openapi: 3.1.0
info:
  title: Kernel API Keys Credential Providers API
  description: Developer tools and cloud infrastructure for AI agents to use web browsers
  version: 0.1.0
servers:
- url: https://api.onkernel.com
  description: API Server
security:
- bearerAuth: []
tags:
- name: Credential Providers
  description: Configure external credential providers like 1Password.
paths:
  /org/credential_providers:
    post:
      x-hidden: true
      operationId: postCredentialProviders
      tags:
      - Credential Providers
      summary: Create a credential provider
      description: Configure an external credential provider (e.g., 1Password) for automatic credential lookup.
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCredentialProviderRequest'
      responses:
        '201':
          description: Credential provider created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialProvider'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProvider = await client.credentialProviders.create({\n  token: 'ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',\n  name: 'my-1password',\n  provider_type: 'onepassword',\n});\n\nconsole.log(credentialProvider.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\ncredential_provider = client.credential_providers.create(\n    token=\"ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n    name=\"my-1password\",\n    provider_type=\"onepassword\",\n)\nprint(credential_provider.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProvider, err := client.CredentialProviders.New(context.TODO(), kernel.CredentialProviderNewParams{\n\t\tCreateCredentialProviderRequest: kernel.CreateCredentialProviderRequestParam{\n\t\t\tToken:        \"ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n\t\t\tName:         \"my-1password\",\n\t\t\tProviderType: kernel.CreateCredentialProviderRequestProviderTypeOnepassword,\n\t\t},\n\t})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProvider.ID)\n}\n"
    get:
      x-hidden: true
      operationId: getCredentialProviders
      tags:
      - Credential Providers
      summary: List credential providers
      description: List external credential providers configured for the organization.
      security:
      - bearerAuth: []
      responses:
        '200':
          description: List of credential providers
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CredentialProvider'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProviders = await client.credentialProviders.list();\n\nconsole.log(credentialProviders);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\ncredential_providers = client.credential_providers.list()\nprint(credential_providers)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProviders, err := client.CredentialProviders.List(context.TODO())\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProviders)\n}\n"
  /org/credential_providers/{id}:
    get:
      x-hidden: true
      operationId: getCredentialProvidersById
      tags:
      - Credential Providers
      summary: Get credential provider by ID
      description: Retrieve a credential provider by its ID.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Credential provider ID
      responses:
        '200':
          description: Credential provider details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialProvider'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProvider = await client.credentialProviders.retrieve('id');\n\nconsole.log(credentialProvider.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\ncredential_provider = client.credential_providers.retrieve(\n    \"id\",\n)\nprint(credential_provider.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProvider, err := client.CredentialProviders.Get(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProvider.ID)\n}\n"
    patch:
      x-hidden: true
      operationId: patchCredentialProvidersById
      tags:
      - Credential Providers
      summary: Update credential provider
      description: Update a credential provider's configuration.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Credential provider ID
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateCredentialProviderRequest'
      responses:
        '200':
          description: Credential provider updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialProvider'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProvider = await client.credentialProviders.update('id');\n\nconsole.log(credentialProvider.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\ncredential_provider = client.credential_providers.update(\n    id=\"id\",\n)\nprint(credential_provider.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProvider, err := client.CredentialProviders.Update(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.CredentialProviderUpdateParams{\n\t\t\tUpdateCredentialProviderRequest: kernel.UpdateCredentialProviderRequestParam{},\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProvider.ID)\n}\n"
    delete:
      x-hidden: true
      operationId: deleteCredentialProvidersById
      tags:
      - Credential Providers
      summary: Delete credential provider
      description: Delete a credential provider by its ID.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Credential provider ID
      responses:
        '204':
          description: Credential provider deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nawait client.credentialProviders.delete('id');"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nclient.credential_providers.delete(\n    \"id\",\n)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\terr := client.CredentialProviders.Delete(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n}\n"
  /org/credential_providers/{id}/test:
    post:
      x-hidden: true
      operationId: testCredentialProviderById
      tags:
      - Credential Providers
      summary: Test credential provider connection
      description: Validate the credential provider's token and list accessible vaults.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Credential provider ID
      responses:
        '200':
          description: Connection test successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialProviderTestResult'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst credentialProviderTestResult = await client.credentialProviders.test('id');\n\nconsole.log(credentialProviderTestResult.success);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\ncredential_provider_test_result = client.credential_providers.test(\n    \"id\",\n)\nprint(credential_provider_test_result.success)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tcredentialProviderTestResult, err := client.CredentialProviders.Test(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", credentialProviderTestResult.Success)\n}\n"
  /org/credential_providers/{id}/items:
    get:
      x-hidden: true
      operationId: getCredentialProviderItems
      tags:
      - Credential Providers
      summary: List items from a credential provider
      description: Returns available credential items (e.g., 1Password login items) from the provider.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Credential provider ID
      responses:
        '200':
          description: List of credential items
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/CredentialProviderItem'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst response = await client.credentialProviders.listItems('id');\n\nconsole.log(response.items);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nresponse = client.credential_providers.list_items(\n    \"id\",\n)\nprint(response.items)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tresponse, err := client.CredentialProviders.ListItems(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", response.Items)\n}\n"
components:
  responses:
    InternalError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Forbidden – insufficient permissions or plan
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Unauthorized – missing or invalid authorization token
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Conflict:
      description: Conflict – resource already exists
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Bad Request – invalid input
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    ErrorDetail:
      type: object
      properties:
        code:
          type: string
          description: Lower-level error code providing more specific detail
          example: invalid_input
        message:
          type: string
          description: Further detail about the error
          example: Provided version string is not semver compliant
    CredentialProvider:
      type: object
      description: An external credential provider (e.g., 1Password) for automatic credential lookup
      required:
      - id
      - provider_type
      - name
      - enabled
      - priority
      - created_at
      - updated_at
      properties:
        id:
          type: string
          description: Unique identifier for the credential provider
          example: credprov_abc123xyz
        provider_type:
          type: string
          description: Type of credential provider
          enum:
          - onepassword
          example: onepassword
        name:
          type: string
          description: Human-readable name for this provider instance
          example: my-1password
        enabled:
          type: boolean
          description: Whether the provider is enabled for credential lookups
          example: true
        priority:
          type: integer
          description: Priority order for credential lookups (lower numbers are checked first)
          example: 0
        created_at:
          type: string
          format: date-time
          description: When the credential provider was created
          example: '2025-01-15T10:30:00Z'
        updated_at:
          type: string
          format: date-time
          description: When the credential provider was last updated
          example: '2025-01-15T10:30:00Z'
      additionalProperties: false
    CreateCredentialProviderRequest:
      type: object
      description: Request to create an external credential provider
      required:
      - provider_type
      - name
      - token
      properties:
        provider_type:
          type: string
          description: Type of credential provider
          enum:
          - onepassword
          example: onepassword
        name:
          type: string
          description: Human-readable name for this provider instance (unique per org)
          example: my-1password
        token:
          type: string
          description: Service account token for the provider (e.g., 1Password service account token)
          example: ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
        cache_ttl_seconds:
          type: integer
          description: How long to cache credential lists (default 300 seconds)
          default: 300
          example: 300
      additionalProperties: false
    Error:
      type: object
      required:
      - code
      - message
      properties:
        code:
          type: string
          description: Application-specific error code (machine-readable)
          example: bad_request
        message:
          type: string
          description: Human-readable error description for debugging
          example: 'Missing required field: app_name'
        details:
          type: array
          description: Additional error details (for multiple errors)
          items:
            $ref: '#/components/schemas/ErrorDetail'
        inner_error:
          $ref: '#/components/schemas/ErrorDetail'
    CredentialProviderTestResult:
      type: object
      description: Result of testing a credential provider connection
      required:
      - success
      - vaults
      properties:
        success:
          type: boolean
          description: Whether the connection test was successful
          example: true
        vaults:
          type: array
          description: List of vaults accessible by the service account
          items:
            type: object
            required:
            - id
            - name
            properties:
              id:
                type: string
                description: Vault ID
                example: abc123xyz
              name:
                type: string
                description: Vault name
                example: Shared Logins
        error:
          type: string
          description: Error message if the test failed
          example: Invalid token
      additionalProperties: false
    CredentialProviderItem:
      type: object
      description: A credential item from an external provider (e.g., a 1Password login item)
      required:
      - id
      - title
      - vault_id
      - vault_name
      - path
      properties:
        id:
          type: string
          description: Unique identifier for the item within the provider
          example: abc123xyz
        title:
          type: string
          description: Display name of the credential item
          example: Netflix Login
        vault_id:
          type: string
          description: ID of the vault containing this item
          example: vault_abc123
        vault_name:
          type: string
          description: Name of the vault containing this item
          example: Engineering
        path:
          type: string
          description: Path to reference this item (VaultName/ItemTitle format)
          example: Engineering/Netflix Login
        urls:
          type: array
          items:
            type: string
          description: URLs associated with this credential
          example:
          - https://netflix.com
          - https://www.netflix.com
      additionalProperties: false
    UpdateCredentialProviderRequest:
      type: object
      description: Request to update a credential provider
      properties:
        name:
          type: string
          description: Human-readable name for this provider instance
          example: my-1password
        enabled:
          type: boolean
          description: Whether the provider is enabled for credential lookups
          example: true
        priority:
          type: integer
          description: Priority order for credential lookups (lower numbers are checked first)
          example: 0
        token:
          type: string
          description: New service account token (to rotate credentials)
          example: ops_eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
        cache_ttl_seconds:
          type: integer
          description: How long to cache credential lists
          example: 300
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer