RequestRocketRequestRocketDocs
ConnectInbound credentials

Inbound credentials API

Create the credential a caller presents.

Inbound and target credentials are the same collection. credentialType proxy is inbound. credentialType target is the credential RequestRocket sends upstream.

Endpoints

MethodPathWhat it does
GET/api/clients/:clientId/credentialsList credentials
POST/api/clients/:clientId/credentialsCreate a credential
GET/api/clients/:clientId/credentials/:credentialIdRead a credential
PUT/api/clients/:clientId/credentials/:credentialIdUpdate a credential
DELETE/api/clients/:clientId/credentials/:credentialIdDelete a credential

Create an inbound credential

POST /api/clients/:clientId/credentials creates the credential. This body is an inbound API key.

Request

curl -X POST "https://api.requestrocket.com/api/clients/:clientId/credentials" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "credentialName": "Caller key",
  "credentialType": "proxy",
  "credentialAuthType": "key",
  "credentialRegion": "us-east-2",
  "credentialSecret": {
    "key": "Authorization",
    "value": "replace-me",
    "addToHeader": true
  }
}'
import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/clients/:clientId/credentials",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "credentialName": "Caller key",
  "credentialType": "proxy",
  "credentialAuthType": "key",
  "credentialRegion": "us-east-2",
  "credentialSecret": {
    "key": "Authorization",
    "value": "replace-me",
    "addToHeader": true
  }
}
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/clients/:clientId/credentials",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"credentialName\": \"Caller key\",\n  \"credentialType\": \"proxy\",\n  \"credentialAuthType\": \"key\",\n  \"credentialRegion\": \"us-east-2\",\n  \"credentialSecret\": {\n    \"key\": \"Authorization\",\n    \"value\": \"replace-me\",\n    \"addToHeader\": true\n  }\n}"
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "credentialName": "Caller key",
  "credentialType": "proxy",
  "credentialAuthType": "key",
  "credentialRegion": "us-east-2",
  "credentialSecret": {
    "key": "Authorization",
    "value": "replace-me",
    "addToHeader": true
  }
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/credentials", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/credentials"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"credentialName\": \"Caller key\",\n  \"credentialType\": \"proxy\",\n  \"credentialAuthType\": \"key\",\n  \"credentialRegion\": \"us-east-2\",\n  \"credentialSecret\": {\n    \"key\": \"Authorization\",\n    \"value\": \"replace-me\",\n    \"addToHeader\": true\n  }\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "credentials": [
    {
      "credentialType": "proxy",
      "credentialAuthType": "key",
      "credentialName": "Caller key",
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "parentId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "credentialRegion": "us-east-2",
      "credentialCreatedAt": "2026-11-02T07:30:00.000Z",
      "credentialUpdatedAt": "2026-11-02T07:30:00.000Z",
      "temporary": false,
      "credentialDefaultRuleEffect": null,
      "credentialNotes": null,
      "TTL": null
    }
  ],
  "message": "Success"
}
{
  "message": "credentialType is required"
}
{
  "message": "Unauthorized"
}
{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}
{
  "message": "method / endpoint not supported"
}

Returns a credentials array with message set to "Success". The secret is stored separately and is not in this body.

Request body

ParameterTypeRequiredDescription
credentialNamestring✓Display name, 3–256 characters.
credentialTypestring✓"proxy" for an inbound credential.
credentialAuthTypestring✓"key", "bearer", "basic", "jwt", "jwtVerify", or "idpVerify".
credentialRegionstring✓Region that stores the credential, such as us-east-2.
credentialSecretobject✓Secret for credentialAuthType. The shape depends on that type. See Inbound credentials.
credentialDefaultRuleEffectstring—"allow" or "deny". Applied when no rule matches.
credentialNotesstring—Free-text note.
temporaryboolean—When true, the credential expires. OAuth2 redirect flows set this. Defaults to false.
ttlMinutesnumber—Lifetime in minutes while temporary is true. Redirect flows default to 20. Other temporary credentials default to 60.
keepTemporaryboolean—When true, an OAuth2 callback leaves the credential temporary. Defaults to false.
isPendingboolean—When true, another party must fill pendingFields before the credential can be used. Defaults to false.
pendingFieldsstring[]—Secret field names that party must supply. Used with isPending.

Returns a credentials array. The attributes match List credentials. sKey on the create response is the new credential id.

List credentials

GET /api/clients/:clientId/credentials returns credentials for the organisation. The same path returns target credentials. A read of one credential is GET /api/clients/:clientId/credentials/:credentialId.

Query parameters

ParameterTypeDescription
includeTemporarystringWhen present, temporary credentials are included. When omitted, they are left out. A read of a temporary credential returns 404 unless this is set.

Response attributes

AttributeTypeDescription
credentialsarrayOne or more credential objects.
credentials[].sKeystringCredential id. Pass this as credentialId.
credentials[].pKey / parentIdstringOrganisation id.
credentials[].credentialNamestringDisplay name.
credentials[].credentialTypestring"proxy" (inbound) or "target".
credentials[].credentialAuthTypestringAuthentication type, such as key, bearer, jwt, etc.
credentials[].credentialRegionstringDeployment region.
credentials[].credentialSecretobjectDecrypted secret. Shape depends on credentialAuthType. Only on GET.
credentials[].credentialCreatedAtstringISO 8601 creation time.
credentials[].credentialUpdatedAtstringISO 8601 last update time.
credentials[].credentialDefaultRuleEffectstring or null"allow" or "deny".
credentials[].credentialNotesstring or nullFree-text note.
credentials[].temporarybooleantrue when the credential expires.
credentials[].TTLnumber or nullEpoch expiry while temporary. null on permanent credentials.
credentials[].shareUrlstringPresent while a pending share is waiting to be completed.
messagestring"Success".

Update a credential

PUT /api/clients/:clientId/credentials/:credentialId changes the name, notes, and default rule effect. The auth type and the secret stay as they were created. Set temporary to false to keep a temporary credential.

Request body

All fields are optional. Omit a field to leave it unchanged.

ParameterTypeRequiredDescription
credentialNamestring—Display name, 3–256 characters.
credentialNotesstring—Free-text note.
credentialDefaultRuleEffectstring—"allow" or "deny".
temporaryboolean—Set to false to stop a temporary credential from expiring.

Returns a credentials array with message set to "Credential updated successfully". The attributes match List credentials.

Auth types depend on the credential type. Inbound (proxy): key, bearer, basic, jwt, jwtVerify, idpVerify. Target: key, bearer, basic, jwt, oauth2, custom, customToken, jwtSigned, passthrough, none. The secret shape depends on the auth type. A GET response returns the decrypted secret to an authorised user.

Next

On this page