Add a credential

The payload is sealed on the way in and is never returned by any route. An mcp credential targets its server’s URL and is oauth or static_bearer; an http one is sent to one or more origins (https://host[:port], nothing past it) and is header here, a list of headers sent with every request to them. An oauth http credential is connected through the OAuth route instead.

POST/v1/vaults/{vault_id}/credentials

Authorization

AuthorizationBearer token · headerrequired

Path parameters

vault_idstring<uuid>required

Vault id

Header parameters

Idempotency-Keystring

Retry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.

min length 1 · max length 255

Request body

requiredapplication/json

One of:

object

display_namestringrequired

max length 200

payloadMcpPayloadBodyrequired

How an `mcp` credential authenticates: an OAuth grant this vault refreshes, or a bearer token supplied once.

Show properties

One of:

object

access_tokenstringrequired

auth_schemestringrequired

Allowed:oauth

expires_atstring | null

refreshany | RefreshBlockBody

Show properties

One of:

any

any

RefreshBlockBody

client_idstringrequired

refresh_tokenstringrequired

scopestring | null

token_endpointstringrequired

token_endpoint_authobjectrequired

How the client authenticates to the token endpoint. Opaque: the fields depend on the method and on the provider, so no shape is promised.

object

auth_schemestringrequired

Allowed:static_bearer

tokenstringrequired

protocolstringrequired

Allowed:mcp

targetstringrequired

The MCP server's exact URL.

min length 1 · max length 2048

object

display_namestringrequired

max length 200

originsHttpOriginBody[]required

Each at most once, and none another credential in the vault is already sent to.

min items 1 · max items 16

payloadHttpPayloadBodyrequired

How an `http` credential authenticates: headers sent with every request to its origin.

Show properties

One of:

object

auth_schemestringrequired

Allowed:header

headersCredentialHeaderBody[]required

Each name at most once.

min items 1 · max items 16

Show properties

Array of CredentialHeaderBody

namestringrequired

An HTTP token, compared without regard to case and stored in lowercase. A header the client or a proxy owns (`host`, `content-length`, `transfer-encoding`, `connection`, `keep-alive`, `te`, `trailer`, `upgrade`, `proxy-*`) is refused.

min length 1 · max length 256

valuestringrequired

Visible characters, with spaces or tabs only between them; at most 8192 bytes.

min length 1 · max length 8192

protocolstringrequired

Allowed:http

Responses

201Created.

idstring<uuid>required

400Malformed body, including an auth scheme the protocol does not take; a header or an origin named twice; or an `http` origin that is not one, or one the deployment's network policy does not reach.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

401Missing, malformed, or invalid bearer token.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

403Caller lacks credential.manage.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

404No such vault, or the caller cannot see it.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

409Idempotency-Key was already used for a different request. Duplicate credential target, or an origin another credential in the vault is already sent to.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer tokenRemember on this deviceInclude my values in samples

Parameters

Idempotency-KeyheaderRetry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.vault_idpath*Vault id

Bodyapplication/json

Request body

Request

curl -X POST "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "display_name": "string",
  "payload": {
    "access_token": "string",
    "auth_scheme": "oauth",
    "expires_at": "string",
    "refresh": {}
  },
  "protocol": "mcp",
  "target": "string"
}'

const response = await fetch("https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"display_name\": \"string\",\n  \"payload\": {\n    \"access_token\": \"string\",\n    \"auth_scheme\": \"oauth\",\n    \"expires_at\": \"string\",\n    \"refresh\": {}\n  },\n  \"protocol\": \"mcp\",\n  \"target\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"display_name\": \"string\",\n  \"payload\": {\n    \"access_token\": \"string\",\n    \"auth_scheme\": \"oauth\",\n    \"expires_at\": \"string\",\n    \"refresh\": {}\n  },\n  \"protocol\": \"mcp\",\n  \"target\": \"string\"\n}",
)

Response

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}