Inbound credentials API
Create the credential a caller presents.
Inbound and target credentials are the same collection. credentialType proxy is inbound. credentialType target is the credential RequestRocket sends upstream.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/clients/:clientId/credentials | List credentials |
| POST | /api/clients/:clientId/credentials | Create a credential |
| GET | /api/clients/:clientId/credentials/:credentialId | Read a credential |
| PUT | /api/clients/:clientId/credentials/:credentialId | Update a credential |
| DELETE | /api/clients/:clientId/credentials/:credentialId | Delete a credential |
Create an inbound credential
POST /api/clients/:clientId/credentials creates the credential. This body is an inbound API key.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/credentials" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"credentialName": "Caller key",
"credentialType": "proxy",
"credentialAuthType": "key",
"credentialRegion": "us-east-2",
"credentialSecret": {
"key": "Authorization",
"value": "replace-me",
"addToHeader": true
}
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/credentials",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"credentialName": "Caller key",
"credentialType": "proxy",
"credentialAuthType": "key",
"credentialRegion": "us-east-2",
"credentialSecret": {
"key": "Authorization",
"value": "replace-me",
"addToHeader": true
}
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/credentials",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"credentialName\": \"Caller key\",\n \"credentialType\": \"proxy\",\n \"credentialAuthType\": \"key\",\n \"credentialRegion\": \"us-east-2\",\n \"credentialSecret\": {\n \"key\": \"Authorization\",\n \"value\": \"replace-me\",\n \"addToHeader\": true\n }\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"credentialName": "Caller key",
"credentialType": "proxy",
"credentialAuthType": "key",
"credentialRegion": "us-east-2",
"credentialSecret": {
"key": "Authorization",
"value": "replace-me",
"addToHeader": true
}
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/credentials", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/credentials"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"credentialName\": \"Caller key\",\n \"credentialType\": \"proxy\",\n \"credentialAuthType\": \"key\",\n \"credentialRegion\": \"us-east-2\",\n \"credentialSecret\": {\n \"key\": \"Authorization\",\n \"value\": \"replace-me\",\n \"addToHeader\": true\n }\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"credentials": [
{
"credentialType": "proxy",
"credentialAuthType": "key",
"credentialName": "Caller key",
"userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
"parentId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"credentialRegion": "us-east-2",
"credentialCreatedAt": "2026-11-02T07:30:00.000Z",
"credentialUpdatedAt": "2026-11-02T07:30:00.000Z",
"temporary": false,
"credentialDefaultRuleEffect": null,
"credentialNotes": null,
"TTL": null
}
],
"message": "Success"
}{
"message": "credentialType is required"
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Returns a credentials array with message set to "Success". The secret is stored separately and is not in this body.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
credentialName | string | ✓ | Display name, 3–256 characters. |
credentialType | string | ✓ | "proxy" for an inbound credential. |
credentialAuthType | string | ✓ | "key", "bearer", "basic", "jwt", "jwtVerify", or "idpVerify". |
credentialRegion | string | ✓ | Region that stores the credential, such as us-east-2. |
credentialSecret | object | ✓ | Secret for credentialAuthType. The shape depends on that type. See Inbound credentials. |
credentialDefaultRuleEffect | string | — | "allow" or "deny". Applied when no rule matches. |
credentialNotes | string | — | Free-text note. |
temporary | boolean | — | When true, the credential expires. OAuth2 redirect flows set this. Defaults to false. |
ttlMinutes | number | — | Lifetime in minutes while temporary is true. Redirect flows default to 20. Other temporary credentials default to 60. |
keepTemporary | boolean | — | When true, an OAuth2 callback leaves the credential temporary. Defaults to false. |
isPending | boolean | — | When true, another party must fill pendingFields before the credential can be used. Defaults to false. |
pendingFields | string[] | — | Secret field names that party must supply. Used with isPending. |
Returns a credentials array. The attributes match List credentials. sKey on the create response is the new credential id.
List credentials
GET /api/clients/:clientId/credentials returns credentials for the organisation. The same path returns target credentials. A read of one credential is GET /api/clients/:clientId/credentials/:credentialId.
Query parameters
| Parameter | Type | Description |
|---|---|---|
includeTemporary | string | When present, temporary credentials are included. When omitted, they are left out. A read of a temporary credential returns 404 unless this is set. |
Response attributes
| Attribute | Type | Description |
|---|---|---|
credentials | array | One or more credential objects. |
credentials[].sKey | string | Credential id. Pass this as credentialId. |
credentials[].pKey / parentId | string | Organisation id. |
credentials[].credentialName | string | Display name. |
credentials[].credentialType | string | "proxy" (inbound) or "target". |
credentials[].credentialAuthType | string | Authentication type, such as key, bearer, jwt, etc. |
credentials[].credentialRegion | string | Deployment region. |
credentials[].credentialSecret | object | Decrypted secret. Shape depends on credentialAuthType. Only on GET. |
credentials[].credentialCreatedAt | string | ISO 8601 creation time. |
credentials[].credentialUpdatedAt | string | ISO 8601 last update time. |
credentials[].credentialDefaultRuleEffect | string or null | "allow" or "deny". |
credentials[].credentialNotes | string or null | Free-text note. |
credentials[].temporary | boolean | true when the credential expires. |
credentials[].TTL | number or null | Epoch expiry while temporary. null on permanent credentials. |
credentials[].shareUrl | string | Present while a pending share is waiting to be completed. |
message | string | "Success". |
Update a credential
PUT /api/clients/:clientId/credentials/:credentialId changes the name, notes, and default rule effect. The auth type and the secret stay as they were created. Set temporary to false to keep a temporary credential.
Request body
All fields are optional. Omit a field to leave it unchanged.
| Parameter | Type | Required | Description |
|---|---|---|---|
credentialName | string | — | Display name, 3–256 characters. |
credentialNotes | string | — | Free-text note. |
credentialDefaultRuleEffect | string | — | "allow" or "deny". |
temporary | boolean | — | Set to false to stop a temporary credential from expiring. |
Returns a credentials array with message set to "Credential updated successfully". The attributes match List credentials.
Auth types depend on the credential type. Inbound (proxy): key, bearer, basic, jwt, jwtVerify, idpVerify. Target: key, bearer, basic, jwt, oauth2, custom, customToken, jwtSigned, passthrough, none. The secret shape depends on the auth type. A GET response returns the decrypted secret to an authorised user.