Sign in

v2

latestOpenAPI 3.0.3Apache 2.0raw.githubusercontent.com2026-01-12412664.0 KB
Vault

Issue Ephemeral Credential

Issue an ephemeral, time-bound access credential for an agent. The credential contains the necessary permissions and can be used to access external services.

post/vault/credentials

Request body

agent_idstring required
ephemeral_public_keystring base64 required

Base64-encoded ephemeral Ed25519 public key (32 bytes)

signaturestring base64 required

Base64-encoded signature (64 bytes)

ttlinteger required

Time-to-live in seconds

scopestring
origin_contextobject

Optional context about the request origin

Example request

{
  "agent_id": "agent-ebd9cd4a-1234",
  "ephemeral_public_key": "AAAAC3NzaC1lZDI1NTE5AAAAIEPH...",
  "signature": "MEUCIQCxxx...",
  "ttl": 3600,
  "scope": "read:secrets:prod/app1",
  "origin_context": {
    "hostname": "agent-host-1",
    "ip": "192.168.1.100"
  }
}

Response

Credential issued successfully

credential_idstring uuid
agent_idstring
ephemeral_public_keystring base64
issued_atstring date-time
expires_atstring date-time
statusstring
scopestring
origin_contextobject
secret_valuestring nullable

The secret value if this credential was issued for secret access

Example response

{
  "credential_id": "123e4567-e89b-12d3-a456-426614174000",
  "agent_id": "agent-ebd9cd4a-1234",
  "ephemeral_public_key": "AAAAC3NzaC1lZDI1NTE5AAAAIEPH...",
  "status": "active",
  "scope": "read:secrets:prod/app1",
  "origin_context": {
    "hostname": "agent-host-1",
    "ip": "192.168.1.100"
  }
}