Vault object
Returned by create, get, list, and archive endpoints.
| Field | Type | Description |
|---|---|---|
id | string | Vault ID with the vault_ prefix |
type | string | Always "vault" |
display_name | string | Vault display name, at most 255 characters |
metadata | object | Metadata object |
credentials | array of Vault credential | Returned only when creating a Vault and always empty; manage credentials through the separate credential endpoints |
archived_at | string | null | Archive time, or null when active |
created_at | string | Creation time |
updated_at | string | Last update time |
Vault credential
Returned by the create credential, list credentials, and archive credential endpoints.
| Field | Type | Description |
|---|---|---|
id | string | Credential ID with the vcred_ prefix |
type | string | Always "vault_credential" |
vault_id | string | Owning Vault ID |
auth | Credential auth object | Sanitized auth details; secrets are never returned |
display_name | null | Currently always null |
metadata | object | Custom metadata object stored with the credential; defaults to {} |
archived_at | string | null | Archive time, or null when active |
created_at | string | Creation time |
updated_at | string | Last update time |
token, access_token, refresh_token, and client_secret, are accepted on create requests but are never returned.
Create credential request
| Field | Type | Required | Description |
|---|---|---|---|
auth | object | Yes | Credential authentication details |
display_name | string | No | Accepted for compatibility; currently returned as null and not persisted |
metadata | object | No | Custom metadata stored with the credential; defaults to {} |
Credential auth object
static_bearer
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | static_bearer |
mcp_server_url | string | Yes | MCP server URL, at most 2048 characters |
token | string | Yes | Bearer token stored securely in the Vault; never returned |
token.
mcp_oauth
Use this object with Create a credential when you already have OAuth tokens. To obtain tokens through a browser authorization flow instead, use Start MCP OAuth; CAS creates this Credential after the callback succeeds.
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | mcp_oauth |
mcp_server_url | string | Yes | MCP server URL, at most 2048 characters |
access_token | string | Yes | OAuth access token; never returned |
expires_at | string | No | Access token expiration time in RFC 3339 format |
refresh | MCP OAuth refresh object | No | Refresh configuration. Returned without refresh_token or client_secret |
access_token. When refresh is present, it also omits refresh_token and token_endpoint_auth.client_secret.
environment_variable
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | environment_variable |
secret_name | string | Yes | Environment variable name. Must match [A-Za-z_][A-Za-z0-9_]* |
secret_value | string | Yes | Secret value; never returned |
MCP OAuth refresh object
| Field | Type | Required | Description |
|---|---|---|---|
client_id | string | Yes | OAuth client ID |
refresh_token | string | Yes | OAuth refresh token; never returned |
token_endpoint | string | Yes | OAuth token endpoint URL |
token_endpoint_auth | object | Yes | Authentication used at the token endpoint; see below |
resource | string | No | OAuth protected-resource identifier sent during refresh |
scope | string | No | Space-separated OAuth scopes sent during refresh |
Token endpoint auth object
| Field | Type | Required | Description |
|---|---|---|---|
type | string | Yes | none, client_secret_basic, or client_secret_post |
client_secret | string | For client_secret_basic or client_secret_post | OAuth client secret; never returned |
mcp_oauth credential before MCP discovery or execution. If the provider rotates the refresh token, CAS stores the replacement atomically.
Start OAuth request
Used by POST /api/v1/cloud/oauth/start. See Start MCP OAuth for the complete flow.
| Field | Type | Required | Description |
|---|---|---|---|
vault_id | string | Yes | Vault that will own the resulting Credential |
mcp_server_url | string | Yes | MCP URL used for discovery and credential matching |
client_id | string | No | Pre-registered OAuth client ID |
client_secret | string | No | Secret for the supplied client ID |
Start OAuth response
| Field | Type | Description |
|---|---|---|
authorization_url | string | Provider authorization URL to open in a browser |
state | string | Opaque, short-lived OAuth state |
callback_origin | string | Expected origin of the browser callback message |