Enter or rotate the Organization's credential for a Provider

PUT /v1/provider-credentials/{provider}

Checks the key with the vendor where the vendor offers a cheap read, then seals it as the Provider's next version for the caller's Organization and revokes the active one (1.28.0). From then on every chain entry of the Organization's Calls that names the Provider runs on this key; running Calls keep the version they were issued. A Provider whose descriptors do not list byok is refused with validation_failed and the issue credential_mode_unavailable; a key the vendor refuses, with validation_failed and the issue credential_invalid; a vendor that does not answer, with dependency_unavailable; in each case nothing is stored. The request body is never logged, never stored in clear and never returned; the response and the Audit event name the Provider, the version and the verification outcome, never the secret or the hint. Session only: the api refuses the route to every API key, whatever its scopes, and accepts a Member ID token with credentials:write.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the credentials:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X PUT "$VOCAL_API/v1/provider-credentials/mock" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "secret": "<secret>" }'

const response = await fetch(`${process.env.VOCAL_API}/v1/provider-credentials/mock`, {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "secret": "<secret>"
  }),
});
console.log(response.status, await response.text());

import os

import requests

response = requests.put(
    f"{os.environ['VOCAL_API']}/v1/provider-credentials/mock",
    headers={
        "Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
    },
    json={
        "secret": "<secret>",
    },
)
print(response.status_code, response.text)

Parameters

Request body

Content type application/json, required: ProviderCredentialPutRequest.

Responses

Fields of the 200 answer

The shape is ProviderCredential.