List App Credentials

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

List this app's service credentials. Never returns a secret.

Includes revoked ones: a builder auditing which credentials exist needs to see the one they turned off, and hiding it would make a rotation look like a deletion.