# Credential API map

> Navigate provider discovery and installation, Credential creation, OAuth authorization, rotation, version activation, revocation, and inspection.

Credential operations are namespace-scoped and provider-driven. Secret material is accepted only where documented and is never returned. Use the dedicated [Credential HTTP API](/docs/credentials/reference/http-api) and downloadable OpenAPI document as the schema-level source of truth.

## Endpoint families {#families}

| Family | Operations |
| --- | --- |
| Provider catalog | `GET /credential-provider-catalog` |
| Installed providers | `GET /credential-providers`, `GET /credential-providers/:id` |
| Install provider | `POST /credential-providers/install` with package, non-secret config, and existing or one-time bootstrap inputs |
| Credentials | `GET` / `POST /credentials`, `GET /credentials/:id` |
| Imported versions | `POST /credentials/:id/versions`, then `/activate` |
| Provider lifecycle | `POST /credentials/:id/rotate`, `/authorize`, or `/revoke` |
| Inspection | `GET /credentials/:id/consumers`, `/uses`, and `/events` |
| Browser callback | `GET /v1/credential-authorizations/callback`; called by the external service, not client automation |

All relative paths above follow `/v1/namespaces/:namespace` except the public callback and deployment upload. Custom Credential Provider packages are uploaded through `POST /v1/deployments`, which publishes a package into the visible catalog; installation is a separate operation that binds namespace configuration and bootstrap Credentials.

Agent code does not call these lifecycle endpoints and cannot read material. It invokes a governed Resource, whose protected integration receives the active version for a declared slot. Read [Use a credential from an agent](/docs/credentials/use-from-agent) and [Credential Provider SDK reference](/docs/credentials/reference/sdk) for the two runtime boundaries.