List credentials
Everything about each credential except its values, in name order.
GET
/v1/credentialsRequest
| Method and path | GET/v1/credentials |
|---|---|
| Base URL | https://api.boxline.dev |
| Authentication | Your API key in the x-api-key header (or Authorization: Bearer). The examples read it from BOXLINE_API_KEY. |
Query parameters
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
limit | integer | 100 | – | From 1 to 200. |
after | string | – | – | The next value of the previous page (same filters and sort). Opaque; do not build it yourself. |
curl "https://api.boxline.dev/v1/credentials" \ -H "x-api-key: $BOXLINE_API_KEY"import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URLfor await (const c of bx.credentials.list()) console.log(c.name, c.type, c.scope, c.lastUsedAt); // never a valuefrom boxline import Boxlinebx = Boxline() # reads BOXLINE_API_KEY and BOXLINE_API_URLfor c in bx.credentials.list(): print(c["name"], c["type"], c["scope"], c["lastUsedAt"]) # never a valueboxline credentials list # never the valuesboxline credentials list --allResponses
200 OK
A page of credentials.
Fields
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
data | object[] | – | – | |
data[].name | string | – | – | |
data[].type | string | – | password, secret | |
data[].description | string | null | – | – | |
data[].origins | string[] | null | – | – | Sites where the AI may type it (null = any site; always set for a password). |
data[].username | string | – | – | A password's user name. |
data[].hasTotp | boolean | – | – | A password has a 2FA key (codeSource totp). |
data[].codeSource | string | null | – | totp, push, url, null | Where a password's 2FA codes come from (%NAME.otp%, boxline-otp NAME); null: no 2FA. |
data[].codeUrl | string | null | – | – | The endpoint the platform asks for codes (codeSource url). |
data[].codeTimeoutSeconds | integer | – | – | How long a wait for a pushed or asked code lasts. From 5 to 900. |
data[].preview | string | null | – | – | A secret's last 4 characters, for values of 24 characters or more; null for shorter values and for secrets with origins. |
data[].shell | boolean | – | – | The AI may use it in bash commands; this also allows exporting it into shells. |
data[].scope | string | agent | agent, shell, all | agent: only the AI, as placeholders (agent runs, steps, scripts' step(), the type action); shell: only as environment variables in session shells and commands; all: both. |
data[].createdAt | string | – | – | Format: date-time. |
data[].updatedAt | string | – | – | Format: date-time. |
data[].lastUsedAt | string | null | – | – | Format: date-time. |
next | string | null | – | – | Pass it back as after for the next page; null on the last page. |
{ "data": [ { "name": "SHOP", "type": "password", "description": "…", "origins": [ "…" ], "username": "…", "hasTotp": false, "codeSource": "totp", "codeUrl": "…", "codeTimeoutSeconds": 5, "preview": "••••1a2b", "shell": false, "scope": "agent", "createdAt": "2026-09-29T10:00:00.000Z", "updatedAt": "2026-09-29T10:00:00.000Z", "lastUsedAt": "2026-09-29T10:00:00.000Z" } ], "next": "eyJvIjoiY3JlYXRlZF9kZXNjIiwidCI6IjIwMjYtMDktMjlUMTA6MDA6MDAuMTIzNDU2WiIsImkiOiI2YzFmIn0"}Errors
Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.
| Status | Codes | When |
|---|---|---|
| 400 Bad Request | invalid_request, invalid_json, invalid_cursor, invalid_idempotency_key, invalid_extension, variables_with_extensions, terms_not_accepted, invalid_reset_token, invalid_confirmation_code, wrong_password, no_password, invalid_next, invalid_oauth_token | The request is not valid. |
| 401 Unauthorized | unauthorized | Missing or invalid API key. |
{ "error": { "code": "not_found", "message": "session not found", "requestId": "req_4fJx0aQm2Lk9Pz7N" }}Learn more
These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.