Vault
Get a credential
One credential's full record: fields with their secret flag, requested and granted scopes, ownership.
GET
https://cloud.generalinput.com/v1/credentials/:idAuthenticationRequires
vault:read on a platform API key. A CLI session always passes.Everything from list credentials plus the field breakdown, so a caller can know which keys a token response will carry before asking for one.
Path parameters
| Name | Notes |
|---|---|
id | Credential id. |
Response
{
"id": "cred_01HX7AB",
"service": "salesforce",
"providerTitle": "Salesforce",
"title": "Salesforce, Acme prod",
"credentialType": "oauth2",
"description": null,
"envVars": [
"SALESFORCE_ACCESS_TOKEN_01HX7AB",
"SALESFORCE_INSTANCE_URL_01HX7AB"
],
"fields": [
{ "name": "accessToken", "isSecret": true },
{ "name": "instanceUrl", "isSecret": false }
],
"requestedScopes": ["api", "refresh_token"],
"grantedScopes": ["api", "refresh_token"],
"isShared": false,
"isOwnedByViewer": true,
"createdAt": "2026-06-01T12:00:00.000Z",
"updatedAt": "2026-08-30T09:12:44.000Z"
}| Field | Type | Notes |
|---|---|---|
fields | object[] | Field name and whether it isSecret. Non-secret fields are config, like an instance URL. |
requestedScopes | string[], null | Scopes asked for at connect time. |
description | string, null | Free text the owner added. |
Errors
| Status | When |
|---|---|
404 | No such credential, or it is not visible to the member. Same response for both. |