# List Credentials

- **Method:** `GET`
- **Path:** `/api/v1/credentials`
- **Operation ID:** `list_credentials`
- **Tags:** credentials

This tenant's live credentials, oldest first. Metadata only; the values never come back out.

## Effective servers

- `https://api.saram.sh`

  Saram

## Authentication

- **HTTPBearer**: HTTP bearer

  a Saram API key (`sk_saram_<env>_...`) or a person's AuthKit access token, as `Authorization: Bearer <credential>`. Both are told apart by shape and produce the same principal.

## Responses

### 200 Successful Response

**Content type:** `application/json`

schema: `CredentialList`, no additional properties

The tenant's own credentials, as metadata: never a value, which the API stores and cannot read back.

- **`credentials` (required)**: `array`

  This tenant's live credentials, oldest first. A deleted one is not listed.

  **Items:**

  schema: `CredentialRecord`, no additional properties

  One of this tenant's credentials, a provider key or a test account, as all three routes answer it.
  Metadata only.
  - **`created_at` (required)**: `string`, format: `date-time`
  - **`id` (required)**: `string`
  - **`kind` (required)**: `string`
  - **`name` (required)**: `string`
  - **`secret_ref` (required)**: `string`

    The awssm:// ref to paste into a run spec as providers.entries\[].credential\_ref, for an account into target.seed.accounts, as connectors.webhook.secret\_ref for a webhook key, or as connectors.github.token\_ref for a github token. Only this tenant's specs may name it.
  - **`deleted_at`**: `string | null`, format: `date-time`

    Set on the record `DELETE` answers with, absent on a live one: the secret is gone and the name is free.

**Example:**

```json
{
  "credentials": [
    {
      "id": "",
      "name": "",
      "kind": "",
      "secret_ref": "",
      "created_at": "",
      "deleted_at": ""
    }
  ]
}
```

### 403 the API key lacks the required scope

## Schemas

- `CredentialList` — shown above.
- `CredentialRecord` — shown above.