RequestRocketRequestRocketDocs
ConnectTarget credentials

Target credentials API

Create the credential RequestRocket sends upstream.

This is the credentials collection with credentialType target. List, read, update, and delete are the same paths as Inbound credentials.

Endpoints

MethodPathWhat it does
POST/api/clients/:clientId/credentialsCreate a target credential
GET/api/clients/:clientId/credentialsList credentials, including target credentials
PUT/api/clients/:clientId/credentials/:credentialIdUpdate a target credential
DELETE/api/clients/:clientId/credentials/:credentialIdDelete a target credential

Create a target credential

POST /api/clients/:clientId/credentials creates the target credential. none is the auth type for a target that does not check a secret.

Request

curl -X POST "https://api.requestrocket.com/api/clients/:clientId/credentials" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "credentialName": "HTTPBin none",
  "credentialType": "target",
  "credentialAuthType": "none",
  "credentialRegion": "us-east-2",
  "credentialSecret": {}
}'
import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/clients/:clientId/credentials",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "credentialName": "HTTPBin none",
  "credentialType": "target",
  "credentialAuthType": "none",
  "credentialRegion": "us-east-2",
  "credentialSecret": {}
}
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/clients/:clientId/credentials",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"credentialName\": \"HTTPBin none\",\n  \"credentialType\": \"target\",\n  \"credentialAuthType\": \"none\",\n  \"credentialRegion\": \"us-east-2\",\n  \"credentialSecret\": {}\n}"
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "credentialName": "HTTPBin none",
  "credentialType": "target",
  "credentialAuthType": "none",
  "credentialRegion": "us-east-2",
  "credentialSecret": {}
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/credentials", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/credentials"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"credentialName\": \"HTTPBin none\",\n  \"credentialType\": \"target\",\n  \"credentialAuthType\": \"none\",\n  \"credentialRegion\": \"us-east-2\",\n  \"credentialSecret\": {}\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "credentials": [
    {
      "credentialType": "target",
      "credentialAuthType": "none",
      "credentialName": "HTTPBin none",
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "parentId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "credentialRegion": "us-east-2",
      "credentialCreatedAt": "2026-11-02T07:30:00.000Z",
      "credentialUpdatedAt": "2026-11-02T07:30:00.000Z",
      "temporary": false,
      "credentialDefaultRuleEffect": null,
      "credentialNotes": null,
      "TTL": null
    }
  ],
  "message": "Success"
}
{
  "message": "credentialType is required"
}
{
  "message": "Unauthorized"
}
{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}
{
  "message": "method / endpoint not supported"
}

Returns a credentials array with message set to "Success". The secret is stored separately and is not in this body.

Request body

ParameterTypeRequiredDescription
credentialNamestring✓Display name, 3–256 characters.
credentialTypestring✓"target".
credentialAuthTypestring✓"key", "bearer", "basic", "jwt", "oauth2", "custom", "customToken", "jwtSigned", "passthrough", or "none".
credentialRegionstring✓Region that stores the credential, such as us-east-2.
credentialSecretobject✓Secret for credentialAuthType. The shape depends on that type. none sends an empty object. See Target credentials.
credentialDefaultRuleEffectstring—"allow" or "deny". Applied when no rule matches.
credentialNotesstring—Free-text note.
temporaryboolean—When true, the credential expires. OAuth2 redirect flows set this. Defaults to false.
ttlMinutesnumber—Lifetime in minutes while temporary is true. Redirect flows default to 20. Other temporary credentials default to 60.
keepTemporaryboolean—When true, an OAuth2 callback leaves the credential temporary. Defaults to false.
isPendingboolean—When true, another party must fill pendingFields before the credential can be used. Defaults to false.
pendingFieldsstring[]—Secret field names that party must supply. Used with isPending.

Returns a credentials array. The response attributes match Inbound credentials API — List credentials.

List credentials

GET /api/clients/:clientId/credentials returns every credential for the organisation, including target credentials. A read is GET /api/clients/:clientId/credentials/:credentialId. See Inbound credentials for the shared paths.

Query parameters

ParameterTypeDescription
includeTemporarystringWhen present, temporary credentials are included. When omitted, they are left out. A read of a temporary credential returns 404 unless this is set.

The response attributes match Inbound credentials API — List credentials. credentialSecret is the decrypted secret.

Update a target credential

PUT /api/clients/:clientId/credentials/:credentialId changes the name, notes, and default rule effect. The auth type and the secret stay as they were created. Set temporary to false to keep a temporary credential.

Request body

All fields are optional. Omit a field to leave it unchanged.

ParameterTypeRequiredDescription
credentialNamestring—Display name, 3–256 characters.
credentialNotesstring—Free-text note.
credentialDefaultRuleEffectstring—"allow" or "deny".
temporaryboolean—Set to false to stop a temporary credential from expiring.

Returns a credentials array with message set to "Credential updated successfully". The response attributes match Inbound credentials API — List credentials.

A temporary credential cannot be used as the inbound credential of an MCP server.

Next

On this page