---
title: "List every credential you can use in this org as one shape: Keys (secrets) and the opt-in url, login, and signing kin..."
method: GET
path: "/v1/credentials"
tags: ["secrets"]
---

# List every credential you can use in this org as one shape: Keys (secrets) and the opt-in url, login, and signing kin...

`GET /v1/credentials`

## Request

- Base URL: `https://api.kody.codes`
- URL: `https://api.kody.codes/v1/credentials`
- Auth: HTTP bearer

List every credential you can use in this org as one shape: Keys (secrets) and the opt-in url, login, and signing kinds, OAuth integrations, and MCP servers (kind "mcp"). Includes your own personal credentials granted to this org (scope "personal"). Filter by text, kind, scope, package-scoped Keys, or package locks. Metadata only: never values. To add one, send the person to /connect/credential (kind, kindMode=hint|required, name, provider, allowedHosts).

Org permission: none (touches no org data).

## Query parameters

- `q` string: Substring of name, provider, description, or host.
- `kinds` string[]
- `scope` 'org' | 'personal'
- `packageScoped` boolean: true: only package-scoped Keys; false: exclude them.
- `locked` union: true: locked to any package; a package id: locked to it.
  - true
  - string

## Response `200`

Success.

- object
  - `credentials` object[], required
    - `id` string, required: Credential id (accessGrant, credentialUpdate).
    - `kind` 'secret' | 'oauth' | 'mcp' | 'url' | 'login' | 'signing', required
    - `name` string, required
    - `scope` 'org' | 'personal', required: personal: your own credential granted to this org.
    - `provider` string, nullable, required
    - `description` string, required
    - `hosts` string[], required
    - `inject` union, required
      - object
        - `kind` 'header', required
        - `name` string, required
        - `format` string, required
      - object
        - `kind` 'basic', required
        - `valueAs` 'username' | 'password', required
        - `other` string, required
      - object
        - `kind` 'query', required
        - `param` string, required
    - `placement` object, nullable, required: Where placeholders may be filled (headers, query, path, body). Null means anywhere. Distinct from inject.
      - `headers` union
        - true
        - string[]
      - `query` true
      - `path` true
      - `body` true
    - `packageId` string, nullable, required: Set for a package-scoped Key: the package it belongs to.
    - `lockedToPackageIds` string[], required: Non-empty when only these packages may use it.
    - `expiresAt` string, nullable, required
    - `createdAt` string, required
    - `updatedAt` string, required
    - `status` 'ok' | 'expired' | 'needs_attention' | 'disabled', required
    - `statusMessage` string, nullable, required
    - `mcp` object, nullable, required
      - `url` string, required
      - `enabled` boolean, required

## Other responses

- `400`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `401`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `403`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `404`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `409`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `413`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying.
- `500`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `503`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `default`: Error envelope `{ "error": { "code", "message", "details"? } }`.

---

[API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/a020ecedb82b?raw)