Skip to main content
GET
List credentials

Authorizations

Authorization
string
header
required

User session JWT (Bearer ). Must be paired with the X-Team-ID request header on team-scoped endpoints so the server knows which team's resources to operate on.

Headers

X-Team-ID
string<uuid>
required

UUID of the team to scope the request to. Required on all team-scoped JWT endpoints because a user may belong to multiple teams.

Example:

"019abc12-4567-7890-abcd-ef1234567891"

Query Parameters

current_page
integer
default:1

Page number to retrieve (1-based). Default: 1.

Required range: x >= 1
Example:

1

per_page
integer
default:20

Number of items per page (1–100). Default: 20.

Required range: 1 <= x <= 100
Example:

20

kind
enum<string>

Filter by credential kind. Returns all kinds when omitted. Type of credential. Each kind shares the same storage shape but has different behaviour:

  • integration (sk-...): team-scoped programmatic key. Carries no user identity; used by CI bots, third-party integrations, scripts.
  • agent (ak-...): team-scoped agent key. Used by headless workers connecting to the platform's WebSocket. Rejected by the REST surface — see the carrier table at the top of the spec.
  • device (dk-...): per-user, team-scoped key issued by the desktop device-pairing flow (POST /desktop/pair/confirm). Carries user_id so the authorization layer can run against the actual user. Cannot be issued via POST /credentials — use the pairing flow.
Available options:
integration,
agent,
device
Example:

"integration"

Response

Credential list

credentials
object[]
required
page_meta
object
required

Pagination metadata included in all list responses.