---
title: "Bind credential to toolkit"
method: POST
path: "/toolkits/{toolkit_id}/credentials"
tags: ["Toolkit Credentials"]
---

# Bind credential to toolkit

`POST /toolkits/{toolkit_id}/credentials`

Bind an existing credential to a toolkit, optionally with inline permission rules.

## Path parameters

- `toolkit_id` string, required

## Request body

- ToolkitCredentialBindRequest — Bind a credential to a toolkit.
  - `allow_all` boolean — Convenience flag: bind with a single `allow` rule that matches every request for this binding's vendor. Mutually exclusive with `permissions`.
  - `credential_id` string, required
  - `permissions` JenticOneControlWebSchemasToolkitsPermissionRuleSchema[], nullable
    - `effect` 'allow' | 'deny', required — Whether this rule allows or denies the matched request.
    - `match_mode` 'regex' | 'prefix' | 'exact' — How `path` is interpreted: `regex` (full-match), `prefix` (string prefix), or `exact` (equality). Defaults to `regex` for backwards compatibility.
    - `methods` string[], nullable — HTTP methods to match (case-insensitive). None matches all.
    - `operations` string[], nullable — OpenAPI operation IDs to match. None matches all operations.
    - `path` string, nullable — Path pattern to match. Interpreted per `match_mode`: `regex` uses full-match semantics (the pattern must describe the whole path); `prefix` and `exact` are literal. None matches all paths.

## Response `201`

Successful Response

- ToolkitCredentialBindingResponse — Credential binding response.
  - `api_name` string, nullable
  - `api_vendor` string, nullable
  - `bound_at` string, date-time, required
  - `catalog_api_id` string, nullable — Catalog identity slug of the bound credential's target API (`domain[/sub-api]`), when recorded. Display-only.
  - `credential_id` string, required
  - `credential_type` string, nullable
  - `label` string, nullable
  - `permissions` PermissionRuleReadSchema[]
    - `_comment` string, nullable
    - `_system` boolean
    - `effect` 'allow' | 'deny', required
    - `match_mode` 'regex' | 'prefix' | 'exact'
    - `methods` string[], nullable
    - `operations` string[], nullable
    - `path` string, nullable
  - `toolkit_id` string, required
  - `warnings` BindingWarningSchema[] — Non-fatal bind-time signals — e.g. a binding that landed with zero permission rules (broker denies by default until rules are added).
    - `code` string, required — Stable machine-readable warning code.
    - `credential_id` string, nullable — Credential the warning applies to; null when the whole binding is meant.
    - `message` string, required — Human-readable explanation with a recovery pointer.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `409` — Credential already bound
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.net/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/versions/ff371f19960a/schema)