---
title: "Exchange a delegated runner capability for home-repository and user API credentials"
method: POST
path: "/api/v1/agent/roder/workspace_credentials"
tags: ["agent"]
---

# Exchange a delegated runner capability for home-repository and user API credentials

`POST /api/v1/agent/roder/workspace_credentials`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/agent/roder/workspace_credentials`
- Auth: HTTP bearer

Requires the server-held turn capability delegated by Roder. Browser session capabilities, browser cookies, and personal access tokens are not accepted. Returns a short-lived repository credential for the org Home checkout and a short-lived system personal access token that authenticates API/CLI calls as the spawning user. Both expire together and are reissued on refresh.

## Request body

- AgentRoderWorkspaceCredentialRequest
  - `required_lifetime_seconds` integer, required: Lifetime the pending clone or command must be able to complete within.

## Response `200`

Short-lived repository clone and user API credentials

- AgentRoderWorkspaceCredentials
  - `clone_url` string, uri, required
  - `username` 'vex', required
  - `repository_spec` string, required: The explicitly selected physical repository address.
  - `default_branch` string, required
  - `author_name` string, required
  - `author_email` string, email, required
  - `token` string, password, required: Short-lived read/write repository credential. The raw value is returned once and only its digest is stored.
  - `api_token` string, password, required: Short-lived personal access token for the spawning user. Installed into the sandbox CLI config so `vex` and API clients act as that user. The raw value is returned once and only its digest is stored.
  - `expires_at` string, date-time, required
  - `organization_id` string, required
  - `repository_id` string, required
  - `repository_slug` string, required

## Other responses

- `400`: Required credential lifetime is missing or invalid
- `401`: Invalid, expired, or unauthorized agent capability
- `503`: Agent repository access is not configured

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/74298a24e040?raw)