Validate an MCP OAuth credential

POST /api/v1/cloud/vaults/{vault_id}/credentials/{credential_id}/mcp_oauth_validate Performs a live validation of an active mcp_oauth credential: if the credential holds a refresh token, CAS first attempts a token refresh (a successful refresh persists the rotated tokens), then probes the MCP server with an initialize request using the current access token.

Path parameters

Parameter	Type	Description
`vault_id`	string	Vault ID with the `vault_` prefix
`credential_id`	string	Credential ID with the `vcred_` prefix; must be an active `mcp_oauth` credential

Headers

Header	Required	Description
`Authorization`	Yes	`Bearer <PAT or SAT>`
`Content-Type`	Yes	`application/json`

Request body

Send an empty JSON object:

{}

Example request

curl -X POST "https://api.qoder.com/api/v1/cloud/vaults/vault_019e3bb940277f0db05ab74291acf6ef/credentials/vcred_019e3bb98877759e862750b495c1fce8/mcp_oauth_validate" \
  -H "Authorization: Bearer $QODER_PAT" \
  -H "Content-Type: application/json" \
  -d '{}'

Example response

HTTP 200 OK

{
  "credential_id": "vcred_019e3bb98877759e862750b495c1fce8",
  "vault_id": "vault_019e3bb940277f0db05ab74291acf6ef",
  "type": "vault_credential_validation",
  "status": "invalid",
  "validated_at": "2026-08-19T02:58:16Z",
  "has_refresh_token": false,
  "refresh": {
    "status": "no_refresh_token",
    "http_response": null
  },
  "mcp_probe": {
    "method": "initialize",
    "http_response": {
      "status_code": 401,
      "content_type": "application/json",
      "body": "{\"error\":\"invalid_token\"}",
      "body_truncated": false
    }
  }
}

Response fields

Field	Type	Description
`credential_id` / `vault_id`	string	The validated credential and its Vault
`type`	string	Always `vault_credential_validation`
`status`	string	Overall result: `valid`, `invalid`, or `unknown`
`validated_at`	string	Validation time in RFC 3339 format
`has_refresh_token`	boolean	Whether the credential stores a refresh token
`refresh.status`	string	`no_refresh_token`, `succeeded`, `failed`, or `connect_error`
`refresh.http_response`	object \| null	Token-endpoint response captured on refresh failure
`mcp_probe`	object \| null	Present only when the MCP probe fails; `method` names the failed MCP call
`*.http_response`	object	`status_code`, `content_type`, `body` (bounded and secret-scrubbed), `body_truncated`

Status semantics

valid — the MCP server accepted the initialize probe with the current access token.
invalid — a deterministic rejection: the probe or refresh got a 4xx response (other than 408/429), or the credential has no usable access token.
unknown — the check could not reach a verdict: connection errors, timeouts, 408/429, or 5xx responses. Retry later before treating the credential as broken.

A succeeded refresh updates the stored tokens as a side effect, so validation can heal a near-expiry credential.

Errors

HTTP	Type	Trigger
404	`not_found_error`	Vault or credential does not exist or is not accessible
409	`conflict_error`	Credential is archived, or its type is not `mcp_oauth`

​Path parameters

​Headers

​Request body

​Example request

​Example response

​Response fields

​Status semantics

​Errors