Create a credential

POST

/credentials

curl --request POST \
  --url https://your-org.evershell.ai/v1/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "example", "provider": "google", "kind": "oauth2_authorization_code", "scopes": [ "example" ], "provider_config": {}, "service_account_json": "example", "client_secret": "example", "api_key": "example", "password": "example", "personal": true, "allow_user_override": true }'

• Hosted tenant

Permissions: auth:write or auth:write:own. Members carrying only auth:write:own can create personal Authorization Code overrides on themselves; everything else (org-scoped credentials, other AC kinds) needs auth:write (unscoped).

Creates a credential record + uploads the durable secret to Vault. Required body fields branch on (provider, kind):

• kind: oauth2_jwt_bearer (Google SA) — service_account_json (full SA JSON key)
• kind: oauth2_client_credentials + kind: oauth2_authorization_code (BYO OAuth) — client_secret, provider_config: { client_id, tenant_id (Microsoft only) }
• kind: api_key (static token) — api_key
• kind: basic_auth — password, provider_config: { username }
• kind: query_api_key — api_key

For Authorization Code (oauth2_authorization_code), the response carries a next link pointing to POST /credentials/{id}/oauth/start — call that to obtain the provider’s authorize URL and redirect the browser there.

Authorizations

• bearerAuth

Request Body ^required

Media type application/json

object

name

required

Operator-chosen identifier referenced from caps.yaml transforms.

string

provider

required

string

Example

google

kind

required

oauth2_jwt_bearer_with_subject is Google domain-wide delegation — same SA JSON key as the durable credential, but mint requests carry a sub claim that impersonates the email in provider_config.subject.

string

Allowed values: oauth2_authorization_code oauth2_client_credentials oauth2_jwt_bearer oauth2_jwt_bearer_with_subject oauth2_client_assertion api_key basic_auth query_api_key

scopes

Array<string>

provider_config

object

key

additional properties

any

service_account_json

Kind=oauth2_jwt_bearer only.

string

client_secret

Kind=oauth2_client_credentials | oauth2_authorization_code.

string

api_key

Kind=api_key | query_api_key.

string

password

Kind=basic_auth.

string

personal

Kind=oauth2_authorization_code only — create a user-scoped override.

boolean

allow_user_override

Kind=oauth2_authorization_code only — let members create personal overrides of an org-scoped row.

boolean

Responses

201

Created

Media type application/json

object

id

required

string

org_id

string

user_id

Non-null for personal (per-user) credentials

string

name

required

string

provider

required

string

kind

required

oauth2_jwt_bearer_with_subject is Google domain-wide delegation — same SA JSON key as the durable credential, but mint requests carry a sub claim that impersonates the email in provider_config.subject.

string

Allowed values: oauth2_authorization_code oauth2_client_credentials oauth2_jwt_bearer oauth2_jwt_bearer_with_subject oauth2_client_assertion api_key basic_auth query_api_key

scopes

Array<string>

durable_ref

Vault path to the durable secret. Reference only — the secret value is never returned.

string

provider_config

Provider-specific structured config. Common shapes: {client_id, tenant_id} for Microsoft client_credentials, {subject} for Google domain-wide delegation, {username} for basic_auth. Never carries the secret.

object

key

additional properties

any

last_minted_at

Timestamp of the most recent successful mint by the proxy’s broker.

string format: date-time

last_minted_status

Short status code from the most recent mint attempt — populated alongside status=needs_reauth to surface the broker’s terminal-error reason.

string

allow_user_override

AC-kind only — lets members create personal overrides

boolean

status

required

string

Allowed values: active needs_reauth failed revoked

created_at

string format: date-time

updated_at

string format: date-time

sa_client_email

Populated for kind=oauth2_jwt_bearer; grant this email access to whatever resources the agent should reach.

string

Example

{
  "provider": "google",
  "kind": "oauth2_authorization_code",
  "status": "active"
}

400

Validation failure

Media type application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}

423

Tenant is past_due, decommissioning, or trial-expired

Media type application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}

503

auth_disabled — credentials subsystem isn’t configured on this CP, or Vault was unreachable when the durable secret was uploaded.

Media type application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}