{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/anthropic/main/json-schema/anthropic-beta-managed-agents-list-credentials-response-schema.json",
  "title": "BetaManagedAgentsListCredentialsResponse",
  "description": "Response containing a paginated list of credentials.",
  "x-generated": "2026-09-23",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/anthropic-vaults-api-openapi.yml#/components/schemas/BetaManagedAgentsListCredentialsResponse",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "data": {
      "description": "List of credentials.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/BetaManagedAgentsCredential"
      }
    },
    "next_page": {
      "description": "Pagination token for the next page, or null if no more results.",
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    }
  },
  "$defs": {
    "BetaManagedAgentsCredential": {
      "description": "A credential stored in a vault. Sensitive fields are never returned in responses.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type",
        "id",
        "vault_id",
        "metadata",
        "created_at",
        "updated_at",
        "archived_at",
        "auth"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "vault_credential"
          ]
        },
        "id": {
          "description": "Unique identifier for the credential.",
          "type": "string"
        },
        "vault_id": {
          "description": "Identifier of the vault this credential belongs to.",
          "type": "string"
        },
        "display_name": {
          "description": "Human-readable name for the credential.",
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ]
        },
        "metadata": {
          "description": "Arbitrary key-value metadata attached to the credential.",
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "created_at": {
          "$ref": "#/$defs/BetaTimestamp"
        },
        "updated_at": {
          "$ref": "#/$defs/BetaTimestamp"
        },
        "archived_at": {
          "description": "When the credential was archived. Null if not archived.",
          "anyOf": [
            {
              "$ref": "#/$defs/BetaTimestamp"
            },
            {
              "type": "null"
            }
          ]
        },
        "auth": {
          "description": "Authentication configuration for this credential.",
          "allOf": [
            {
              "$ref": "#/$defs/BetaManagedAgentsCredentialAuth"
            }
          ]
        }
      }
    },
    "BetaManagedAgentsCredentialAuth": {
      "description": "Authentication details for a credential.",
      "type": "object",
      "oneOf": [
        {
          "$ref": "#/$defs/BetaManagedAgentsMcpOauthAuthResponse"
        },
        {
          "$ref": "#/$defs/BetaManagedAgentsStaticBearerAuthResponse"
        },
        {
          "$ref": "#/$defs/BetaManagedAgentsEnvironmentVariableAuthResponse"
        }
      ]
    },
    "BetaManagedAgentsCredentialNetworkingResponse": {
      "type": "object",
      "oneOf": [
        {
          "$ref": "#/$defs/BetaManagedAgentsUnrestrictedCredentialNetworkingResponse"
        },
        {
          "$ref": "#/$defs/BetaManagedAgentsLimitedCredentialNetworkingResponse"
        }
      ]
    },
    "BetaManagedAgentsEnvironmentVariableAuthResponse": {
      "description": "Environment variable credential details. The secret value is never returned.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type",
        "secret_name",
        "networking",
        "injection_location"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "environment_variable"
          ]
        },
        "secret_name": {
          "description": "Name of the environment variable.",
          "type": "string"
        },
        "networking": {
          "description": "Outbound hosts the secret value is substituted on.",
          "allOf": [
            {
              "$ref": "#/$defs/BetaManagedAgentsCredentialNetworkingResponse"
            }
          ]
        },
        "injection_location": {
          "description": "Where in the outbound request the secret value is substituted.",
          "allOf": [
            {
              "$ref": "#/$defs/BetaManagedAgentsInjectionLocationResponse"
            }
          ],
          "x-anthropic-beta-required": [
            "managed-agents-2026-04-01"
          ]
        }
      }
    },
    "BetaManagedAgentsInjectionLocationResponse": {
      "description": "Where in the outbound request the secret value is substituted.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "header",
        "body"
      ],
      "properties": {
        "header": {
          "description": "Whether the placeholder is substituted in request header values.",
          "type": "boolean"
        },
        "body": {
          "description": "Whether the placeholder is substituted in the request body.",
          "type": "boolean"
        }
      }
    },
    "BetaManagedAgentsLimitedCredentialNetworkingResponse": {
      "description": "The secret is substituted only on requests to the listed hosts.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type",
        "allowed_hosts"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "limited"
          ]
        },
        "allowed_hosts": {
          "description": "Hostnames on which the secret will be substituted. An entry matches the request host exactly; a `*.`-prefixed entry matches any subdomain of the named domain but not the domain itself.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "BetaManagedAgentsMcpOauthAuthResponse": {
      "description": "OAuth credential details for an MCP server.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type",
        "mcp_server_url"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "mcp_oauth"
          ]
        },
        "mcp_server_url": {
          "description": "URL of the MCP server this credential authenticates against.",
          "type": "string"
        },
        "expires_at": {
          "anyOf": [
            {
              "$ref": "#/$defs/BetaTimestamp"
            },
            {
              "type": "null"
            }
          ]
        },
        "refresh": {
          "description": "Refresh token configuration, if the credential supports token refresh.",
          "anyOf": [
            {
              "$ref": "#/$defs/BetaManagedAgentsMcpOauthRefreshResponse"
            },
            {
              "type": "null"
            }
          ]
        }
      }
    },
    "BetaManagedAgentsMcpOauthRefreshResponse": {
      "description": "OAuth refresh token configuration returned in credential responses.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "token_endpoint",
        "client_id",
        "token_endpoint_auth"
      ],
      "properties": {
        "token_endpoint": {
          "description": "Token endpoint URL used to refresh the access token.",
          "type": "string"
        },
        "client_id": {
          "description": "OAuth client ID.",
          "type": "string"
        },
        "resource": {
          "description": "OAuth resource indicator.",
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ]
        },
        "scope": {
          "description": "OAuth scope for the refresh request.",
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ]
        },
        "token_endpoint_auth": {
          "type": "object",
          "oneOf": [
            {
              "$ref": "#/$defs/BetaManagedAgentsTokenEndpointAuthNoneResponse"
            },
            {
              "$ref": "#/$defs/BetaManagedAgentsTokenEndpointAuthBasicResponse"
            },
            {
              "$ref": "#/$defs/BetaManagedAgentsTokenEndpointAuthPostResponse"
            }
          ]
        }
      }
    },
    "BetaManagedAgentsStaticBearerAuthResponse": {
      "description": "Static bearer token credential details for an MCP server.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type",
        "mcp_server_url"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "static_bearer"
          ]
        },
        "mcp_server_url": {
          "description": "URL of the MCP server this credential authenticates against.",
          "type": "string"
        }
      }
    },
    "BetaManagedAgentsTokenEndpointAuthBasicResponse": {
      "description": "Token endpoint uses HTTP Basic authentication with client credentials.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "client_secret_basic"
          ]
        }
      }
    },
    "BetaManagedAgentsTokenEndpointAuthNoneResponse": {
      "description": "Token endpoint requires no client authentication.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "none"
          ]
        }
      }
    },
    "BetaManagedAgentsTokenEndpointAuthPostResponse": {
      "description": "Token endpoint uses POST body authentication with client credentials.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "client_secret_post"
          ]
        }
      }
    },
    "BetaManagedAgentsUnrestrictedCredentialNetworkingResponse": {
      "description": "The secret is substituted on any host the session's Environment network policy permits egress to.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "unrestricted"
          ]
        }
      }
    },
    "BetaTimestamp": {
      "description": "A timestamp in RFC 3339 format",
      "type": "string",
      "format": "date-time"
    }
  }
}