---
title: "Validate a credential-request token without consuming it"
method: POST
path: "/v1/credential-requests/peek"
tags: ["credential-requests"]
---

# Validate a credential-request token without consuming it

`POST /v1/credential-requests/peek`

## Request

- Base URL: `` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v1/credential-requests/peek`
- Auth: none declared

Returns the service/field/label the link collects. The token travels in the body so it never appears in URLs or access logs.

## Request body

- object
  - `token` string, required

## Response `200`

Successful response

- union
  - object
    - `service` string, required
    - `field` string, required
    - `label` string, nullable, required
    - `expiresAt` number, required
  - object
    - `error` object, required
      - `code` 'INVALID' | 'EXPIRED' | 'USED', required
      - `message` string, required

## Changes

- **2026-07-08** `e1143cfdd794`: 1 info
  - endpoint added
- **2026-06-15** `8aa43f77a604`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/vellum-ai/apis/vellum-gateway-api/changes/v1/credential-requests/peek/post.md)

---

[API](https://skmtc.dev/vellum-ai/apis/vellum-gateway-api.md) - [All operations](https://skmtc.dev/vellum-ai/apis/vellum-gateway-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vellum-ai/apis/vellum-gateway-api/revisions/48d611686235?raw)