Target credentials API
Create the credential RequestRocket sends upstream.
This is the credentials collection with credentialType target. List, read, update, and delete are the same paths as Inbound credentials.
Endpoints
| Method | Path | What it does |
|---|---|---|
| POST | /api/clients/:clientId/credentials | Create a target credential |
| GET | /api/clients/:clientId/credentials | List credentials, including target credentials |
| PUT | /api/clients/:clientId/credentials/:credentialId | Update a target credential |
| DELETE | /api/clients/:clientId/credentials/:credentialId | Delete a target credential |
Create a target credential
POST /api/clients/:clientId/credentials creates the target credential. none is the auth type for a target that does not check a secret.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/credentials" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"credentialName": "HTTPBin none",
"credentialType": "target",
"credentialAuthType": "none",
"credentialRegion": "us-east-2",
"credentialSecret": {}
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/credentials",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"credentialName": "HTTPBin none",
"credentialType": "target",
"credentialAuthType": "none",
"credentialRegion": "us-east-2",
"credentialSecret": {}
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/credentials",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"credentialName\": \"HTTPBin none\",\n \"credentialType\": \"target\",\n \"credentialAuthType\": \"none\",\n \"credentialRegion\": \"us-east-2\",\n \"credentialSecret\": {}\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"credentialName": "HTTPBin none",
"credentialType": "target",
"credentialAuthType": "none",
"credentialRegion": "us-east-2",
"credentialSecret": {}
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/credentials", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/credentials"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"credentialName\": \"HTTPBin none\",\n \"credentialType\": \"target\",\n \"credentialAuthType\": \"none\",\n \"credentialRegion\": \"us-east-2\",\n \"credentialSecret\": {}\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"credentials": [
{
"credentialType": "target",
"credentialAuthType": "none",
"credentialName": "HTTPBin none",
"userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
"parentId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"credentialRegion": "us-east-2",
"credentialCreatedAt": "2026-11-02T07:30:00.000Z",
"credentialUpdatedAt": "2026-11-02T07:30:00.000Z",
"temporary": false,
"credentialDefaultRuleEffect": null,
"credentialNotes": null,
"TTL": null
}
],
"message": "Success"
}{
"message": "credentialType is required"
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Returns a credentials array with message set to "Success". The secret is stored separately and is not in this body.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
credentialName | string | ✓ | Display name, 3–256 characters. |
credentialType | string | ✓ | "target". |
credentialAuthType | string | ✓ | "key", "bearer", "basic", "jwt", "oauth2", "custom", "customToken", "jwtSigned", "passthrough", or "none". |
credentialRegion | string | ✓ | Region that stores the credential, such as us-east-2. |
credentialSecret | object | ✓ | Secret for credentialAuthType. The shape depends on that type. none sends an empty object. See Target credentials. |
credentialDefaultRuleEffect | string | — | "allow" or "deny". Applied when no rule matches. |
credentialNotes | string | — | Free-text note. |
temporary | boolean | — | When true, the credential expires. OAuth2 redirect flows set this. Defaults to false. |
ttlMinutes | number | — | Lifetime in minutes while temporary is true. Redirect flows default to 20. Other temporary credentials default to 60. |
keepTemporary | boolean | — | When true, an OAuth2 callback leaves the credential temporary. Defaults to false. |
isPending | boolean | — | When true, another party must fill pendingFields before the credential can be used. Defaults to false. |
pendingFields | string[] | — | Secret field names that party must supply. Used with isPending. |
Returns a credentials array. The response attributes match Inbound credentials API — List credentials.
List credentials
GET /api/clients/:clientId/credentials returns every credential for the organisation, including target credentials. A read is GET /api/clients/:clientId/credentials/:credentialId. See Inbound credentials for the shared paths.
Query parameters
| Parameter | Type | Description |
|---|---|---|
includeTemporary | string | When present, temporary credentials are included. When omitted, they are left out. A read of a temporary credential returns 404 unless this is set. |
The response attributes match Inbound credentials API — List credentials. credentialSecret is the decrypted secret.
Update a target credential
PUT /api/clients/:clientId/credentials/:credentialId changes the name, notes, and default rule effect. The auth type and the secret stay as they were created. Set temporary to false to keep a temporary credential.
Request body
All fields are optional. Omit a field to leave it unchanged.
| Parameter | Type | Required | Description |
|---|---|---|---|
credentialName | string | — | Display name, 3–256 characters. |
credentialNotes | string | — | Free-text note. |
credentialDefaultRuleEffect | string | — | "allow" or "deny". |
temporary | boolean | — | Set to false to stop a temporary credential from expiring. |
Returns a credentials array with message set to "Credential updated successfully". The response attributes match Inbound credentials API — List credentials.
A temporary credential cannot be used as the inbound credential of an MCP server.