---
title: "Inject a decrypted credential for the current execution"
method: POST
path: "/credentials/inject"
---

# Inject a decrypted credential for the current execution

`POST /credentials/inject`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/credentials/inject`
- Auth: HTTP bearer

Present a valid execution JWT and receive a decrypted credential value. The credential must be in the JWT scope. Every injection is audit-logged. Raw credential values are never stored in logs — only the credential label and injection timestamp are recorded.

## Request body

- CredentialInjectRequest
  - `credential_label` string, required: Label of the credential to inject. Must be in JWT scope.

## Response `200`

Credential injected

- CredentialInjectResponse
  - `label` string
  - `type` string
  - `value` string: Decrypted credential value. Valid for the duration of the execution JWT.
  - `injected_at` string, date-time
  - `expires_at` string, date-time

## Other responses

- `401`: Invalid or expired JWT
- `403`: Credential not in JWT scope
- `404`: Credential not found in vault

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)