Skip to content
Subako Docs
English
English日本語Not translated
Esc
↑↓navigate↵open⌘Jpreview

List credentials

GET/v1/vaults/{vault_id}/credentials
Authorization
AuthorizationBearer token · headerrequired
Path parameters
vault_idstring<uuid>required
Vault id
Query parameters
limitinteger<int64>
min 1 · max 200
afterstring<uuid>
Rows past this id in `order`'s direction: a page's `next_cursor`.
beforestring<uuid>
Rows just before this id, still in `order`'s direction: a page's `prev_cursor`.
orderOrderParam
Newest first when omitted.
Allowed:ascdesc
Responses
200Credential metadata, newest first unless order=asc; never payloads.
itemsCredentialBody[]required
Show properties
Array of CredentialBody
One of:
object
auth_schemeMcpSchemeBodyrequired
How an `mcp` credential authenticates against its server.
Allowed:oauthstatic_bearer
display_namestringrequired
idstring<uuid>required
oauth_client_idstring<uuid> | nullrequired
The workspace OAuth client an `oauth` credential was connected through; null for one whose client Subako registered with the server's provider itself, and for any other scheme.
protocolstringrequired
Allowed:mcp
statusCredentialStatusBodyrequired
Whether a credential is sent to its server: `reconnect_required` once the provider refused its refresh, until it is reconnected.
Allowed:activereconnect_required
targetstringrequired
The MCP server's exact URL.
vault_idstring<uuid>required
object
auth_schemeHttpSchemeBodyrequired
How an `http` credential authenticates against its origins: headers it was given, or an OAuth token sent as `authorization: Bearer`.
Allowed:headeroauth
display_namestringrequired
headersCredentialHeaderNameBody[]required
Every header the credential is sent as, in the order it was added: `authorization` alone for an `oauth` one.
Show properties
Array of CredentialHeaderNameBody
namestringrequired
The header's name, in lowercase.
idstring<uuid>required
oauth_client_idstring<uuid> | nullrequired
The workspace OAuth client an `oauth` credential was connected through; null for a `header` one.
originsstring[]required
Every origin the credential is sent to, as the vault stores them, in the order they were given.
protocolstringrequired
Allowed:http
statusCredentialStatusBodyrequired
Whether a credential is sent to its server: `reconnect_required` once the provider refused its refresh, until it is reconnected.
Allowed:activereconnect_required
vault_idstring<uuid>required
next_cursorstring<uuid> | nullrequired
Pass back as `after` for the next page; `null` on the last page.
prev_cursorstring<uuid> | nullrequired
Pass back as `before` for the previous page; `null` on the first page.
400Bad limit, cursor, or order.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
401Missing, malformed, or invalid bearer token.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
403Caller lacks credential.read.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
404No such vault, or the caller cannot see it.
errorErrorDetailrequired
What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.
Show properties
codeErrorCoderequired
The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.
Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal
messagestringrequired
Try it
Server
Authorization
Parameters
Request
curl -X GET "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials" \
  -H "Authorization: Bearer YOUR_TOKEN"
Response
{
  "items": [
    {
      "auth_scheme": "oauth",
      "display_name": "string",
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "oauth_client_id": "727760ca-b97d-449c-90e5-7773c8142d5d",
      "protocol": "mcp",
      "status": "active",
      "target": "string",
      "vault_id": "432b199b-1f71-42bf-ba0b-33d512afa9de"
    }
  ],
  "next_cursor": "a7ec8888-a9c3-4732-a281-9a08510f220b",
  "prev_cursor": "2ffdd032-1f96-48c2-8179-571201598694"
}