Credential API map
Navigate provider discovery and installation, Credential creation, OAuth authorization, rotation, version activation, revocation, and inspection.
Credential operations are namespace-scoped and provider-driven. Secret material is accepted only where documented and is never returned. Use the dedicated Credential HTTP API and downloadable OpenAPI document as the schema-level source of truth.
Endpoint families
| Family | Operations |
|---|---|
| Provider catalog | GET /credential-provider-catalog |
| Installed providers | GET /credential-providers, GET /credential-providers/:id |
| Install provider | POST /credential-providers/install with package, non-secret config, and existing or one-time bootstrap inputs |
| Credentials | GET / POST /credentials, GET /credentials/:id |
| Imported versions | POST /credentials/:id/versions, then /activate |
| Provider lifecycle | POST /credentials/:id/rotate, /authorize, or /revoke |
| Inspection | GET /credentials/:id/consumers, /uses, and /events |
| Browser callback | GET /v1/credential-authorizations/callback; called by the external service, not client automation |
All relative paths above follow /v1/namespaces/:namespace except the public callback and deployment upload. Custom Credential Provider packages are uploaded through POST /v1/deployments, which publishes a package into the visible catalog; installation is a separate operation that binds namespace configuration and bootstrap Credentials.
Agent code does not call these lifecycle endpoints and cannot read material. It invokes a governed Resource, whose protected integration receives the active version for a declared slot. Read Use a credential from an agent and Credential Provider SDK reference for the two runtime boundaries.