Start connecting a credential through OAuth

Takes the client Subako presents to the provider and answers the URL to send the browser to. An mcp credential connects through the workspace OAuth client oauth_client_id names, or else Subako discovers the MCP server’s authorization server and registers a client with it for redirect_uri. An http credential always connects through a workspace OAuth client, and is sent to its origins as authorization: Bearer. The provider sends the browser back to redirect_uri with code and state, and the same caller completes the connection with them, once, within ten minutes.

POST/v1/vaults/{vault_id}/credentials/oauth

Authorization

AuthorizationBearer token · headerrequired

Path parameters

vault_idstring<uuid>required

Vault id

Header parameters

Idempotency-Keystring

Retry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.

min length 1 · max length 255

Request body

requiredapplication/json

One of:

object

display_namestringrequired

max length 200

oauth_client_idstring<uuid> | null

The workspace OAuth client to connect through, for a server whose provider registers no client on the spot. Omitted, Subako discovers the provider and registers a client there itself.

protocolstringrequired

Allowed:mcp

redirect_uristringrequired

The client's own page the provider sends the browser back to, with `code` and `state` (or `error`) in its query: an absolute http(s) URL without a fragment.

min length 1 · max length 2048

targetstringrequired

The MCP server's URL. Without `oauth_client_id`, it must answer an unauthenticated request with a challenge naming its protected resource metadata, or publish that metadata at its well-known URL, and its authorization server must register clients on the spot.

min length 1 · max length 2048

object

display_namestringrequired

max length 200

oauth_client_idstring<uuid>required

The workspace OAuth client to connect through.

originsHttpOriginBody[]required

The origins the credential is sent to, each at most once, and none another credential in the vault is already sent to.

min items 1 · max items 16

protocolstringrequired

Allowed:http

redirect_uristringrequired

As for `mcp`.

min length 1 · max length 2048

Responses

200Replayed start receipt. The authorization URL cannot be recovered; start again with a new Idempotency-Key.

expires_atstring<date-time>required

201Started.

authorization_urlstringrequired

expires_atstring<date-time>required

400Malformed body; an `mcp` target without an OAuth client that is not OAuth protected, whose authorization server cannot be discovered, does not support dynamic client registration, or refused the registration; or a target, origin, or endpoint the deployment's network policy does not reach.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

401Missing, malformed, or invalid bearer token.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

403Caller lacks credential.manage, or the organization may not create.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

404No such vault, or the caller cannot see it; or no such OAuth client in the vault's workspace.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

409Idempotency-Key was already used for a different request. Duplicate credential target, or an origin another credential in the vault is already sent to.

errorErrorDetailrequired

What went wrong: a `code` to branch on and a `message` to show. The message is written for a person and may change; the code will not.

Show properties

codeErrorCoderequired

The machine-readable half of an error response, and the field a client branches on. Closed: every error carries exactly one of these.

Allowed:unauthorizedforbiddennot_foundinvalid_requestconflictclient_outdatedprecondition_failedtoo_many_requestsinternal

messagestringrequired

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer tokenRemember on this deviceInclude my values in samples

Parameters

Idempotency-KeyheaderRetry the same operation with this key to return its saved receipt. Scoped by the operation's authenticated caller or resource. A different input under the same key returns 409. Receipts are retained for at least 7 days after completion, then removed by an hourly sweep. After removal the key can execute again. Fresh-only secrets are never included in a replay.vault_idpath*Vault id

Bodyapplication/json

Request body

Request

curl -X POST "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/oauth" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "display_name": "string",
  "oauth_client_id": "727760ca-b97d-449c-90e5-7773c8142d5d",
  "protocol": "mcp",
  "redirect_uri": "string",
  "target": "string"
}'

const response = await fetch("https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/oauth", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"display_name\": \"string\",\n  \"oauth_client_id\": \"727760ca-b97d-449c-90e5-7773c8142d5d\",\n  \"protocol\": \"mcp\",\n  \"redirect_uri\": \"string\",\n  \"target\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://api.us.cloud.subako.ai/v1/vaults/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials/oauth",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"display_name\": \"string\",\n  \"oauth_client_id\": \"727760ca-b97d-449c-90e5-7773c8142d5d\",\n  \"protocol\": \"mcp\",\n  \"redirect_uri\": \"string\",\n  \"target\": \"string\"\n}",
)

Response

{
  "expires_at": "2019-08-24T14:15:22Z"
}

{
  "authorization_url": "string",
  "expires_at": "2019-08-24T14:15:22Z"
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "string"
  }
}