---
title: "List gateway credential sets"
method: GET
path: "/v1/inference-providers/{inferenceProviderId}/credential-sets"
tags: ["Inference Providers"]
---

# List gateway credential sets

`GET /v1/inference-providers/{inferenceProviderId}/credential-sets`

## Request

- Base URL: `https://api.openworklabs.com`
- URL: `https://api.openworklabs.com/v1/inference-providers/{inferenceProviderId}/credential-sets`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Returns credential-set configuration status, creator metadata and OAuth client metadata without stored secrets. The creator (createdBy) is only returned to callers who also hold Manage Gateway providers. Member credential readiness is evaluated for the caller. Requires the View Gateway providers permission and enabled Gateway management.

## Path parameters

- `inferenceProviderId` string, typeid, required

## Response `200`

List gateway credential sets

- object
  - `credentialSets` object[], required
    - `id` string, typeid, required: Den TypeID with 'gcs_' prefix and a 26-character base32 suffix.
    - `name` string, required
    - `createdAt` string, date-time
    - `createdBy` object, nullable: Who created the set. Omitted unless the caller holds Manage Gateway providers.
      - `id` string, typeid, required: Den TypeID with 'om_' prefix and a 26-character base32 suffix.
      - `name` string, nullable, required
      - `email` string, nullable, required
    - `credentialMode` 'org' | 'member', required
    - `status` 'active' | 'disabled', required
    - `configured` boolean, required
    - `credentialStatus` 'ready' | 'member_auth_required' | 'org_credential_missing', required
    - `oauthClientId` string, nullable
    - `hasOauthClientSecret` boolean
    - `oauthTenantId` string, nullable
    - `awsSso` object, nullable
      - `startUrl` string, required
      - `region` string, required
      - `accountId` string, required
      - `roleName` string, required

## Other responses

- `400`: Invalid request or provider configuration.
- `401`: Sign-in required.
- `403`: Access denied or Gateway management disabled.
- `404`: Resource not found.
- `409`: Selection or resource conflict.

## Changes

- **2026-10-23** `c93387179b31`: 4 breaking, 6 info
  - the response property `credentialSets/items/createdBy/anyOf[subschema #1]/email` became nullable for the status `200`
  - the response property `credentialSets/items/createdBy/anyOf[subschema #1]/name` became nullable for the status `200`
  - the response property `credentialSets/items/oauthClientId` became nullable for the status `200`
  - the response property `credentialSets/items/oauthTenantId` became nullable for the status `200`
  - …6 more
- **2026-10-08** `5e65f24df46a`: 2 info
  - added the optional property `credentialSets/items/awsSso` to the response with the `200` status
  - added the optional property `credentialSets/items/oauthTenantId` to the response with the `200` status
- **2026-10-01** `df3754993784`: 1 info
  - added the optional property `anyOf[#/components/schemas/InvalidRequestError]/message` to the response with the `400` status
- **2026-09-11** `d76883ffb5c4`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/openworklabs/apis/den-api/changes/v1/inference-providers/:inferenceProviderId/credential-sets/get.md)

---

[API](https://skmtc.dev/openworklabs/apis/den-api.md) - [All operations](https://skmtc.dev/openworklabs/apis/den-api/llms.txt) - [OpenAPI document](https://skmtc.dev/openworklabs/apis/den-api/revisions/5bd253fbca6a?raw)