The credential to test. It is spent on one read and never persisted.
kind is a StandardProviderKind or CustomProviderKind value; provider carries the same field vocabulary the vault stores, so a card can probe what it is about to save without reshaping it.
secret_id names a connection already stored in the caller's project, and is how a write-only connection is testable at all: its value never comes back to the browser, so there is nothing for the card to send. The stored kind and credentials are the base; anything typed in this request replaces the stored value for that field, which is what lets a card test an edit — a new base URL, say — before saving it.
Provider kind, e.g. 'openai', 'azure', 'custom'. Optional when secret_id is given: the stored kind is used unless this overrides it.
Credentials in transit only. Never persisted here, never logged, never echoed.
key is a SecretStr and extras is kept out of repr, so an accidental log line or traceback that carries this object cannot print the credential. Unwrap the key with .get_secret_value() at the point it is put on the wire, never earlier.
Test the credential stored under this secret, in the caller's project. Fields sent in provider override the stored ones.
Successful Response