The Credential API provides create, query, update, archive, and delete operations for individual secrets within a Vault.
Overview
A Credential is a specific secret stored within a Vault. The auth field currently supports only the environment_variable type. Sensitive values such as secret_value are write-only: accepted on create and update but never returned in responses. Archive is a soft operation: an archived Credential is no longer injected into sessions but can still be queried. Deletion is permanent and cannot be undone.
Credential operations
| Operation | Endpoint | Description |
|---|---|---|
| Create Credential | POST /vaults/{vault_id}/credentials | Create a Credential in a specified Vault |
| Get Credential | GET /vaults/{vault_id}/credentials/{credential_id} | Get Credential details; sensitive values are masked in the response |
| List Credentials | GET /vaults/{vault_id}/credentials | Paginated list of Credentials under a specified Vault |
| Update Credential | POST /vaults/{vault_id}/credentials/{credential_id} | Update display name, auth, or metadata; type and secret_name are immutable |
| Archive Credential | POST /vaults/{vault_id}/credentials/{credential_id}/archive | Soft archive; the Credential is no longer injected into sessions |
| Delete Credential | DELETE /vaults/{vault_id}/credentials/{credential_id} | Permanent deletion, cannot be undone |