> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qoder.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault data structures

> Shared Vault and credential structures.

## Vault object

Returned by create, get, list, and archive endpoints.

| Field          | Type                                           | Description                                                                                                        |
| -------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| `id`           | string                                         | Vault ID with the `vault_` prefix                                                                                  |
| `type`         | string                                         | Always `"vault"`                                                                                                   |
| `display_name` | string                                         | Vault display name, at most 255 characters                                                                         |
| `metadata`     | object                                         | [Metadata object](/cloud-agents/api/conventions/schemas#metadata-object)                                           |
| `credentials`  | array of [Vault credential](#vault-credential) | Returned only when creating a Vault and always empty; manage credentials through the separate credential endpoints |
| `archived_at`  | string \| null                                 | Archive time, or `null` when active                                                                                |
| `created_at`   | string                                         | Creation time                                                                                                      |
| `updated_at`   | string                                         | Last update time                                                                                                   |

## Vault credential

Returned by the create credential, list credentials, and archive credential endpoints.

| Field          | Type                                              | Description                                                         |
| -------------- | ------------------------------------------------- | ------------------------------------------------------------------- |
| `id`           | string                                            | Credential ID with the `vcred_` prefix                              |
| `type`         | string                                            | Always `"vault_credential"`                                         |
| `vault_id`     | string                                            | Owning Vault ID                                                     |
| `auth`         | [Credential auth object](#credential-auth-object) | Sanitized auth details; secrets are never returned                  |
| `display_name` | null                                              | Currently always `null`                                             |
| `metadata`     | object                                            | Custom metadata object stored with the credential; defaults to `{}` |
| `archived_at`  | string \| null                                    | Archive time, or `null` when active                                 |
| `created_at`   | string                                            | Creation time                                                       |
| `updated_at`   | string                                            | Last update time                                                    |

Credential secrets, including `token`, `access_token`, `refresh_token`, `client_secret`, and `secret_value`, are accepted on create requests but are never returned.

## Create credential request

| Field          | Type   | Required | Description                                                                |
| -------------- | ------ | -------- | -------------------------------------------------------------------------- |
| `auth`         | object | Yes      | Credential authentication details                                          |
| `display_name` | string | No       | Accepted for compatibility; currently returned as `null` and not persisted |
| `metadata`     | object | No       | Custom metadata stored with the credential; defaults to `{}`               |

## Credential auth object

### `static_bearer`

| Field            | Type   | Required | Description                                               |
| ---------------- | ------ | -------- | --------------------------------------------------------- |
| `type`           | string | Yes      | `static_bearer`                                           |
| `mcp_server_url` | string | Yes      | MCP server URL, at most 2048 characters                   |
| `token`          | string | Yes      | Bearer token stored securely in the Vault; never returned |

Response auth omits `token`.

### `mcp_oauth`

| Field            | Type   | Required | Description                                                                |
| ---------------- | ------ | -------- | -------------------------------------------------------------------------- |
| `type`           | string | Yes      | `mcp_oauth`                                                                |
| `mcp_server_url` | string | Yes      | MCP server URL, at most 2048 characters                                    |
| `access_token`   | string | Yes      | OAuth access token; never returned                                         |
| `expires_at`     | string | No       | Access token expiration time in RFC 3339 format                            |
| `refresh`        | object | No       | Refresh configuration. Returned without `refresh_token` or `client_secret` |

### `environment_variable`

| Field          | Type   | Required | Description                                                                   |
| -------------- | ------ | -------- | ----------------------------------------------------------------------------- |
| `type`         | string | Yes      | `environment_variable`                                                        |
| `secret_name`  | string | Yes      | Environment variable name. Must match `[A-Za-z_][A-Za-z0-9_]*`                |
| `secret_value` | string | Yes      | Secret value; never returned                                                  |
| `networking`   | object | No       | Accepted for compatibility; currently a no-op and returned as an empty object |