Check a credential against its server

Resolves the credential as a session would, refreshing an OAuth one about to lapse, and sends its server an MCP initialize with it. A server that refuses an OAuth credential gets one refresh and one more try; refused again, or refused a refresh, the credential is marked reconnect_required. A credential already marked is not sent.

POST/v1/vaults/{vault_id}/credentials/{credential_id}/check

Authorization

AuthorizationBearer token · headerrequired

Path parameters

vault_idstring<uuid>required

Vault id

credential_idstring<uuid>required

Credential id

Header parameters

Idempotency-Keystring

Retry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.

min length 1 · max length 255

Responses

200What the server answered.

resultCredentialCheckResultrequired

What checking a credential against its server found.

Allowed:connectedrejectedreconnect_required

400Malformed path parameter; an `http` credential, which has no server to check; or the server or its provider's token endpoint could not be reached, or the deployment's network policy does not reach it.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

401Missing, malformed, or invalid bearer token.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

403Caller lacks credential.manage.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

404No such vault or credential, or the caller cannot see it.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

409Idempotency-Key was already used for a different request. The credential was refreshed or reconnected while it was being checked.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer tokenRemember on this deviceInclude my values in samples

Parameters

Idempotency-KeyheaderRetry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.vault_idpath*Vault idcredential_idpath*Credential id

Request

curl -X POST "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/497f6eca-6276-4993-bfeb-53cbbbba6f08/check" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/497f6eca-6276-4993-bfeb-53cbbbba6f08/check", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.post(
    "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/497f6eca-6276-4993-bfeb-53cbbbba6f08/check",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "result": "connected"
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}