder appears in a request header value.26262627### Beta Managed Agents Environment Variable Update Params26282629- `BetaManagedAgentsEnvironmentVariableUpdateParams object`26302631  Parameters for updating an environment variable credential. `secret_name` is immutable.26322633  - `type: "environment_variable"`26342635  - `injection_location: optional BetaManagedAgentsInjectionLocationUpdateParams`26362637    Updated injection location.26382639    - `body: optional boolean`26402641      Substitute when the placeholder appears in the request body.26422643    - `header: optional boolean`26442645      Substitute when the placeholder appears in a request header value.26462647  - `networking: optional BetaManagedAgentsCredentialNetworkingParams or null`26482649    Updated networking scope. Full replacement.26502651    - `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`26522653      Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.26542655      - `type: "unrestricted"`26562657    - `BetaManagedAgentsLimitedCredentialNetworkingParams object`26582659      Substitute the secret only on requests to the listed hosts.26602661      - `type: "limited"`26622663      - `allowed_hosts: array of string`26642665        Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.26662667  - `secret_value: optional string or null`26682669    Updated secret value.26702671    minLength: 1, maxLength: 409626722673### Beta Managed Agents Injection Location Params26742675- `BetaManagedAgentsInjectionLocationParams object`26762677  Where in the outbound request the secret value may be substituted.26782679  - `body: optional boolean`26802681    Substitute when the placeholder appears in the request body.26822683  - `header: optional boolean`26842685    Substitute when the placeholder appears in a request header value.26862687### Beta Managed Agents Injection Location Response26882689- `BetaManagedAgentsInjectionLocationResponse object`26902691  Where in the outbound request the secret value is substituted.26922693  - `body: boolean`26942695    Whether the placeholder is substituted in the request body.26962697  - `header: boolean`26982699    Whether the placeholder is substituted in request header values.27002701### Beta Managed Agents Injection Location Update Params27022703- `BetaManagedAgentsInjectionLocationUpdateParams object`27042705  Updated injection location.27062707  - `body: optional boolean`27082709    Substitute when the placeholder appears in the request body.27102711  - `header: optional boolean`27122713    Substitute when the placeholder appears in a request header value.27142715### Beta Managed Agents Limited Credential Networking Params27162717- `BetaManagedAgentsLimitedCredentialNetworkingParams object`27182719  Substitute the secret only on requests to the listed hosts.27202721  - `type: "limited"`27222723  - `allowed_hosts: array of string`27242725    Hostnames on which the secret will be substituted. Each entry is a bare hostname (`api.example.com`), an IPv4 address (`192.0.2.1`), or a `*.`-prefixed wildcard (`*.example.com`). URLs, ports, paths, and IPv6 addresses are not accepted. At most 16 entries.27262727### Beta Managed Agents Limited Credential Networking Response27282729- `BetaManagedAgentsLimitedCredentialNetworkingResponse object`27302731  The secret is substituted only on requests to the listed hosts.27322733  - `type: "limited"`27342735  - `allowed_hosts: array of string`27362737    Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.27382739### Beta Managed Agents MCP OAuth Auth Response27402741- `BetaManagedAgentsMCPOAuthAuthResponse object`27422743  OAuth credential details for an MCP server.27442745  - `type: "mcp_oauth"`27462747  - `mcp_server_url: string`27482749    URL of the MCP server this credential authenticates against.27502751  - `expires_at: optional string or null`27522753    A timestamp in RFC 3339 format27542755    format: date-time27562757  - `refresh: optional BetaManagedAgentsMCPOAuthRefreshResponse or null`27582759    OAuth refresh token configuration returned in credential responses.27602761    - `client_id: string`27622763      OAuth client ID.27642765    - `token_endpoint: string`27662767      Token endpoint URL used to refresh the access token.27682769    - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`27702771      - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`27722773        Token endpoint requires no client authentication.27742775        - `type: "none"`27762777      - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`27782779        Token endpoint uses HTTP Basic authentication with client credentials.27802781        - `type: "client_secret_basic"`27822783      - `BetaManagedAgentsTokenEndpointAuthPostResponse object`27842785        Token endpoint uses POST body authentication with client credentials.27862787        - `type: "client_secret_post"`27882789    - `resource: optional string or null`27902791      OAuth resource indicator.27922793    - `scope: optional string or null`27942795      OAuth scope for the refresh request.27962797### Beta Managed Agents MCP OAuth Create Params27982799- `BetaManagedAgentsMCPOAuthCreateParams object`28002801  Parameters for creating an MCP OAuth credential.28022803  - `type: "mcp_oauth"`28042805  - `access_token: string`28062807    OAuth access token.28082809    minLength: 1, maxLength: 819228102811  - `mcp_server_url: string`28122813    URL of the MCP server this credential authenticates against.28142815    minLength: 1, maxLength: 204728162817  - `expires_at: optional string or null`28182819    A timestamp in RFC 3339 format28202821    format: date-time28222823  - `refresh: optional BetaManagedAgentsMCPOAuthRefreshParams or null`28242825    OAuth refresh token parameters for creating a credential with refresh support.28262827    - `client_id: string`28282829      OAuth client ID.28302831      minLength: 1, maxLength: 102428322833    - `refresh_token: string`28342835      OAuth refresh token.28362837      minLength: 1, maxLength: 819228382839    - `token_endpoint: string`28402841      Token endpoint URL used to refresh the access token.28422843      minLength: 1, maxLength: 204728442845    - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`28462847      - `BetaManagedAgentsTokenEndpointAuthNoneParam object`28482849        Token endpoint requires no client authentication.28502851        - `type: "none"`28522853      - `BetaManagedAgentsTokenEndpointAuthBasicParam object`28542855        Token endpoint uses HTTP Basic authentication with client credentials.28562857        - `type: "client_secret_basic"`28582859        - `client_secret: string`28602861          OAuth client secret.28622863          minLength: 1, maxLength: 51228642865      - `BetaManagedAgentsTokenEndpointAuthPostParam object`28662867        Token endpoint uses POST body authentication with client credentials.28682869        - `type: "client_secret_post"`28702871        - `client_secret: string`28722873          OAuth client secret.28742875          minLength: 1, maxLength: 51228762877    - `resource: optional string or null`28782879      OAuth resource indicator.28802881      minLength: 1, maxLength: 204728822883    - `scope: optional string or null`28842885      OAuth scope for the refresh request.28862887      minLength: 1, maxLength: 819228882889### Beta Managed Agents MCP OAuth Refresh Params28902891- `BetaManagedAgentsMCPOAuthRefreshParams object`28922893  OAuth refresh token parameters for creating a credential with refresh support.28942895  - `client_id: string`28962897    OAuth client ID.28982899    minLength: 1, maxLength: 102429002901  - `refresh_token: string`29022903    OAuth refresh token.29042905    minLength: 1, maxLength: 819229062907  - `token_endpoint: string`29082909    Token endpoint URL used to refresh the access token.29102911    minLength: 1, maxLength: 204729122913  - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneParam or BetaManagedAgentsTokenEndpointAuthBasicParam or BetaManagedAgentsTokenEndpointAuthPostParam`29142915    - `BetaManagedAgentsTokenEndpointAuthNoneParam object`29162917      Token endpoint requires no client authentication.29182919      - `type: "none"`29202921    - `BetaManagedAgentsTokenEndpointAuthBasicParam object`29222923      Token endpoint uses HTTP Basic authentication with client credentials.29242925      - `type: "client_secret_basic"`29262927      - `client_secret: string`29282929        OAuth client secret.29302931        minLength: 1, maxLength: 51229322933    - `BetaManagedAgentsTokenEndpointAuthPostParam object`29342935      Token endpoint uses POST body authentication with client credentials.29362937      - `type: "client_secret_post"`29382939      - `client_secret: string`29402941        OAuth client secret.29422943        minLength: 1, maxLength: 51229442945  - `resource: optional string or null`29462947    OAuth resource indicator.29482949    minLength: 1, maxLength: 204729502951  - `scope: optional string or null`29522953    OAuth scope for the refresh request.29542955    minLength: 1, maxLength: 819229562957### Beta Managed Agents MCP OAuth Refresh Response29582959- `BetaManagedAgentsMCPOAuthRefreshResponse object`29602961  OAuth refresh token configuration returned in credential responses.29622963  - `client_id: string`29642965    OAuth client ID.29662967  - `token_endpoint: string`29682969    Token endpoint URL used to refresh the access token.29702971  - `token_endpoint_auth: BetaManagedAgentsTokenEndpointAuthNoneResponse or BetaManagedAgentsTokenEndpointAuthBasicResponse or BetaManagedAgentsTokenEndpointAuthPostResponse`29722973    - `BetaManagedAgentsTokenEndpointAuthNoneResponse object`29742975      Token endpoint requires no client authentication.29762977      - `type: "none"`29782979    - `BetaManagedAgentsTokenEndpointAuthBasicResponse object`29802981      Token endpoint uses HTTP Basic authentication with client credentials.29822983      - `type: "client_secret_basic"`29842985    - `BetaManagedAgentsTokenEndpointAuthPostResponse object`29862987      Token endpoint uses POST body authentication with client credentials.29882989      - `type: "client_secret_post"`29902991  - `resource: optional string or null`29922993    OAuth resource indicator.29942995  - `scope: optional string or null`29962997    OAuth scope for the refresh request.29982999### Beta Managed Agents MCP OAuth Refresh Update Params30003001- `BetaManagedAgentsMCPOAuthRefreshUpdateParams object`30023003  Parameters for updating OAuth refresh token configuration.30043005  - `refresh_token: optional string or null`30063007    Updated OAuth refresh token.30083009    minLength: 1, maxLength: 819230103011  - `scope: optional string or null`30123013    Updated OAuth scope for the refresh request.30143015    maxLength: 819230163017  - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`30183019    - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`30203021      Updated HTTP Basic authentication parameters for the token endpoint.30223023      - `type: "client_secret_basic"`30243025      - `client_secret: optional string or null`30263027        Updated OAuth client secret.30283029        minLength: 1, maxLength: 51230303031    - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`30323033      Updated POST body authentication parameters for the token endpoint.30343035      - `type: "client_secret_post"`30363037      - `client_secret: optional string or null`30383039        Updated OAuth client secret.30403041        minLength: 1, maxLength: 51230423043### Beta Managed Agents MCP OAuth Update Params30443045- `BetaManagedAgentsMCPOAuthUpdateParams object`30463047  Parameters for updating an MCP OAuth credential. The `mcp_server_url` is immutable.30483049  - `type: "mcp_oauth"`30503051  - `access_token: optional string or null`30523053    Updated OAuth access token.30543055    minLength: 1, maxLength: 819230563057  - `expires_at: optional string or null`30583059    A timestamp in RFC 3339 format30603061    format: date-time30623063  - `refresh: optional BetaManagedAgentsMCPOAuthRefreshUpdateParams or null`30643065    Parameters for updating OAuth refresh token configuration.30663067    - `refresh_token: optional string or null`30683069      Updated OAuth refresh token.30703071      minLength: 1, maxLength: 819230723073    - `scope: optional string or null`30743075      Updated OAuth scope for the refresh request.30763077      maxLength: 819230783079    - `token_endpoint_auth: optional BetaManagedAgentsTokenEndpointAuthBasicUpdateParam or BetaManagedAgentsTokenEndpointAuthPostUpdateParam`30803081      - `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`30823083        Updated HTTP Basic authentication parameters for the token endpoint.30843085        - `type: "client_secret_basic"`30863087        - `client_secret: optional string or null`30883089          Updated OAuth client secret.30903091          minLength: 1, maxLength: 51230923093      - `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`30943095        Updated POST body authentication parameters for the token endpoint.30963097        - `type: "client_secret_post"`30983099        - `client_secret: optional string or null`31003101          Updated OAuth client secret.31023103          minLength: 1, maxLength: 51231043105### Beta Managed Agents MCP Probe31063107- `BetaManagedAgentsMCPProbe object`31083109  The failing step of an MCP validation probe.31103111  - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`31123113    An HTTP response captured during a credential validation probe.31143115    - `body: string`31163117      Response body. May be truncated and has sensitive values scrubbed.31183119    - `body_truncated: boolean`31203121      Whether `body` was truncated.31223123    - `content_type: string`31243125      Value of the `Content-Type` response header.31263127    - `status_code: number`31283129      HTTP status code.31303131      format: int3231323133  - `method: string`31343135    The MCP method that failed (for example `initialize` or `tools/list`).31363137### Beta Managed Agents Refresh HTTP Response31383139- `BetaManagedAgentsRefreshHTTPResponse object`31403141  An HTTP response captured during a credential validation probe.31423143  - `body: string`31443145    Response body. May be truncated and has sensitive values scrubbed.31463147  - `body_truncated: boolean`31483149    Whether `body` was truncated.31503151  - `content_type: string`31523153    Value of the `Content-Type` response header.31543155  - `status_code: number`31563157    HTTP status code.31583159    format: int3231603161### Beta Managed Agents Refresh Object31623163- `BetaManagedAgentsRefreshObject object`31643165  Outcome of a refresh-token exchange attempted during credential validation.31663167  - `http_response: BetaManagedAgentsRefreshHTTPResponse or null`31683169    An HTTP response captured during a credential validation probe.31703171    - `body: string`31723173      Response body. May be truncated and has sensitive values scrubbed.31743175    - `body_truncated: boolean`31763177      Whether `body` was truncated.31783179    - `content_type: string`31803181      Value of the `Content-Type` response header.31823183    - `status_code: number`31843185      HTTP status code.31863187      format: int3231883189  - `status: "succeeded" or "failed" or "connect_error" or "no_refresh_token"`31903191    Outcome of a refresh-token exchange attempted during credential validation.31923193    - `"succeeded"`31943195    - `"failed"`31963197    - `"connect_error"`31983199    - `"no_refresh_token"`32003201### Beta Managed Agents Static Bearer Auth Response32023203- `BetaManagedAgentsStaticBearerAuthResponse object`32043205  Static bearer token credential details for an MCP server.32063207  - `type: "static_bearer"`32083209  - `mcp_server_url: string`32103211    URL of the MCP server this credential authenticates against.32123213### Beta Managed Agents Static Bearer Create Params32143215- `BetaManagedAgentsStaticBearerCreateParams object`32163217  Parameters for creating a static bearer token credential.32183219  - `type: "static_bearer"`32203221  - `token: string`32223223    Static bearer token value.32243225    minLength: 1, maxLength: 819232263227  - `mcp_server_url: string`32283229    URL of the MCP server this credential authenticates against.32303231    minLength: 1, maxLength: 204732323233### Beta Managed Agents Static Bearer Update Params32343235- `BetaManagedAgentsStaticBearerUpdateParams object`32363237  Parameters for updating a static bearer token credential. The `mcp_server_url` is immutable.32383239  - `type: "static_bearer"`32403241  - `token: optional string or null`32423243    Updated static bearer token value.32443245    minLength: 1, maxLength: 819232463247### Beta Managed Agents Token Endpoint Auth Basic Param32483249- `BetaManagedAgentsTokenEndpointAuthBasicParam object`32503251  Token endpoint uses HTTP Basic authentication with client credentials.32523253  - `type: "client_secret_basic"`32543255  - `client_secret: string`32563257    OAuth client secret.32583259    minLength: 1, maxLength: 51232603261### Beta Managed Agents Token Endpoint Auth Basic Response32623263- `BetaManagedAgentsTokenEndpointAuthBasicResponse object`32643265  Token endpoint uses HTTP Basic authentication with client credentials.32663267  - `type: "client_secret_basic"`32683269### Beta Managed Agents Token Endpoint Auth Basic Update Param32703271- `BetaManagedAgentsTokenEndpointAuthBasicUpdateParam object`32723273  Updated HTTP Basic authentication parameters for the token endpoint.32743275  - `type: "client_secret_basic"`32763277  - `client_secret: optional string or null`32783279    Updated OAuth client secret.32803281    minLength: 1, maxLength: 51232823283### Beta Managed Agents Token Endpoint Auth None Param32843285- `BetaManagedAgentsTokenEndpointAuthNoneParam object`32863287  Token endpoint requires no client authentication.32883289  - `type: "none"`32903291### Beta Managed Agents Token Endpoint Auth None Response32923293- `BetaManagedAgentsTokenEndpointAuthNoneResponse object`32943295  Token endpoint requires no client authentication.32963297  - `type: "none"`32983299### Beta Managed Agents Token Endpoint Auth Post Param33003301- `BetaManagedAgentsTokenEndpointAuthPostParam object`33023303  Token endpoint uses POST body authentication with client credentials.33043305  - `type: "client_secret_post"`33063307  - `client_secret: string`33083309    OAuth client secret.33103311    minLength: 1, maxLength: 51233123313### Beta Managed Agents Token Endpoint Auth Post Response33143315- `BetaManagedAgentsTokenEndpointAuthPostResponse object`33163317  Token endpoint uses POST body authentication with client credentials.33183319  - `type: "client_secret_post"`33203321### Beta Managed Agents Token Endpoint Auth Post Update Param33223323- `BetaManagedAgentsTokenEndpointAuthPostUpdateParam object`33243325  Updated POST body authentication parameters for the token endpoint.33263327  - `type: "client_secret_post"`33283329  - `client_secret: optional string or null`33303331    Updated OAuth client secret.33323333    minLength: 1, maxLength: 51233343335### Beta Managed Agents Unrestricted Credential Networking Params33363337- `BetaManagedAgentsUnrestrictedCredentialNetworkingParams object`33383339  Substitute the secret on any host the session's Environment network policy permits egress to. The Environment's network policy is the only boundary on where the secret can reach.33403341  - `type: "unrestricted"`33423343### Beta Managed Agents Unrestricted Credential Networking Response33443345- `BetaManagedAgentsUnrestrictedCredentialNetworkingResponse object`33463347  The secret is substituted on any host the session's Environment network policy permits egress to.33483349  - `type: "unrestricted"`3350