Credential API endpoints

The automation orchestrator REST API provides endpoints for managing credentials and credential types. The following tables list each endpoint, its HTTP method, and the required permission.

Credentials

Credentials are encrypted authentication resources used by workflows, chat, and agentic orchestration. Each credential references a credential type that defines its field schema and injection patterns.

The API masks credential input fields differently depending on the endpoint. List responses mask all input fields as $encrypted$ without decryption. Detail responses mask only secret-typed fields; non-secret fields appear in plain text. To preserve an existing secret value when updating a credential, pass $encrypted$ as the field value rather than the actual secret.

All paths are relative to the /api/v1 prefix.

Table 1. Credential endpoints
Method Endpoint Description Permission
POST /credentials Create a new credential with encrypted inputs. Required fields:name,credential_type_id,project_id. Returns201 Created. credential:create
GET /credentials List credentials with optional filtering and cursor-based pagination. Supportscredential_type_id,enabled, andfor_action query parameters. Passfor_action=use to filter for credentials the authenticated user hascredential:use permission on; the workflow builder uses this filter for credential selection. All input fields are masked as$encrypted$. credential:read
GET /credentials/{credential_id} Retrieve a single credential. Secret fields masked as$encrypted$. credential:read
PATCH /credentials/{credential_id} Partially update a credential. Pass$encrypted$ for any secret field to preserve its existing value without decrypting it. credential:update
DELETE /credentials/{credential_id} Delete a credential. Returns204 No Content. Returns 409 Conflict with error code CREDENTIAL_IN_USE if the credential is an integration's management credential. credential:delete
GET /credentials/{credential_id}/workflows List workflows that reference this credential. Each result includes the names of the nodes using the credential. credential:read

Before deleting a credential, check the workflow_count and integration_count fields on the credential response. If the credential is an integration's management credential, the request returns 409 Conflict with the error code CREDENTIAL_IN_USE. Reassign or remove the credential from every integration, then retry the deletion. Deleting a credential that is referenced only by workflows returns 204 No Content; those workflows fail on their next run.

Credential types

Credential types define the field schema and injection patterns for credentials. All credential types are preseeded and managed by the system. You cannot create, update, or delete credential types through the API.

Credential type endpoints do not require a specific permission but still require an authenticated session.

Table 2. Credential type endpoints
Method Endpoint Description Permission
GET /credential_types List all credential types, including preseeded managed types. Each result includes acredential_count of credentials using it. None required
GET /credential_types/{credential_type_id} Retrieve a single credential type with its field schema (inputs), injection patterns (injectors), andcredential_count. None required