Vault
List credentials
Every credential the member can use, with the env var names each one injects. Never secret values.
GET
https://cloud.generalinput.com/v1/credentialsAuthenticationRequires
vault:read on a platform API key. A CLI session always passes.Credentials the member owns, plus ones shared with them through a workspace grant or a per-credential collaborator row. Discovery only: ids and metadata, never the secret.
Response
{
"credentials": [
{
"id": "cred_01HX7AB",
"service": "slack",
"providerTitle": "Slack",
"title": "Slack, Acme prod",
"credentialType": "oauth2",
"envVars": ["SLACK_ACCESS_TOKEN_01HX7AB", "SLACK_BOT_TOKEN"],
"grantedScopes": ["chat:write", "channels:read"],
"isShared": false,
"isOwnedByViewer": true,
"createdAt": "2026-06-01T12:00:00.000Z",
"updatedAt": "2026-08-30T09:12:44.000Z"
}
]
}| Field | Type | Notes |
|---|---|---|
id | string | Pass to issue a token. |
service | string | The integration slug. |
providerTitle | string | The service's display name. |
title | string | The label the owner gave it. |
credentialType | string | oauth2, apiKey, and so on. |
envVars | string[] | Names the token endpoint's env map uses. Schema-derived names carry an _<id> suffix so two credentials of one service coexist; provider-canonical aliases (GH_TOKEN, OPENAI_API_KEY) do not. |
grantedScopes | string[], null | OAuth scopes granted at connect time. null for non-OAuth credentials. |
isShared | boolean | Shared with the member rather than owned. |
isOwnedByViewer | boolean | The member the key acts as owns it. |
Example
curl -s https://cloud.generalinput.com/v1/credentials \
-H "Authorization: Bearer $GI_API_KEY" | jq '.credentials[] | select(.service == "slack") | .id'