Module vaults 

Available on crate feature managed-agents-preview only.

Vaults: per-user collections of MCP credentials.

Vaults are workspace-scoped and reference credentials by ID at session creation time. Credentials are write-only: secret fields are never returned in API responses.

Constraints:

• One active credential per mcp_server_url per vault.
• mcp_server_url is immutable after creation; archive and replace.
• Maximum 20 credentials per vault.

Structs

CreateCredentialRequest

Request body for POST /v1/vaults/{id}/credentials.

CreateVaultRequest

Request body for POST /v1/vaults.

Credential

A stored credential. Secret fields are never echoed in API responses; the auth object carries only the non-secret metadata (server URL, expiry, etc.).

Credentials

Namespace handle for credential operations on a single vault.

ListVaultsParams

Optional knobs for Vaults::list.

McpOauthAuth

mcp_oauth credential body.

McpOauthBuilder

Builder for McpOauthAuth credentials.

OAuthRefresh

OAuth refresh configuration on an mcp_oauth credential.

OAuthRefreshPatch

Partial refresh-block patch for CredentialAuthPatch::McpOauth.

StaticBearerAuth

static_bearer credential body.

UpdateCredentialRequest

Patch applied to an existing credential. Only the secret payload and a few metadata fields are mutable; mcp_server_url, token_endpoint, and client_id are locked after creation.

Vault

A vault: collection of MCP credentials, typically scoped to one end-user.

Vaults

Namespace handle for the Vaults API.

Enums

CredentialAuth

Credential authentication payload.

CredentialAuthPatch

Partial auth update for UpdateCredentialRequest. Pass only the fields you want to rotate; immutable fields (mcp_server_url, token_endpoint, client_id) cannot be changed.

CredentialAuthResponse

Auth payload as returned on a credential response. Mirrors CredentialAuth but never carries the secret token fields.

TokenEndpointAuth

Token-endpoint authentication scheme for refreshing OAuth credentials.