> ## Documentation Index
> Fetch the complete documentation index at: https://oma-codex-339-workspace-permissions.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Credential

> Get Credential through the OMA API.

<Info>Every request requires `?beta=true`.</Info>


## OpenAPI

````yaml /openapi/oma.en.json get /v1/vaults/{vault_id}/credentials/{credential_id}
openapi: 3.1.0
info:
  title: OMA API Reference
  version: 1.0.0
  description: Open Managed Agents application API reference.
servers:
  - url: http://localhost:38080
    description: Local OMA server
security:
  - omaApiKey: []
  - omaBearer: []
paths:
  /v1/vaults/{vault_id}/credentials/{credential_id}:
    get:
      summary: Get Credential
      operationId: BetaGetCredential
      parameters:
        - name: beta
          in: query
          required: true
          description: Selects the beta API contract for this endpoint. Must be `true`.
          schema:
            type: boolean
            enum:
              - true
        - name: anthropic-version
          in: header
          required: false
          schema:
            type: string
        - name: anthropic-beta
          in: header
          required: false
          schema:
            type: string
            items:
              type: string
            x-stainless-override-schema:
              x-stainless-param: betas
              x-stainless-extend-default: true
              type: array
              description: Optional header to specify the beta version(s) you want to use.
              items:
                $ref: '#/components/schemas/AnthropicBeta'
            x-default: managed-agents-2026-04-01
        - name: vault_id
          in: path
          required: true
          schema:
            type: string
          description: Path parameter vault_id
          example: vlt_011CZkZDLs7fYzm1hXNPeRjv
        - name: credential_id
          in: path
          required: true
          schema:
            type: string
          description: Path parameter credential_id
          example: vcrd_011CZkZEMt8gZan2iYOQfSkw
      responses:
        '200':
          description: Successful response (OK)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaManagedAgentsCredential'
        '400':
          description: Invalid argument - The client specified an invalid argument
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '401':
          description: >-
            Unauthenticated - The request does not have valid authentication
            credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '403':
          description: >-
            Permission denied - The caller does not have permission to execute
            the specified operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '404':
          description: Not found - Some requested entity was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '408':
          description: >-
            Deadline exceeded - The deadline expired before the operation could
            complete
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '409':
          description: Aborted - The operation was aborted due to concurrency issue
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '412':
          description: >-
            Failed precondition - Operation was rejected because the system is
            not in required state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '413':
          description: Out of range - Operation was attempted past the valid range
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '429':
          description: >-
            Resource exhausted - Some resource has been exhausted (rate
            limiting)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '431':
          description: Request header fields too large - Request metadata was too large
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '499':
          description: Cancelled - The operation was cancelled by the client
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '500':
          description: Internal - Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '501':
          description: Unimplemented - The operation is not implemented or supported
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '503':
          description: Unavailable - The service is currently unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
        '504':
          description: Deadline exceeded - Upstream service did not respond in time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BetaErrorResponse'
components:
  schemas:
    BetaManagedAgentsCredential:
      description: >-
        A credential stored in a vault. Sensitive fields are never returned in
        responses.
      type: object
      additionalProperties: false
      required:
        - type
        - id
        - vault_id
        - metadata
        - created_at
        - updated_at
        - archived_at
        - auth
      properties:
        type:
          type: string
          enum:
            - vault_credential
          examples:
            - vault_credential
        id:
          description: Unique identifier for the credential.
          type: string
          examples:
            - vcrd_011CZkZEMt8gZan2iYOQfSkw
        vault_id:
          description: Identifier of the vault this credential belongs to.
          type: string
          examples:
            - vlt_011CZkZDLs7fYzm1hXNPeRjv
        display_name:
          description: Human-readable name for the credential.
          type: string
          nullable: true
          examples:
            - Example credential
        metadata:
          description: Arbitrary key-value metadata attached to the credential.
          type: object
          additionalProperties:
            type: string
          examples:
            - environment: production
        created_at:
          $ref: '#/components/schemas/BetaTimestamp'
          examples:
            - '2026-03-15T10:00:00Z'
        updated_at:
          $ref: '#/components/schemas/BetaTimestamp'
          examples:
            - '2026-03-15T10:00:00Z'
        archived_at:
          description: When the credential was archived. Null if not archived.
          allOf:
            - $ref: '#/components/schemas/BetaTimestamp'
          nullable: true
          examples:
            - null
        auth:
          description: Authentication configuration for this credential.
          allOf:
            - $ref: '#/components/schemas/BetaManagedAgentsCredentialAuth'
          examples:
            - type: static_bearer
              mcp_server_url: https://example-server.modelcontextprotocol.io/sse
      example:
        type: vault_credential
        id: vcrd_011CZkZEMt8gZan2iYOQfSkw
        vault_id: vlt_011CZkZDLs7fYzm1hXNPeRjv
        display_name: Example credential
        metadata:
          environment: production
        created_at: '2026-03-15T10:00:00Z'
        updated_at: '2026-03-15T10:00:00Z'
        archived_at: null
        auth:
          type: static_bearer
          mcp_server_url: https://example-server.modelcontextprotocol.io/sse
    BetaErrorResponse:
      properties:
        error:
          discriminator:
            mapping:
              api_error:
                $ref: '#/components/schemas/BetaAPIError'
              authentication_error:
                $ref: '#/components/schemas/BetaAuthenticationError'
              billing_error:
                $ref: '#/components/schemas/BetaBillingError'
              invalid_request_error:
                $ref: '#/components/schemas/BetaInvalidRequestError'
              not_found_error:
                $ref: '#/components/schemas/BetaNotFoundError'
              overloaded_error:
                $ref: '#/components/schemas/BetaOverloadedError'
              permission_error:
                $ref: '#/components/schemas/BetaPermissionError'
              rate_limit_error:
                $ref: '#/components/schemas/BetaRateLimitError'
              timeout_error:
                $ref: '#/components/schemas/BetaGatewayTimeoutError'
            propertyName: type
          oneOf:
            - $ref: '#/components/schemas/BetaInvalidRequestError'
            - $ref: '#/components/schemas/BetaAuthenticationError'
            - $ref: '#/components/schemas/BetaBillingError'
            - $ref: '#/components/schemas/BetaPermissionError'
            - $ref: '#/components/schemas/BetaNotFoundError'
            - $ref: '#/components/schemas/BetaRateLimitError'
            - $ref: '#/components/schemas/BetaGatewayTimeoutError'
            - $ref: '#/components/schemas/BetaAPIError'
            - $ref: '#/components/schemas/BetaOverloadedError'
          title: Error
        request_id:
          anyOf:
            - type: string
            - type: 'null'
          default: null
          title: Request Id
        type:
          const: error
          default: error
          title: Type
          type: string
      required:
        - error
        - request_id
        - type
      title: ErrorResponse
      type: object
    BetaTimestamp:
      description: A timestamp in RFC 3339 format
      type: string
      format: date-time
    BetaManagedAgentsCredentialAuth:
      description: Authentication details for a credential.
      type: object
      discriminator:
        propertyName: type
        mapping:
          mcp_oauth:
            $ref: '#/components/schemas/BetaManagedAgentsMcpOauthAuthResponse'
          static_bearer:
            $ref: '#/components/schemas/BetaManagedAgentsStaticBearerAuthResponse'
          environment_variable:
            $ref: >-
              #/components/schemas/BetaManagedAgentsEnvironmentVariableAuthResponse
      oneOf:
        - $ref: '#/components/schemas/BetaManagedAgentsMcpOauthAuthResponse'
        - $ref: '#/components/schemas/BetaManagedAgentsStaticBearerAuthResponse'
        - $ref: >-
            #/components/schemas/BetaManagedAgentsEnvironmentVariableAuthResponse
      example:
        type: static_bearer
        mcp_server_url: https://example-server.modelcontextprotocol.io/sse
    BetaAPIError:
      properties:
        message:
          default: Internal server error
          title: Message
          type: string
        type:
          const: api_error
          default: api_error
          title: Type
          type: string
      required:
        - message
        - type
      title: APIError
      type: object
    BetaAuthenticationError:
      properties:
        message:
          default: Authentication error
          title: Message
          type: string
        type:
          const: authentication_error
          default: authentication_error
          title: Type
          type: string
      required:
        - message
        - type
      title: AuthenticationError
      type: object
    BetaBillingError:
      properties:
        message:
          default: Billing error
          title: Message
          type: string
        type:
          const: billing_error
          default: billing_error
          title: Type
          type: string
      required:
        - message
        - type
      title: BillingError
      type: object
    BetaInvalidRequestError:
      properties:
        message:
          default: Invalid request
          title: Message
          type: string
        type:
          const: invalid_request_error
          default: invalid_request_error
          title: Type
          type: string
      required:
        - message
        - type
      title: InvalidRequestError
      type: object
    BetaNotFoundError:
      properties:
        message:
          default: Not found
          title: Message
          type: string
        type:
          const: not_found_error
          default: not_found_error
          title: Type
          type: string
      required:
        - message
        - type
      title: NotFoundError
      type: object
    BetaOverloadedError:
      properties:
        message:
          default: Overloaded
          title: Message
          type: string
        type:
          const: overloaded_error
          default: overloaded_error
          title: Type
          type: string
      required:
        - message
        - type
      title: OverloadedError
      type: object
    BetaPermissionError:
      properties:
        message:
          default: Permission denied
          title: Message
          type: string
        type:
          const: permission_error
          default: permission_error
          title: Type
          type: string
      required:
        - message
        - type
      title: PermissionError
      type: object
    BetaRateLimitError:
      properties:
        message:
          default: Rate limited
          title: Message
          type: string
        type:
          const: rate_limit_error
          default: rate_limit_error
          title: Type
          type: string
      required:
        - message
        - type
      title: RateLimitError
      type: object
    BetaGatewayTimeoutError:
      properties:
        message:
          default: Request timeout
          title: Message
          type: string
        type:
          const: timeout_error
          default: timeout_error
          title: Type
          type: string
      required:
        - message
        - type
      title: GatewayTimeoutError
      type: object
    BetaManagedAgentsMcpOauthAuthResponse:
      description: OAuth credential details for an MCP server.
      type: object
      additionalProperties: false
      required:
        - type
        - mcp_server_url
      properties:
        type:
          type: string
          enum:
            - mcp_oauth
        mcp_server_url:
          description: URL of the MCP server this credential authenticates against.
          type: string
        expires_at:
          $ref: '#/components/schemas/BetaTimestamp'
          nullable: true
        refresh:
          description: >-
            Refresh token configuration, if the credential supports token
            refresh.
          allOf:
            - $ref: '#/components/schemas/BetaManagedAgentsMcpOauthRefreshResponse'
          nullable: true
    BetaManagedAgentsStaticBearerAuthResponse:
      description: Static bearer token credential details for an MCP server.
      type: object
      additionalProperties: false
      required:
        - type
        - mcp_server_url
      properties:
        type:
          type: string
          enum:
            - static_bearer
          examples:
            - static_bearer
        mcp_server_url:
          description: URL of the MCP server this credential authenticates against.
          type: string
          examples:
            - https://example-server.modelcontextprotocol.io/sse
      example:
        type: static_bearer
        mcp_server_url: https://example-server.modelcontextprotocol.io/sse
    BetaManagedAgentsEnvironmentVariableAuthResponse:
      description: >-
        Environment variable credential details. The secret value is never
        returned.
      type: object
      additionalProperties: false
      required:
        - type
        - secret_name
        - networking
        - injection_location
      properties:
        type:
          type: string
          enum:
            - environment_variable
        secret_name:
          description: Name of the environment variable.
          type: string
        networking:
          description: Outbound hosts the secret value is substituted on.
          allOf:
            - $ref: >-
                #/components/schemas/BetaManagedAgentsCredentialNetworkingResponse
        injection_location:
          description: Where in the outbound request the secret value is substituted.
          allOf:
            - $ref: '#/components/schemas/BetaManagedAgentsInjectionLocationResponse'
    BetaManagedAgentsMcpOauthRefreshResponse:
      description: OAuth refresh token configuration returned in credential responses.
      type: object
      additionalProperties: false
      required:
        - token_endpoint
        - client_id
        - token_endpoint_auth
      properties:
        token_endpoint:
          description: Token endpoint URL used to refresh the access token.
          type: string
        client_id:
          description: OAuth client ID.
          type: string
        resource:
          description: OAuth resource indicator.
          type: string
          nullable: true
        scope:
          description: OAuth scope for the refresh request.
          type: string
          nullable: true
        token_endpoint_auth:
          type: object
          discriminator:
            propertyName: type
            mapping:
              none:
                $ref: >-
                  #/components/schemas/BetaManagedAgentsTokenEndpointAuthNoneResponse
              client_secret_basic:
                $ref: >-
                  #/components/schemas/BetaManagedAgentsTokenEndpointAuthBasicResponse
              client_secret_post:
                $ref: >-
                  #/components/schemas/BetaManagedAgentsTokenEndpointAuthPostResponse
          oneOf:
            - $ref: >-
                #/components/schemas/BetaManagedAgentsTokenEndpointAuthNoneResponse
            - $ref: >-
                #/components/schemas/BetaManagedAgentsTokenEndpointAuthBasicResponse
            - $ref: >-
                #/components/schemas/BetaManagedAgentsTokenEndpointAuthPostResponse
    BetaManagedAgentsCredentialNetworkingResponse:
      type: object
      discriminator:
        propertyName: type
        mapping:
          unrestricted:
            $ref: >-
              #/components/schemas/BetaManagedAgentsUnrestrictedCredentialNetworkingResponse
          limited:
            $ref: >-
              #/components/schemas/BetaManagedAgentsLimitedCredentialNetworkingResponse
      oneOf:
        - $ref: >-
            #/components/schemas/BetaManagedAgentsUnrestrictedCredentialNetworkingResponse
        - $ref: >-
            #/components/schemas/BetaManagedAgentsLimitedCredentialNetworkingResponse
    BetaManagedAgentsInjectionLocationResponse:
      description: Where in the outbound request the secret value is substituted.
      type: object
      additionalProperties: false
      required:
        - header
        - body
      properties:
        header:
          description: Whether the placeholder is substituted in request header values.
          type: boolean
        body:
          description: Whether the placeholder is substituted in the request body.
          type: boolean
    BetaManagedAgentsTokenEndpointAuthNoneResponse:
      description: Token endpoint requires no client authentication.
      type: object
      additionalProperties: false
      required:
        - type
      properties:
        type:
          type: string
          enum:
            - none
    BetaManagedAgentsTokenEndpointAuthBasicResponse:
      description: Token endpoint uses HTTP Basic authentication with client credentials.
      type: object
      additionalProperties: false
      required:
        - type
      properties:
        type:
          type: string
          enum:
            - client_secret_basic
    BetaManagedAgentsTokenEndpointAuthPostResponse:
      description: Token endpoint uses POST body authentication with client credentials.
      type: object
      additionalProperties: false
      required:
        - type
      properties:
        type:
          type: string
          enum:
            - client_secret_post
    BetaManagedAgentsUnrestrictedCredentialNetworkingResponse:
      description: >-
        The secret is substituted on any host the session's Environment network
        policy permits egress to.
      type: object
      additionalProperties: false
      required:
        - type
      properties:
        type:
          type: string
          enum:
            - unrestricted
    BetaManagedAgentsLimitedCredentialNetworkingResponse:
      description: The secret is substituted only on requests to the listed hosts.
      type: object
      additionalProperties: false
      required:
        - type
        - allowed_hosts
      properties:
        type:
          type: string
          enum:
            - limited
        allowed_hosts:
          description: >-
            Hostnames on which the secret will be substituted. An entry matches
            the request host exactly; a `*.`-prefixed entry matches any
            subdomain of the named domain but not the domain itself.
          type: array
          items:
            type: string
  securitySchemes:
    omaApiKey:
      type: apiKey
      in: header
      name: X-Api-Key
      description: OMA workspace API key.
      x-default: sk-ant-local-default
    omaBearer:
      type: http
      scheme: bearer
      description: OMA workspace API key sent as a bearer token.

````