---
title: "GET /vault/search"
method: GET
path: "/vault/search"
---

# GET /vault/search

`GET /vault/search`

## Request

- Base URL: `https://api.useanima.sh/v1`
- URL: `https://api.useanima.sh/v1/vault/search`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

## Query parameters

- `agentId` union: Agent identifier. Optional when using an agent API key (resolved automatically); required when using a master key.
  - string
  - string
- `search` string: Free-text search query
- `q` string: Alias for `search`
- `type` 'login' | 'secure_note' | 'card' | 'identity' | 'oauth_token' | 'api_key' | 'certificate': Filter results by credential type

## Response `200`

OK

- object: List of vault credentials
  - `items` object[], required: List of credentials matching the query
    - `id` string, required: Unique credential identifier
    - `type` 'login' | 'secure_note' | 'card' | 'identity' | 'oauth_token' | 'api_key' | 'certificate', required: Credential type
    - `name` string, required: User-defined credential name
    - `notes` string: Free-form notes attached to the credential
    - `login` object: Login credential data, present when type is login
      - `username` string: Login username or email
      - `password` string: Login password
      - `uris` object[]: URIs associated with this login
        - `uri` string, required: URI associated with the credential
        - `match` 'domain' | 'host' | 'starts_with' | 'regex' | 'never': URI matching strategy for auto-fill
      - `totp` string: TOTP secret for two-factor authentication
    - `card` object: Card credential data, present when type is card
      - `cardholderName` string: Name on the payment card
      - `brand` string: Card brand (e.g. Visa, Mastercard)
      - `number` string: Full card number
      - `expMonth` string: Card expiration month
      - `expYear` string: Card expiration year
      - `code` string: Card security code (CVV/CVC)
    - `identity` object: Identity credential data, present when type is identity
      - `firstName` string: First name
      - `lastName` string: Last name
      - `email` string, email: Email address
      - `phone` string: Phone number
      - `address1` string: Street address
      - `city` string: City
      - `state` string: State or province
      - `postalCode` string: Postal or ZIP code
      - `country` string: Country code or name
      - `company` string: Company or organization name
      - `ssn` string: Social security number
    - `oauthToken` object: OAuth token data, present when type is oauth_token
      - `provider` string, required: OAuth provider name (e.g. google, github, slack)
      - `accessToken` string, required: Encrypted OAuth access token
      - `refreshToken` string, required: Encrypted OAuth refresh token
      - `tokenEndpoint` string, required: OAuth token endpoint URL for refreshing tokens
      - `clientId` string, required: Encrypted OAuth client ID
      - `clientSecret` string: Encrypted OAuth client secret
      - `scopes` string[], required: OAuth scopes granted to this token
      - `expiresAt` string, date-time, required: Token expiration timestamp
      - `autoRefresh` boolean: Whether to automatically refresh the token before expiry
      - `allowedHosts` string[]: Hosts this token may be brokered to via server-side use. Fail-closed if empty.
    - `apiKey` object: API key data, present when type is api_key
      - `provider` string, required: API provider name (e.g. openai, anthropic, stripe)
      - `key` string, required: Encrypted API key
      - `prefix` string: Display prefix for the key (e.g. 'sk-...abc')
      - `rateLimit` object: Rate limit configuration for this key
        - `requests` integer, required: Maximum number of requests allowed
        - `window` string, required: Time window for rate limiting (e.g. '1m', '1h', '1d')
      - `expiresAt` string, date-time: Optional key expiration timestamp
      - `scopes` string[]: Optional scopes or permissions for this key
      - `allowedHosts` string[]: Hosts this key may be brokered to via server-side use. Fail-closed if empty.
      - `authHeader` string: Header the broker injects the key into (default 'Authorization').
      - `authScheme` string: Value prefix before the key (default 'Bearer '; set '' for a raw key, e.g. x-api-key).
    - `certificate` object: Certificate data, present when type is certificate
      - `format` 'pem' | 'p12' | 'jks', required: Certificate format
      - `certificate` string, required: Encrypted certificate content
      - `privateKey` string, required: Encrypted private key
      - `chain` string[]: Encrypted certificate chain
      - `expiresAt` string, date-time, required: Certificate expiration timestamp
    - `fields` object[]: Custom fields attached to the credential
      - `name` string, required: Field name
      - `value` string, required: Field value
      - `type` 'text' | 'hidden' | 'boolean', required: Field display type
    - `favorite` boolean, required: Whether the credential is marked as a favorite
    - `folderId` string: Folder the credential belongs to
    - `organizationId` string: Organization the credential is scoped to
    - `collectionIds` string[]: Collections the credential is shared with
    - `createdAt` string, date-time, required: Timestamp when the credential was created
    - `updatedAt` string, date-time, required: Timestamp when the credential was last updated
    - `revealPolicy` 'standard' | 'brokered': Reveal policy governing whether plaintext may be returned (default 'standard')

---

[API](https://skmtc.dev/useanima/apis/anima-api.md) · [All operations](https://skmtc.dev/useanima/apis/anima-api/llms.txt) · [OpenAPI document](https://skmtc.dev/useanima/apis/anima-api/revisions/aaa148188980?raw)