---
title: "Get Decrypted Credential"
method: GET
path: "/auth/{tenant_id}/{provider}/decrypted"
tags: ["Internal"]
---

# Get Decrypted Credential

`GET /auth/{tenant_id}/{provider}/decrypted`

## Request

- Base URL: `https://api.continueops.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.continueops.com/auth/{tenant_id}/{provider}/decrypted`
- Auth: API key in header `X-Runner-Key`

Decrypt and return a tenant's active credential. ONLY callable by the runner
(X-Runner-Key). The runner passes run_id as a query param so every decrypt call
is correlated in logs. Over same-GVC TLS only.

## Path parameters

- `tenant_id` string, required
- `provider` 'aws' | 'gcp' | 'azure', required

## Query parameters

- `run_id` string, nullable

## Response `200`

Successful Response

- DecryptedCredentialResponse
  - `tenant_id` string, required
  - `provider` 'aws' | 'gcp' | 'azure', required
  - `credential_id` string, uuid, required
  - `credentials` object, required
  - `expires_at` string, date-time, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/continueops/apis/cloud-credential-proxy.md) · [All operations](https://skmtc.dev/continueops/apis/cloud-credential-proxy/llms.txt) · [OpenAPI document](https://skmtc.dev/continueops/apis/cloud-credential-proxy/revisions/f0940e341f41?raw)