Credentials API
Credential references, rotation and revocation. Secrets are never returned.
Veefore seals material on the way in and brokers short-lived, scoped credentials on the way out. No endpoint in this group returns a secret value, and none ever will — the response carries metadata only.
Step-up required
2 endpoints in this group require a fresh step-up authentication within the last few minutes, even for a session that already holds the permission. They are marked below.
#Endpoints
| Endpoint | Permission | Notes | |
|---|---|---|---|
GET |
/v1/credentials |
credential:read_metadata |
— |
POST |
/v1/credentials |
credential:create |
— |
POST |
/v1/credentials/{credentialId}/rotate |
credential:rotate |
step-up |
POST |
/v1/credentials/{credentialId}/revoke |
credential:revoke |
step-up, high impact |
#What each endpoint does
#GET /v1/credentials
Credential metadata. Secrets are never returned.
Requires credential:read_metadata.
#POST /v1/credentials
Register a credential reference.
Requires credential:create.
#POST /v1/credentials/{credentialId}/rotate
Rotate and invalidate outstanding leases.
Requires credential:rotate. Step-up authentication is also required.
#POST /v1/credentials/{credentialId}/revoke
Revoke a credential.
Requires credential:revoke. Step-up authentication is also required.
Request body:
json{
"reason": "string"
}