---
title: "Store an encrypted credential"
method: POST
path: "/credentials/vault"
---

# Store an encrypted credential

`POST /credentials/vault`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/credentials/vault`
- Auth: API key in header `x-mgmt-key`

Envelope-encrypt and store a secret in the wallet's vault (AES-256-GCM, per-wallet DEK). Never returned raw — injected only under a scoped execution JWT with clearance ≥ the credential's bar. Owner-only.

## Request body

- object
  - `wallet_id` string, required
  - `label` string, required
  - `type` 'api_key' | 'oauth_token' | 'certificate' | 'license' | 'password', required
  - `value` string, required: The plaintext secret; stored encrypted, never returned
  - `allowed_agent_ids` string[]
  - `scopes` string[]
  - `min_clearance` integer
  - `expires_at` string, date-time

## Response `201`

Stored (value returned as [encrypted])

## Other responses

- `400`: Invalid request
- `401`: Management key required

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)