Vault data structures

Vault object

Returned by create, get, list, and archive endpoints.

Field	Type	Description
`id`	string	Vault ID with the `vault_` prefix
`type`	string	Always `"vault"`
`display_name`	string	Vault display name, at most 255 characters
`metadata`	object	Metadata object
`credentials`	array of Vault credential	Returned only when creating a Vault and always empty; manage credentials through the separate credential endpoints
`archived_at`	string \| null	Archive time, or `null` when active
`created_at`	string	Creation time
`updated_at`	string	Last update time

Vault credential

Returned by the create credential, list credentials, and archive credential endpoints.

Field	Type	Description
`id`	string	Credential ID with the `vcred_` prefix
`type`	string	Always `"vault_credential"`
`vault_id`	string	Owning Vault ID
`auth`	Credential auth object	Sanitized auth details; secrets are never returned
`display_name`	null	Currently always `null`
`metadata`	object	Custom metadata object stored with the credential; defaults to `{}`
`archived_at`	string \| null	Archive time, or `null` when active
`created_at`	string	Creation time
`updated_at`	string	Last update time

Credential secrets, including token, access_token, refresh_token, client_secret, and secret_value, are accepted on create requests but are never returned.

Create credential request

Field	Type	Required	Description
`auth`	object	Yes	Credential authentication details
`display_name`	string	No	Accepted for compatibility; currently returned as `null` and not persisted
`metadata`	object	No	Custom metadata stored with the credential; defaults to `{}`

Credential auth object

`static_bearer`

Field	Type	Required	Description
`type`	string	Yes	`static_bearer`
`mcp_server_url`	string	Yes	MCP server URL, at most 2048 characters
`token`	string	Yes	Bearer token stored securely in the Vault; never returned

Response auth omits token.

`mcp_oauth`

Field	Type	Required	Description
`type`	string	Yes	`mcp_oauth`
`mcp_server_url`	string	Yes	MCP server URL, at most 2048 characters
`access_token`	string	Yes	OAuth access token; never returned
`expires_at`	string	No	Access token expiration time in RFC 3339 format
`refresh`	object	No	Refresh configuration. Returned without `refresh_token` or `client_secret`

`environment_variable`

Field	Type	Required	Description
`type`	string	Yes	`environment_variable`
`secret_name`	string	Yes	Environment variable name. Must match `[A-Za-z_][A-Za-z0-9_]*`
`secret_value`	string	Yes	Secret value; never returned
`networking`	object	No	Accepted for compatibility; currently a no-op and returned as an empty object

First steps

Define your agent

Configure agent environment

Delegate work to your agent

Manage agent context

Best Practices

API reference

Vault data structures

Vault object

Vault credential

Create credential request

Credential auth object

`static_bearer`

`mcp_oauth`

`environment_variable`

​Vault object

​Vault credential

​Create credential request

​Credential auth object

​static_bearer

​mcp_oauth

​environment_variable

Vault object

Vault credential

Create credential request

Credential auth object

`static_bearer`

`mcp_oauth`

`environment_variable`