The credential to test. It is spent on one read and never persisted.
kind is a StandardProviderKind or CustomProviderKind value; provider carries the same field vocabulary the vault stores, so a card can probe what it is about to save without reshaping it.
Provider kind, e.g. 'openai', 'azure', 'custom'.
Credentials in transit only. Never persisted here, never logged, never echoed.
key is a SecretStr and extras is kept out of repr, so an accidental log line or traceback that carries this object cannot print the credential. Unwrap the key with .get_secret_value() at the point it is put on the wire, never earlier.
Successful Response