Read tool credential metadata
Authentication
Create and manage workspace-owned keys through the existing app session routes, outside this public API. Creator and manager identities are audit actors only. Key validity follows workspace policy, expiry and explicit revocation, independently of creator membership. Do not include a workspace-selection header.
Path parameters
Response headers
Response
Optional caller-chosen resource key: an opaque external identifier that matches your own record (for example a CRM ID, a configuration-file ID or a UUID) to this resource. Rasen still generates the canonical id; use id in paths and references. Case-sensitive, compared exactly, never normalized or parsed. 1-128 characters from A-Z a-z 0-9 . _ : ~ - and starting with a letter or digit; UUIDs and ULIDs are valid. Unique per resource type within one workspace; separate environment workspaces can reuse the same key. Set only at creation and immutable afterwards. A create with a key that already exists returns 409 resource_key_conflict with details.existing_id; it never updates or returns the existing resource. Not an Idempotency-Key: that header identifies one request intent for 24 hours, and a same-intent replay returns its original receipt before the resource-key check runs. Uniqueness includes archived resources. A key becomes free again only after its resource is permanently deleted or erased (a deleted secret or a deleted knowledge source); archive never frees it.
Workspace-unique handle among secrets that are not deleted. A label, not the resource key. Deletion frees the name and the resource_key.
Consumer type the credential may be released to. A webhook_tool secret cannot be used by an MCP server, and the reverse. Open response vocabulary. Preserve unknown values; never assume they mean success.
A descriptive label that does not change how the value is sent. Rasen sends the stored value unchanged as the header value for a webhook secret header, or as “Bearer <value>” for an MCP server with auth=bearer, or as the header value for auth=secret_header. For basic_auth, store the complete header value, for example “Basic <base64 of user:password>”, and use a secret header named Authorization. No kind and auth-mode pair is refused. Open response vocabulary. Preserve unknown values; never assume they mean success.
revoked means every version is revoked. Open response vocabulary. Preserve unknown values; never assume they mean success.
Highest version number. Not an implicit binding target: consumers pin exact versions.
Reference counts at response time. Use GET /secrets/{secret_id}/references for the exact consumers.