---
title: "Credentials API"
description: "Credential references, rotation and revocation. Secrets are never returned."
label: "Credentials"
generated: "the API catalogue in apps/control-plane/src/routes/developer.ts"
---


Veefore seals material on the way in and brokers short-lived, scoped credentials on the way out. No endpoint in this group returns a secret value, and none ever will — the response carries metadata only.

:::warning Step-up required
2 endpoints in this group require a fresh step-up authentication within the last few minutes, even for a session that already holds the permission. They are marked below.
:::

## Endpoints

| | Endpoint | Permission | Notes |
| --- | --- | --- | --- |
| `GET` | `/v1/credentials` | `credential:read_metadata` | — |
| `POST` | `/v1/credentials` | `credential:create` | — |
| `POST` | `/v1/credentials/{credentialId}/rotate` | `credential:rotate` | step-up |
| `POST` | `/v1/credentials/{credentialId}/revoke` | `credential:revoke` | step-up, high impact |

## What each endpoint does

### `GET /v1/credentials`

Credential metadata. Secrets are never returned.

Requires `credential:read_metadata`.

### `POST /v1/credentials`

Register a credential reference.

Requires `credential:create`.

### `POST /v1/credentials/{credentialId}/rotate`

Rotate and invalidate outstanding leases.

Requires `credential:rotate`. Step-up authentication is also required.

### `POST /v1/credentials/{credentialId}/revoke`

Revoke a credential.

Requires `credential:revoke`. Step-up authentication is also required.

Request body:

```json
{
  "reason": "string"
}
```