---
title: "Validate and vault tenant-managed connector credentials"
method: POST
path: "/connections/managed-credentials"
---

# Validate and vault tenant-managed connector credentials

`POST /connections/managed-credentials`

## Request

- Base URL: `https://api.gravityads.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gravityads.dev/connections/managed-credentials`
- Auth: HTTP bearer

Accepts Criteo client credentials or a MediaGo API token, validates them against the provider, and writes them directly to the tenant-scoped token vault. Raw credentials are never returned or persisted in the control plane.

## Request body

- object
  - `platform` 'criteo' | 'media_go', required
  - `client_id` string: Criteo API client id; accepted only for server-side vaulting.
  - `client_secret` string, password: Criteo API client secret; never returned or logged.
  - `api_token` string, password: MediaGo API token; never returned or logged.

## Response `200`

Managed connector credential stored

- object
  - `status` 'managed_connection_credentials_completed', required
  - `tenant_id` string, required
  - `platform` 'criteo' | 'media_go', required
  - `connection_id` string, required
  - `secret_ref_id` string
  - `vault` object
  - `token_response_metadata` object
  - `account_discovery` object
  - `account_upsert` object
  - `connection` object
  - `ready_for_readonly_etl` boolean, required
  - `database_url_configured` boolean
  - `hosted_auth_context` object
  - `raw_token_material_returned` false, required
  - `raw_secrets_returned` false, required

---

[API](https://skmtc.dev/gravityads/apis/gravityads-api.md) · [All operations](https://skmtc.dev/gravityads/apis/gravityads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gravityads/apis/gravityads-api/revisions/124cd07d534d?raw)