Request a link for a human to enter a provider secret
There is deliberately no endpoint that accepts a secret. A secret named to an agent ends up in the model context, in transport logs and in the conversation history, and none of those can be wiped afterwards. So instead you ask for a link, show it to a person, and poll for the outcome.
The link opens a one-field form inside the dashboard: the person pastes the value straight from their clipboard, the form checks it against the provider and stores it. You never see the value, and neither does this API.
The link is short-lived (15 minutes by default), bound to this one provider, and only usable by someone signed in to the same account — an unauthenticated visitor gets the normal login page first. It is spent by one SUCCESSFUL entry: a rejected value leaves the link usable so a typo does not send the person back to you for a new one.
Not idempotent, on purpose: repeating the call means "the previous link was lost or expired", so it issues a fresh one. Old links stay valid until they expire.
This does NOT replace the dashboard: a person still has to be at a screen. What it removes is the secret travelling through you.
Request
- Base URL: https://wardenpoint.com (the document declares no server; this is the origin it was published from)
- URL: https://wardenpoint.com/api/v1/credentials/{provider}/request
- Auth: API key in header X-API-Key
Path parameters
What the person is being asked for. The 422 body lists the accepted set.
telegram_bot — the BotFather token. telegram — api_id, api_hash and phone of a Telegram ACCOUNT (this one is stored_only: the values are kept but proved only by the QR sign-in that follows). custom_asterisk — AMI host, username and password of your own PBX. whatsapp — Meta access token and phone number id. viber — bot auth token and sender name. telegram_2fa — the two-step verification password, asked for only when the QR status says 2fa_required; it is never stored, it is used once to finish the sign-in.
managed_sip and slack are deliberately absent and always will be. Managed SIP credentials are generated by our own Asterisk, so there is nothing for a person to paste. Slack is installed through OAuth — a form for pasting xoxb-… would bypass the install, not replace it.
Request body
Response
Link issued.
Example response
{
"data": {
"provider": "telegram_bot"
}
}Changes
No recorded changes to this operation across all 1 revision of this API.