Skip to main content
GET
Get one credential reference

Authorizations

Authorization
string
header
required

A Recursion API key, created in the console under API keys.

Headers

x-tenant-id
string

Optional tenant consistency check. When present, it must name the tenant bound to the API key, including when x-organization-id is default.

Minimum string length: 1
x-organization-id
string

Organization in which to act. Required for a tenant-scoped API key. Optional for an organization-scoped key, where it must name that same organization. The value may be an organization id or default.

Minimum string length: 1

Path Parameters

vaultId
string<uuid>
required

Vault id (UUID) that owns the credential.

credentialId
string<uuid>
required

Credential reference id (UUID) within the vault, as returned by managedAgentsListVaultCredentials.

Response

OK

createdAt
string<date-time>
required

Server-assigned RFC 3339 creation time.

credentialId
string
required

Server-assigned credential identifier (UUID), unique within the vault.

credentialType
string
required

How the credential is used. Legacy rows may report additional kinds.

organizationId
string
required

Organization that owns this record, resolved from the authenticated principal.

updatedAt
string<date-time>
required

Server-assigned RFC 3339 last update time.

vaultId
string
required

Vault that owns this credential (UUID).

allowedHosts
string[]

Recorded host intent for limited network mode.

displayName
string

Optional operator-facing credential label.

integrationConnectionId
string

Organization integration connection granted by this credential (UUID).

integrationPermission
string

Validated provider permission preset.

integrationResources
string[]

Provider resources the integration grant is narrowed to.

mcpServerUrl
string

MCP server this credential may be sent to.

metadata
object

Caller-supplied labels, with compatibility-only scope data excluded.

platformMcpService
enum<string>

Deployment-derived identity of an exact platform MCP service; never caller-controlled or stored.

Available options:
slack_tools
provider
enum<string>

Catalog service for a proxied env_var credential, absent for credentials supplied directly to the sandbox.

Available options:
anthropic,
openai,
slack,
stripe
secretName
string

Environment variable or header name the secret binds to.

secretRef
string

Opaque pointer to externally stored secret material.