Get one credential reference
Returns one credential reference with its type, injection locations, and egress bounds. The credential must belong to the vault in the path, and the secret value is never included.
Authorizations
A Recursion API key, created in the console under API keys.
Path Parameters
Vault id (UUID) that owns the credential.
Credential reference id (UUID) within the vault, as returned by listVaultCredentials.
Response
One credential in a vault, described without its secret value — no field on this shape can carry secret material, which is what makes it safe to list over the API. Returned when managing a vault's contents; the value itself is opened only inside a running session.
One credential in a vault, described without its secret value — no field on this shape can carry secret material, which is what makes it safe to list over the API. Returned when managing a vault's contents; the value itself is opened only inside a running session.
RFC 3339 timestamp of when this record was created. Server-assigned.
Identifier for this credential (UUID). Server-assigned, and unique only within its vault.
How the credential is used: bearer_token, env_var, or webhook_secret. Legacy rows may report mcp_oauth or integration, so this remains a string rather than a closed response enum.
Organization that owns this record. Resolved from the API key; never accepted from the caller.
RFC 3339 timestamp of the last change to this record. Server-assigned.
Vault this credential belongs to (UUID).
Hosts the credential may be sent to when network_mode is limited. Ignored under unrestricted.
Operator-facing label for the credential. Optional: a credential is identifiable by its secret_name or MCP server without one.
Where the credential is attached to an outbound request: headers, body, or both. Headers alone is recommended; a secret in a request body is far easier to log by accident. Meaningful only for the MCP OAuth and bearer-token kinds: env_var is injected into the sandbox environment, and integration mints its own token per session.
Organization integration connection this credential grants a session (UUID). Set only for the integration kind, where it replaces sealed material: the provider mints a short-lived token per session.
Permission preset applied when a token is minted for this grant; see the provider's scope table. An unknown value is rejected on write rather than at mint time.
Resources within the connection the grant is narrowed to — repositories, for GitHub. Empty means every resource the connection itself can reach, which is broader than most grants should be.
Labelbox product-state authorization ceiling: either exact projects or organization-wide access, optionally restricted to one exact Slack audience with an explicit internal or Slack Connect classification. Required for a bearer_token credential whose mcp_server_url is that service; rejected for any other server. Replaced as a whole on update and kept when omitted.
MCP server this credential may be sent to. Required for bearer_token and immutable afterwards, so a stored secret cannot be repointed at a different service.
Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service. The key labelbox_scope is reserved for the typed field of that name.
How far the credential may travel: limited confines it to allowed_hosts, unrestricted permits any host. limited is the safe default.
limited, unrestricted Deployment-derived identity of the exact platform MCP service this credential targets. Present as slack_tools only when mcp_server_url matches the configured Slack tools endpoint; never caller-controlled or stored.
slack_tools Environment variable or header name the secret binds to inside the sandbox. Required for the env_var kind.
Pointer to material stored in an external secret manager, carrying a provider prefix such as kms: or vault:. Opaque to this service, and empty on the normal path where the value is sealed into the credential itself.