Forward API reference.
Vault credential object
Create, get, list, and archive endpoints return this structure. Credential secrets such as token, access_token, refresh_token, client_secret, and secret_value are accepted only in create requests and are never returned in responses.
| Field | Type | Description |
|---|---|---|
id | string | Credential ID with the vcred_ prefix |
type | string | Always "vault_credential" |
vault_id | string | Owning Vault ID |
auth | Credential auth object | Sanitized auth details; secrets are never returned |
display_name | string | null | Compatibility field. Currently always null and not persisted |
metadata | object | Custom metadata object stored with the credential; defaults to {} |
archived_at | string | null | Archive time in RFC 3339 format; null while active |
created_at | string | Creation time in RFC 3339 format |
updated_at | string | Last update time in RFC 3339 format |
Create credential request
| Field | Type | Required | Description |
|---|---|---|---|
auth | Credential auth object | Yes | Credential authentication information |
display_name | string | No | Accepted for compatibility; currently returned as null and not persisted |
metadata | object | No | Custom metadata stored with the credential; defaults to {} |
Credential auth object
auth uses type to select the authentication type. Responses never include secret fields.
static_bearer
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | Always "static_bearer" |
mcp_server_url | string | Yes | MCP server URL, at most 2048 characters |
token | string | Yes (request) | Static Bearer token. Accepted only in create requests and never returned in responses |
mcp_oauth
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | Always "mcp_oauth" |
mcp_server_url | string | Yes | MCP server URL, at most 2048 characters |
client_id | string | Yes | OAuth client ID |
client_secret | string | Yes (request) | OAuth client secret. Accepted only in create requests and never returned in responses |
access_token | string | No (request) | Access token already obtained through OAuth. Accepted only in create requests and never returned in responses |
refresh_token | string | No (request) | OAuth refresh token. Accepted only in create requests and never returned in responses |
secret_value
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | Always "secret_value" |
secret_value | string | Yes (request) | Generic secret value. Accepted only in create requests and never returned in responses |
The create endpoint for the Forward Credential API defines the supported authentication types. Unlisted types return 400 invalid_request_error during creation.
List pagination fields
| Field | Type | Description |
|---|---|---|
data | array of Vault credential objects | Records on the current page |
has_more | boolean | Whether another page is available |
next_page | string | null | Forward cursor for the next page (recommended). Equals the current page's last_id when has_more=true; otherwise null |
first_id | string | null | ID of the first record on the current page |
last_id | string | null | ID of the last record on the current page |
page, after_id, and before_id are mutually exclusive; providing more than one returns 400. Use page where possible; it has the same semantics as after_id.