> For the complete documentation index, see [llms.txt](https://docs.idlayr.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.idlayr.com/api-reference/management/credentials.md).
# Credentials
Manage the OAuth2 client credentials of a project.
## List credentials
> Returns a page of the project's credentials. \`client\_secret\` is never included.
```json
{"openapi":"3.1.0","info":{"title":"IDlayr Management API","version":"1.0.0"},"tags":[{"name":"credentials_v1","description":"Manage the OAuth2 client credentials of a project."}],"servers":[{"url":"https://{data_residency}.api.idlayr.com","description":"For accounts with data residency in the EU or US.","variables":{"data_residency":{"default":"eu","enum":["eu","us"]}}}],"security":[{"WorkspaceBearerAuth":[]}],"components":{"securitySchemes":{"WorkspaceBearerAuth":{"description":"Management endpoints expect an [OAuth2 Access Token](https://tools.ietf.org/html/rfc6749#section-1.4)\nin the `Authorization` HTTP header, e.g. `Authorization: Bearer {access_token}`.\n\nThe token must be obtained with **workspace credentials** and carry the `management`\nscope. This is distinct from the project `client_id` / `client_secret` credentials used\nto call the product APIs.\n","type":"http","scheme":"bearer"}},"parameters":{"pageSize":{"name":"size","description":"The number of items returned per page.","in":"query","schema":{"type":"integer","default":10,"minimum":1,"maximum":100}},"pageNumber":{"name":"page","description":"The page number being requested.","in":"query","schema":{"type":"integer","default":1,"minimum":1}},"CredentialSearch":{"name":"search","in":"query","required":false,"description":"An [RSQL](https://github.com/jirutka/rsql-parser) filter over the credentials collection.\nFilterable fields: `client_id`, `scopes`, `member_id`, `created_at`, `updated_at`.\nExample: `created_at=ge=2026-01-01T00:00:00Z`.\n","schema":{"type":"string"}}},"schemas":{"CredentialList":{"description":"A page of credentials.","type":"object","unevaluatedProperties":false,"required":["content","page"],"properties":{"content":{"description":"Credentials in the current page.","type":"array","items":{"$ref":"#/components/schemas/Credential"}},"page":{"$ref":"#/components/schemas/page"}}},"Credential":{"description":"An OAuth2 client credential scoped to a project. `client_secret` is never returned by read operations.","type":"object","unevaluatedProperties":false,"required":["client_id","scopes","created_at","updated_at"],"properties":{"client_id":{"$ref":"#/components/schemas/UUID"},"scopes":{"description":"The OAuth2 scopes granted to the credential.","type":"array","items":{"type":"string"}},"created_at":{"$ref":"#/components/schemas/ISODateTime"},"updated_at":{"$ref":"#/components/schemas/ISODateTime"}}},"UUID":{"description":"A Universally Unique IDentifier.","type":"string","format":"uuid","pattern":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"},"ISODateTime":{"description":"A DateTime conforming to ISO 8601 specifications.","type":"string","format":"date-time"},"page":{"description":"Pagination metadata.","type":"object","unevaluatedProperties":false,"required":["size","number","total_pages","total_elements"],"properties":{"size":{"description":"The number of records per page.","type":"integer"},"number":{"description":"The current page number.","type":"integer"},"total_pages":{"description":"The total number of pages available.","type":"integer"},"total_elements":{"description":"The total number of records across all pages.","type":"integer"}}},"Problem":{"description":"An [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807) problem detail.","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded. The `Retry-After` header carries\nthe number of seconds after which the caller can retry.\n","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}}},"responses":{"Unauthorized":{"description":"The Access Token is missing, invalid, or lacks the `management` scope.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Forbidden":{"description":"The caller is authenticated but not permitted to perform this operation.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"ProjectNotFound":{"description":"The project identified by `project_id` does not exist within the workspace.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/RateLimitReached"}}}}}},"paths":{"/v1/workspaces/{workspace_id}/projects/{project_id}/credentials":{"get":{"summary":"List credentials","description":"Returns a page of the project's credentials. `client_secret` is never included.","operationId":"list-credentials-v1","tags":["credentials_v1"],"parameters":[{"$ref":"#/components/parameters/pageSize"},{"$ref":"#/components/parameters/pageNumber"},{"$ref":"#/components/parameters/CredentialSearch"}],"responses":{"200":{"description":"A page of credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialList"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/ProjectNotFound"},"429":{"$ref":"#/components/responses/RateLimitReached"}}}}}}
```
## Create credentials
> Creates a new OAuth2 client credential for the project. The \`client\_secret\` is returned\
> \*\*only\*\* in this response and cannot be retrieved again.
```json
{"openapi":"3.1.0","info":{"title":"IDlayr Management API","version":"1.0.0"},"tags":[{"name":"credentials_v1","description":"Manage the OAuth2 client credentials of a project."}],"servers":[{"url":"https://{data_residency}.api.idlayr.com","description":"For accounts with data residency in the EU or US.","variables":{"data_residency":{"default":"eu","enum":["eu","us"]}}}],"security":[{"WorkspaceBearerAuth":[]}],"components":{"securitySchemes":{"WorkspaceBearerAuth":{"description":"Management endpoints expect an [OAuth2 Access Token](https://tools.ietf.org/html/rfc6749#section-1.4)\nin the `Authorization` HTTP header, e.g. `Authorization: Bearer {access_token}`.\n\nThe token must be obtained with **workspace credentials** and carry the `management`\nscope. This is distinct from the project `client_id` / `client_secret` credentials used\nto call the product APIs.\n","type":"http","scheme":"bearer"}},"schemas":{"CredentialCreate":{"description":"The payload to create a credential.","type":"object","unevaluatedProperties":false,"required":["grant_type"],"properties":{"grant_type":{"description":"The OAuth2 grant type for the credential.","type":"string"}}},"CredentialWithSecret":{"description":"A newly created credential, including the one-time `client_secret`.","type":"object","unevaluatedProperties":false,"required":["client_id","client_secret","scopes","created_at","updated_at"],"properties":{"client_id":{"$ref":"#/components/schemas/UUID"},"client_secret":{"description":"The OAuth2 client secret. Returned only on creation and never again.","type":"string"},"scopes":{"description":"The OAuth2 scopes granted to the credential.","type":"array","items":{"type":"string"}},"created_at":{"$ref":"#/components/schemas/ISODateTime"},"updated_at":{"$ref":"#/components/schemas/ISODateTime"}}},"UUID":{"description":"A Universally Unique IDentifier.","type":"string","format":"uuid","pattern":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"},"ISODateTime":{"description":"A DateTime conforming to ISO 8601 specifications.","type":"string","format":"date-time"},"Problem":{"description":"An [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807) problem detail.","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded. The `Retry-After` header carries\nthe number of seconds after which the caller can retry.\n","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}}},"responses":{"BadRequest":{"description":"The request body or patch document is invalid.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Unauthorized":{"description":"The Access Token is missing, invalid, or lacks the `management` scope.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Forbidden":{"description":"The caller is authenticated but not permitted to perform this operation.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"ProjectNotFound":{"description":"The project identified by `project_id` does not exist within the workspace.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"MaxCredentialsReached":{"description":"The project has reached the maximum number of credentials.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/RateLimitReached"}}}}}},"paths":{"/v1/workspaces/{workspace_id}/projects/{project_id}/credentials":{"post":{"summary":"Create credentials","description":"Creates a new OAuth2 client credential for the project. The `client_secret` is returned\n**only** in this response and cannot be retrieved again.\n","operationId":"create-credential-v1","tags":["credentials_v1"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialCreate"}}}},"responses":{"201":{"description":"The created credential, including the one-time `client_secret`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CredentialWithSecret"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/ProjectNotFound"},"409":{"$ref":"#/components/responses/MaxCredentialsReached"},"429":{"$ref":"#/components/responses/RateLimitReached"}}}}}}
```
## Get credentials
> Returns the credential details identified by \`client\_id\`. \`client\_secret\` is never included.
```json
{"openapi":"3.1.0","info":{"title":"IDlayr Management API","version":"1.0.0"},"tags":[{"name":"credentials_v1","description":"Manage the OAuth2 client credentials of a project."}],"servers":[{"url":"https://{data_residency}.api.idlayr.com","description":"For accounts with data residency in the EU or US.","variables":{"data_residency":{"default":"eu","enum":["eu","us"]}}}],"security":[{"WorkspaceBearerAuth":[]}],"components":{"securitySchemes":{"WorkspaceBearerAuth":{"description":"Management endpoints expect an [OAuth2 Access Token](https://tools.ietf.org/html/rfc6749#section-1.4)\nin the `Authorization` HTTP header, e.g. `Authorization: Bearer {access_token}`.\n\nThe token must be obtained with **workspace credentials** and carry the `management`\nscope. This is distinct from the project `client_id` / `client_secret` credentials used\nto call the product APIs.\n","type":"http","scheme":"bearer"}},"schemas":{"Credential":{"description":"An OAuth2 client credential scoped to a project. `client_secret` is never returned by read operations.","type":"object","unevaluatedProperties":false,"required":["client_id","scopes","created_at","updated_at"],"properties":{"client_id":{"$ref":"#/components/schemas/UUID"},"scopes":{"description":"The OAuth2 scopes granted to the credential.","type":"array","items":{"type":"string"}},"created_at":{"$ref":"#/components/schemas/ISODateTime"},"updated_at":{"$ref":"#/components/schemas/ISODateTime"}}},"UUID":{"description":"A Universally Unique IDentifier.","type":"string","format":"uuid","pattern":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"},"ISODateTime":{"description":"A DateTime conforming to ISO 8601 specifications.","type":"string","format":"date-time"},"Problem":{"description":"An [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807) problem detail.","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded. The `Retry-After` header carries\nthe number of seconds after which the caller can retry.\n","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}}},"responses":{"Unauthorized":{"description":"The Access Token is missing, invalid, or lacks the `management` scope.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Forbidden":{"description":"The caller is authenticated but not permitted to perform this operation.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"CredentialNotFound":{"description":"The credential identified by `client_id` does not exist within the project.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/RateLimitReached"}}}}}},"paths":{"/v1/workspaces/{workspace_id}/projects/{project_id}/credentials/{client_id}":{"get":{"summary":"Get credentials","description":"Returns the credential details identified by `client_id`. `client_secret` is never included.","operationId":"get-credential-v1","tags":["credentials_v1"],"responses":{"200":{"description":"The credential.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Credential"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/CredentialNotFound"},"429":{"$ref":"#/components/responses/RateLimitReached"}}}}}}
```
## Delete credentials
> Permanently revokes the credential identified by \`client\_id\`. Access Tokens already\
> issued for it can no longer be introspected.
```json
{"openapi":"3.1.0","info":{"title":"IDlayr Management API","version":"1.0.0"},"tags":[{"name":"credentials_v1","description":"Manage the OAuth2 client credentials of a project."}],"servers":[{"url":"https://{data_residency}.api.idlayr.com","description":"For accounts with data residency in the EU or US.","variables":{"data_residency":{"default":"eu","enum":["eu","us"]}}}],"security":[{"WorkspaceBearerAuth":[]}],"components":{"securitySchemes":{"WorkspaceBearerAuth":{"description":"Management endpoints expect an [OAuth2 Access Token](https://tools.ietf.org/html/rfc6749#section-1.4)\nin the `Authorization` HTTP header, e.g. `Authorization: Bearer {access_token}`.\n\nThe token must be obtained with **workspace credentials** and carry the `management`\nscope. This is distinct from the project `client_id` / `client_secret` credentials used\nto call the product APIs.\n","type":"http","scheme":"bearer"}},"responses":{"Unauthorized":{"description":"The Access Token is missing, invalid, or lacks the `management` scope.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Forbidden":{"description":"The caller is authenticated but not permitted to perform this operation.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"CredentialNotFound":{"description":"The credential identified by `client_id` does not exist within the project.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/RateLimitReached"}}}}},"schemas":{"Problem":{"description":"An [RFC 7807](https://datatracker.ietf.org/doc/html/rfc7807) problem detail.","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}},"RateLimitReached":{"description":"The API rate limit for the workspace has been exceeded. The `Retry-After` header carries\nthe number of seconds after which the caller can retry.\n","type":"object","unevaluatedProperties":false,"required":["type","title","status","detail","error_code"],"properties":{"type":{"description":"A URI reference [RFC 3986] that identifies the problem type.","type":"string"},"title":{"description":"A short, human-readable summary of the problem type.","type":"string"},"status":{"description":"The HTTP status code generated by the origin server for this occurrence of the problem.","type":"integer"},"detail":{"description":"A human-readable explanation specific to this occurrence of the problem.","type":"string"},"error_code":{"description":"Machine-readable error code identifying the problem type.","type":"string"}}}}},"paths":{"/v1/workspaces/{workspace_id}/projects/{project_id}/credentials/{client_id}":{"delete":{"summary":"Delete credentials","description":"Permanently revokes the credential identified by `client_id`. Access Tokens already\nissued for it can no longer be introspected.\n","operationId":"delete-credential-v1","tags":["credentials_v1"],"responses":{"204":{"description":"The credential was deleted."},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/CredentialNotFound"},"429":{"$ref":"#/components/responses/RateLimitReached"}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.idlayr.com/api-reference/management/credentials.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.