Enter a secret of a Connection

PUT /v1/connections/{connection_id}/credentials

Property	Value
Operation	`put_connection_credentials`
Group	Connections
Scope	`integrations:write`
Route class	`control`
Idempotency	No `Idempotency-Key`
Audit	Audited `integrations.connection.put_credentials` (mutation)
Released in	1.60.0
Phase 0 host	Served (the hosted api pins 1.65.0)

Seals a key, token, client or certificate into the Connection under the Organization's data key and answers the Connection with its secret_hint (1.60.0; integrations.md section 8). Write-only: the body is never logged, stored in clear or answered, and the Audit event names the kind and the secret version only. A kind the strategy does not take is validation_failed with connection_credential_kind_invalid. A key, token or certificate makes a pending_authorization Connection active.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the integrations:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X PUT "$VOCAL_API/v1/connections/con_.../credentials" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "kind": "api_key", "value": "<value>" }'

const response = await fetch(`${process.env.VOCAL_API}/v1/connections/con_.../credentials`, {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "kind": "api_key",
    "value": "<value>"
  }),
});
console.log(response.status, await response.text());

import os

import requests

response = requests.put(
    f"{os.environ['VOCAL_API']}/v1/connections/con_.../credentials",
    headers={
        "Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
    },
    json={
        "kind": "api_key",
        "value": "<value>",
    },
)
print(response.status_code, response.text)

Parameters

Name	In	Type	Required	Description
`connection_id`	path	ConnectionId	yes	The id of a Connection: `con_` and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log.

Request body

Content type application/json, required: ConnectionCredentialInput.

Responses

Status	Content type	Shape	Error codes
`200`	`application/json`	Connection
`400`	`application/json`	ErrorEnvelope	`invalid_request`
`401`	`application/json`	ErrorEnvelope	`unauthenticated`
`403`	`application/json`	ErrorEnvelope	`forbidden`, `org_suspended`
`404`	`application/json`	ErrorEnvelope	`not_found`
`409`	`application/json`	ErrorEnvelope	`connection_revoked`
`422`	`application/json`	ErrorEnvelope	`validation_failed`
`429`	`application/json`	ErrorEnvelope	`rate_limited`
`500`	`application/json`	ErrorEnvelope	`internal_error`

Fields of the `200` answer

The shape is Connection.

Field	Type	Required	Description
`allowed_environments`	array of Environment	yes	The environments whose runs may use it; `live` only by default. A `test` run against a Connection that does not allow `test` executes the Connector's mock (integrations.md section 3).
`auth_strategy`	ConnectionAuthStrategy	yes
`authorized_at`	Timestamp or null	yes
`base_url`	ConnectionBaseUrl or null	yes
`connector_id`	ConnectorId or null	yes	The Connector; null for an MCP server.
`connector_major`	integer or null	yes	The major version of the Connector's manifest the Connection pins; null for an MCP server.
`created_at`	Timestamp	yes
`enabled_tools`	array of ConnectorToolName	yes	The Connector's tools the Organization allows, which set the scopes requested (integrations.md section 10); empty for an MCP server, whose registration's `allowed_tools` govern.
`external_account`	string or null	yes	The external account authorized (a tenant id, an instance URL); null before.
`granted_scopes`	array of VendorScope	yes	The scopes the vendor granted at the last authorization; empty before.
`id`	ConnectionId	yes
`mcp_server_id`	McpServerId or null	yes	The MCP server registration whose credential the Connection holds; null for a Connector.
`name`	ConnectionName	yes
`object`	`"connection"`	yes
`organization_id`	OrganizationId	yes
`origin`	ConnectionOrigin	yes
`phi_attestation`	ConnectionPhiAttestation or null	yes	The PHI attestation, or null; only an attested Connection may receive PHI.
`requested_scopes`	array of VendorScope	yes	The union of the scopes of `enabled_tools`; nothing more is requested.
`revision`	integer	yes	Counts writes to the Connection; returned as the ETag and required in If-Match.
`revoked_at`	Timestamp or null	yes
`sandbox`	boolean	yes	True for a vendor sandbox, which may allow `test`; a test Call never books a real appointment.
`secret_hint`	string or null	yes	The last characters of the stored key or token, or null; never the secret.
`secret_version`	integer	yes	Counts the secrets stored; 0 before the first. A refresh write-back compares and sets it.
`sender`	ConnectionSender or null	yes	The sender of a messaging Connection; null otherwise.
`status`	ConnectionStatus	yes
`status_reason`	ConnectionStatusReason or null	yes	Null while `active`.
`updated_at`	Timestamp	yes