---
title: "Issue Ephemeral Credential"
method: POST
path: "/vault/credentials"
tags: ["Vault"]
---

# Issue Ephemeral Credential

`POST /vault/credentials`

Issue an ephemeral, time-bound access credential for an agent.
The credential contains the necessary permissions and can be used to access external services.

## Request body

- CredentialIssueRequest
  - `agent_id` string, required
  - `ephemeral_public_key` string, base64, required — Base64-encoded ephemeral Ed25519 public key (32 bytes)
  - `signature` string, base64, required — Base64-encoded signature (64 bytes)
  - `ttl` integer, required — Time-to-live in seconds
  - `scope` string
  - `origin_context` object — Optional context about the request origin

## Response `201`

Credential issued successfully

- CredentialIssueResponse
  - `credential_id` string, uuid
  - `agent_id` string
  - `ephemeral_public_key` string, base64
  - `issued_at` string, date-time
  - `expires_at` string, date-time
  - `status` string
  - `scope` string
  - `origin_context` object
  - `secret_value` string, nullable — The secret value if this credential was issued for secret access

## Other responses

- `400` — Bad Request - Invalid input parameters
- `401` — Unauthorized - Invalid or missing authentication
- `403` — Agent is not active
- `404` — Agent not found
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/deeptrail/apis/deepsecure-api-dual-service-architecture.md) · [All operations](https://skmtc.net/deeptrail/apis/deepsecure-api-dual-service-architecture/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deeptrail/deepsecure-api-dual-service-architecture/revisions/78627360c082/schema)