VaultCredentialResource

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/openai/main/json-schema/openai-vault-credential-resource-schema.json",
  "title": "VaultCredentialResource",
  "description": "Metadata for a stored credential. Secret values are never returned.",
  "x-generated": "2026-09-23",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/openai-vaults-api-openapi.yml#/components/schemas/VaultCredentialResource",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "minLength": 0,
      "description": "The ID of the credential."
    },
    "object": {
      "type": "string",
      "enum": [
        "vault.credential"
      ],
      "default": "vault.credential",
      "x-stainless-const": true,
      "description": "The object type. Always `vault.credential`."
    },
    "vault_id": {
      "type": "string",
      "minLength": 0,
      "description": "The ID of the vault containing this credential."
    },
    "name": {
      "type": "string",
      "minLength": 0,
      "description": "The human-readable name of the credential."
    },
    "auth": {
      "$ref": "#/$defs/VaultCredentialAuthResource",
      "description": "The authentication method and non-secret configuration of the credential."
    },
    "metadata": {
      "type": "object",
      "additionalProperties": {
        "type": "string",
        "minLength": 0
      },
      "propertyNames": {
        "type": "string",
        "minLength": 0
      },
      "minProperties": 0,
      "description": "Application-defined key-value pairs associated with this credential."
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "The Unix timestamp, in seconds, when the credential was created."
    },
    "updated_at": {
      "type": "integer",
      "format": "int64",
      "description": "The Unix timestamp, in seconds, when the credential was last updated."
    }
  },
  "required": [
    "id",
    "object",
    "vault_id",
    "name",
    "auth",
    "metadata",
    "created_at",
    "updated_at"
  ],
  "additionalProperties": false,
  "$defs": {
    "McpOauthRefreshResource": {
      "type": "object",
      "properties": {
        "token_endpoint": {
          "type": "string",
          "minLength": 0,
          "description": "The HTTPS OAuth token endpoint used for refresh."
        },
        "client_id": {
          "type": "string",
          "minLength": 0,
          "description": "The OAuth client ID used when requesting a new access token."
        },
        "resource": {
          "type": [
            "string",
            "null"
          ],
          "minLength": 0,
          "description": "The resource URI sent to the OAuth token endpoint during refresh, if configured."
        },
        "scope": {
          "type": [
            "string",
            "null"
          ],
          "minLength": 0,
          "description": "Space-separated OAuth scopes requested during refresh, if configured."
        },
        "token_endpoint_auth": {
          "$ref": "#/$defs/McpOauthTokenEndpointAuthResource",
          "description": "How the OAuth client authenticates to the token endpoint, excluding its client secret."
        }
      },
      "required": [
        "token_endpoint",
        "client_id",
        "resource",
        "scope",
        "token_endpoint_auth"
      ],
      "additionalProperties": false,
      "description": "Configuration used to refresh an MCP OAuth access token, excluding secret values."
    },
    "McpOauthTokenEndpointAuthResource": {
      "oneOf": [
        {
          "$ref": "#/$defs/McpOauthTokenEndpointAuthResourceNone"
        },
        {
          "$ref": "#/$defs/McpOauthTokenEndpointAuthResourceClientSecretBasic"
        },
        {
          "$ref": "#/$defs/McpOauthTokenEndpointAuthResourceClientSecretPost"
        }
      ],
      "x-oai-discriminator-values": [
        "none",
        "client_secret_basic",
        "client_secret_post"
      ],
      "description": "The client authentication method used for OAuth token refresh."
    },
    "McpOauthTokenEndpointAuthResourceClientSecretBasic": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "client_secret_basic"
          ],
          "default": "client_secret_basic",
          "x-stainless-const": true,
          "description": "The type of the object. Always `client_secret_basic`."
        }
      },
      "required": [
        "type"
      ],
      "additionalProperties": false,
      "description": "Sends the client ID and secret using HTTP Basic authentication."
    },
    "McpOauthTokenEndpointAuthResourceClientSecretPost": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "client_secret_post"
          ],
          "default": "client_secret_post",
          "x-stainless-const": true,
          "description": "The type of the object. Always `client_secret_post`."
        }
      },
      "required": [
        "type"
      ],
      "additionalProperties": false,
      "description": "Sends the client ID and secret in the token request body."
    },
    "McpOauthTokenEndpointAuthResourceNone": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "none"
          ],
          "default": "none",
          "x-stainless-const": true,
          "description": "The type of the object. Always `none`."
        }
      },
      "required": [
        "type"
      ],
      "additionalProperties": false,
      "description": "Sends the client ID without a client secret."
    },
    "VaultCredentialAuthResource": {
      "oneOf": [
        {
          "$ref": "#/$defs/VaultCredentialAuthResourceMcpOauth"
        },
        {
          "$ref": "#/$defs/VaultCredentialAuthResourceStaticBearer"
        },
        {
          "$ref": "#/$defs/VaultCredentialAuthResourceEnvironmentVariable"
        }
      ],
      "x-oai-discriminator-values": [
        "mcp_oauth",
        "static_bearer",
        "environment_variable"
      ],
      "description": "The authentication configuration of a vault credential, excluding secrets."
    },
    "VaultCredentialAuthResourceEnvironmentVariable": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "environment_variable"
          ],
          "default": "environment_variable",
          "x-stainless-const": true,
          "description": "The type of the object. Always `environment_variable`."
        },
        "secret_name": {
          "type": "string",
          "minLength": 0,
          "description": "The environment variable name that receives the placeholder in the sandbox."
        },
        "networking": {
          "$ref": "#/$defs/VaultCredentialNetworkingResource",
          "description": "The destinations where the proxy can substitute the secret, subject to the environment network policy."
        }
      },
      "required": [
        "type",
        "secret_name",
        "networking"
      ],
      "additionalProperties": false,
      "description": "Metadata for an HTTP credential used only in OpenAI-hosted environments. Sandbox code receives a placeholder. The proxy substitutes the secret for allowed HTTPS destinations on ports 443 and 8443. The real secret is not available to sandbox code for local computation and is never returned in this resource."
    },
    "VaultCredentialAuthResourceMcpOauth": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "mcp_oauth"
          ],
          "default": "mcp_oauth",
          "x-stainless-const": true,
          "description": "The type of the object. Always `mcp_oauth`."
        },
        "mcp_server_url": {
          "type": "string",
          "minLength": 0,
          "description": "The HTTPS MCP server URL authorized by this credential."
        },
        "expires_at": {
          "type": [
            "string",
            "null"
          ],
          "minLength": 0,
          "description": "When the OAuth access token expires, as an RFC 3339 timestamp, if known."
        },
        "refresh": {
          "anyOf": [
            {
              "$ref": "#/$defs/McpOauthRefreshResource"
            },
            {
              "type": "null"
            }
          ],
          "description": "Public refresh metadata without refresh tokens or OAuth client secrets."
        }
      },
      "required": [
        "type",
        "mcp_server_url",
        "expires_at",
        "refresh"
      ],
      "additionalProperties": false,
      "description": "Public metadata for an OAuth credential; tokens and client secrets are never returned."
    },
    "VaultCredentialAuthResourceStaticBearer": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "static_bearer"
          ],
          "default": "static_bearer",
          "x-stainless-const": true,
          "description": "The type of the object. Always `static_bearer`."
        },
        "mcp_server_url": {
          "type": "string",
          "minLength": 0,
          "description": "The HTTPS MCP server URL authorized by this credential."
        }
      },
      "required": [
        "type",
        "mcp_server_url"
      ],
      "additionalProperties": false,
      "description": "Metadata for a bearer-token credential, without automatic OAuth refresh."
    },
    "VaultCredentialNetworkingResource": {
      "oneOf": [
        {
          "$ref": "#/$defs/VaultCredentialNetworkingResourceUnrestricted"
        },
        {
          "$ref": "#/$defs/VaultCredentialNetworkingResourceLimited"
        }
      ],
      "x-oai-discriminator-values": [
        "unrestricted",
        "limited"
      ],
      "description": "Destination permissions for an environment-variable credential. These do not grant network access to the environment."
    },
    "VaultCredentialNetworkingResourceLimited": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "limited"
          ],
          "default": "limited",
          "x-stainless-const": true,
          "description": "The type of the object. Always `limited`."
        },
        "allowed_hosts": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 0
          },
          "minItems": 1,
          "maxItems": 16,
          "description": "The 1 to 16 distinct allowed hostnames or IPv4 addresses, normalized to lowercase. Entries contain no scheme, path, port, or wildcard. IPv6 addresses are not supported."
        }
      },
      "required": [
        "type",
        "allowed_hosts"
      ],
      "additionalProperties": false,
      "description": "Allows substitution only for the listed hosts. The environment network policy must also allow these hosts."
    },
    "VaultCredentialNetworkingResourceUnrestricted": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "unrestricted"
          ],
          "default": "unrestricted",
          "x-stainless-const": true,
          "description": "The type of the object. Always `unrestricted`."
        }
      },
      "required": [
        "type"
      ],
      "additionalProperties": false,
      "description": "Allows substitution for destinations permitted by the environment network policy. Requires `environment.network.access` to be `restricted`, with explicit `allowed_domains`."
    }
  }
}