---
title: "Get Integration Instance Auth Credential"
method: GET
path: "/v1/integration-instances/{integrationInstanceId}/auth-credential"
tags: ["Integration Instance Auth Credentials"]
---

# Get Integration Instance Auth Credential

`GET /v1/integration-instances/{integrationInstanceId}/auth-credential`

Fetches the auth credential scoped to the given integration instance.

## Response `200`

A response containing an integration instance auth credential.

- union — Object containing metadata for an integration instance auth credential.
  - OAuthCredential — Represents a credential scoped to an integration instance that supports the `OAuth` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'oauth', required
  - GitHubAppInstallationCredential — Represents a credential scoped to an integration instance that supports the `GitHub App Installation` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'github_app_installation', required
    - `config` object, required
      - `installation_id` string, required — The GitHub App installation ID
      - `app_installed_by` string, nullable, required — The GitHub user who installed the app.
  - MultiKeyAuthCredential — Represents a credential scoped to an integration instance that supports the `Multi Key` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'multi_key_auth', required
  - AWSRoleDelegationAuthCredential — Represents a credential scoped to an integration instance that supports the `AWS Role Delegation` authorization strategy.
    - `id` string, uuid, required
    - `integration_instance` IntegrationInstanceRef, required — Short-hand descriptor of an integration instance.
      - `id` string, uuid, required — The integration instance ID.
      - `name` string, required — The machine name of the integration instance that uniquely identifies it within the catalog.
      - `display_name` string, required — The display name of the integration instance.
    - `missing_permissions` MissingPermission[], required — List of detected missing permissions required to enable the full functionality of the given integration instance.
      - `scopes` string[], required
      - `message` string, required — Describes the degraded experience of the integration instance due to the missing permission. May also include a message on how to resolve the missing permission.
    - `tainted` boolean, required — Indicates that the credential is no longer valid and must be replaced with a new valid credential.
    - `expires_at` string, date-time, nullable, required — Timestamp denoting when the when the credential will expire in RFC-3339 format with a "T" character separating date from time within the field value. When expired, the credential must be replaced with a new valid credential to re-enable full functionality for the given integration instance. A `null` value indicates no known expiration time.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `type` 'aws_role_delegation', required
    - `config` object, required
      - `role_arn` string, required — The Role ARN use for AWS Assume Role.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/0261aef4b1e2/schema)