Credentials

List service credentials

Every service credential the workspace owns, newest first, including revoked and expired ones.

Reading this list costs settings:write rather than a read scope, and that is deliberate: the list names which agents hold which grants, which is the map of the workspace's automated access. A document-reading agent has no business seeing it.

Secrets are described but never returned. Each credential carries a secrets array describing the key material issued for it: the 8-character prefix, the last four characters, when it was created, when it was last used, and, for a secret that a rotation has dated out, when it stops working. The raw key appears exactly once, in the response that issues it, and is unrecoverable afterwards because only its SHA-256 hash is stored.

get/credentials

Request

Base URL: https://inkseal.net/api/v1
URL: https://inkseal.net/api/v1/credentials
Auth: HTTP bearer

Response

Every credential in the workspace, newest first. Not paginated.

Example response

{
  "data": [
    {
      "id": "V1StGXR8_Z5jdHi6B-myT",
      "name": "Contract intake agent",
      "agentIdentity": "intake-bot@ops.example.com",
      "scopes": [
        "documents:write",
        "envelopes:write",
        "envelopes:send"
      ],
      "isActive": true,
      "createdAt": "2026-08-01T11:02:44.000Z",
      "lastUsedAt": "2026-08-21T07:41:12.338Z",
      "secrets": [
        {
          "prefix": "isk_REDA",
          "lastFour": "CTED",
          "createdAt": "2026-08-01T11:02:44.000Z",
          "lastUsedAt": "2026-08-21T07:41:12.338Z"
        }
      ],
      "limits": {
        "maxCreditsPerDay": 25,
        "maxSendsPerHour": 5
      }
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.