---
title: "Retrieve a credential"
method: GET
path: "/credentials/{credential_id}"
tags: ["Credentials"]
---

# Retrieve a credential

`GET /credentials/{credential_id}`

Returns a single credential by ID.

## Path parameters

- `credential_id` string, required

## Response `200`

OK

- GetCredentialResponse
  - `id` string, required — Unique identifier for the credential, prefixed with `cred_`.
  - `object` string, required — Always `credential`.
  - `status` string, required — Credential status: `unverified`, `verified`, `invalid`, or `deleted`.
  - `external_id` string, nullable, required — External identifier from your system, if set.
  - `source_id` string, required — The source this credential authenticates against. Prefixed with `src_`.
  - `auth_method` string, required — Authentication method: `username_password`, `source_fields`, or `none`.
  - `auth_credentials` AuthCredentialsSummary, required — Summary of stored authentication credentials. Secret values such as `password` are encrypted at rest and never returned. Non-tokenized `source_fields` are returned in the clear; fields named in `tokenized` are vaulted and omitted from the map.
    - `username` string, nullable — The username associated with this credential, if applicable.
    - `source_fields` object — Non-tokenized `source_fields` returned as key/value pairs in the clear (for example, `{ "company_id": "ACME-4412" }`). Tokenized source fields are dropped from this map and named in `tokenized` instead. Omitted when empty.
    - `tokenized` string[] — Names of the source fields whose values were vaulted. Their values never appear in `source_fields` and cannot be read back through the API. Omitted when nothing was tokenized.
  - `persistence` PersistenceSummary, required — Persistence settings for this credential.
    - `enabled` boolean, required — Whether persistence is enabled for this credential.
  - `created_at` string, date-time, required — ISO 8601 timestamp of when the resource was created.
  - `updated_at` string, date-time, required — ISO 8601 timestamp of when the resource was last updated.
  - `request_id` string, required — Unique identifier for the API request. Include this when contacting support.

## Other responses

- `400` — Bad request — validation error or malformed input.
- `401` — Unauthorized.
- `403` — Forbidden.
- `404` — Not found — the requested resource does not exist.
- `409` — Conflict — the request is valid but cannot be completed in the current state.
- `422` — Unprocessable content — the request body is understood but contains invalid values.
- `429` — Too many requests or session concurrency exceeded. Retry with backoff; honor Retry-After and RateLimit headers when present.
- `500` — Internal server error.

---

[API](https://skmtc.dev/deck/apis/deck-api.md) · [All operations](https://skmtc.dev/deck/apis/deck-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/deck/deck-api/revisions/eba6e2cc9351/schema)