Skip to main content
A vault holds credentials that are injected at the network boundary and never revealed. Seven methods, and no read of a secret anywhere. API detail: Vaults.
There is no reveal method, and that is the contract, not an omission. The control plane serves no reveal route and the credential schema has no value field, so credentials.list could not return one even if a handler tried.

​
create

POST /v1/vaults. VaultCreate is { display_name, identity_id? } — bind the vault to one persona or leave it org-wide.

​
list

GET /v1/vaults, cursor-paginated.

​
get

GET /v1/vaults/{id}.

​
delete

DELETE /v1/vaults/{id}. Soft-deletes the vault; its credentials go for real. Irreversible for the secrets.

​
credentials.create

POST /v1/vaults/{id}/credentials — the only call in the system that carries a secret. value travels once, on this call, and is sealed server-side; the response is metadata only.
​
VaultCredentialKind
required
What kind of secret this is (e.g. env_var, the MCP kinds).
​
string
required
The name the secret is injected under.
​
string
required
The secret. Write-only.
​
string
Only meaningful for env_var — the egress host it substitutes at.
​
string
Required for the two MCP kinds.
​
string
The one agent the token may be injected into. Omitted, any agent that declares the URL.
​
string
Optional expiry.

​
credentials.list

GET /v1/vaults/{id}/credentials. Metadata only — key, kind, last_injected_at; never a value.

​
credentials.delete

DELETE /v1/vaults/{id}/credentials/{credential_id}. Rotation is create-new + delete-old. There is no update, so last_injected_at stays attributable to exactly one secret.