Credential

Get, create, refresh, update, replace, or delete a credential.

Resource

1/named-credentials/credential

Available version

56.0

HTTP methods

GET, POST, PUT, PATCH, DELETE

PATCH is supported in version 59.0 and later only for custom protocols.

Request parameters for GET

Parameter Name	Type	Description	Required or Optional	Available Version
`externalCredential`	String	Fully qualified developer name of the external credential.	Required	56.0
`principalName`	String	Name of the external credential named principal.	Required if `principalType` is `NamedPrincipal`	56.0
`principalType`	String	Type of credential principal. Values are: `AwsStsPrincipal` `NamedPrincipal` `PerUserPrincipal`	Required	56.0

Response body for GET

Credential

Request parameters for POST

Use this request parameter to refresh an OAuth or AWS Roles Anywhere credential.

Parameter Name	Type	Description	Required or Optional	Available Version
`action`	String	Action to take when creating the credential. Value is: `Refresh`	Optional	58.0

Request body for POST, PUT, and PATCH

Use this request body to create (POST), replace (PUT), and update (PATCH) a credential.

Root XML tag

<credential>

JSON example for creating a credential (POST)

1{
2externalCredential: "ecNameAws",
3authenticationProtocol: "AwsSv4",
4principalName: "principalA",
5principalType: "NamedPrincipal",
6credentials: {
7   awsAccessKeyId: {
8      value: "00000000000",
9      encrypted: false
10   },
11   awsSecretAccessKey: {
12      value: "aws-secret-value",
13      encrypted: true
14   },
15   awsRoleArn: {
16      value: "arn:partition:service:region:account-id:resource-id",
17      encrypted: false
18   }
19}
20}

JSON example for replacing a credential (PUT)

In this example. assume the credential has two values: apiKey and apiSecret. When this request body is used with PUT, apiKey is updated and apiSecret is deleted.

1{
2   authenticationProtocol: String : "Custom",
3   externalCredential: String : "medicalIntegrationExternalCredential",
4   principalName: String : "customerSupportGroup", 
5   principalType: String : "NamedPrincipal",
6   // Map<String, ConnectApi.CredentialValue>
7   credentials: { 
8       apiKey: { 
9           value: String : "00000000",
10           encrypted: Boolean : false
11       }
12   }
13}

JSON example for updating a custom credential (PATCH)

PATCH is supported only for custom credentials. Only the credentials included in the request body are updated. In this example. assume the credential has two values: apiKey and apiSecret. When this request body is used with PATCH, apiKey is updated and apiSecret remains the same.

1{
2   authenticationProtocol: String : "Custom",
3   externalCredential: String : "medicalIntegrationExternalCredential",
4   principalName: String : "customerSupportGroup", 
5   principalType: String : "NamedPrincipal",
6   // Map<String, ConnectApi.CredentialValue>
7   credentials: { 
8       apiKey: { 
9           value: String : "00000000",
10           encrypted: Boolean : false
11       }
12   }
13}

Properties

Name	Type	Description	Required or Optional	Available Version
`authenticationProtocol`	String	Authentication protocol of the external credential. Values are: `AwsSv4` `Basic` `Custom` `Jwt` `OAuth`	Required	56.0
`authenticationProtocolVariant`	String	Authentication protocol variant of the external credential. Values are: `AwsSv4_STS`—AWS Signature Version 4 with Security Token Service. `ClientCredentialsClientSecret`—OAuth 2.0 Client Credentials client secret. Client secrets are sent in the callout’s request body. `ClientCredentialsClientSecretBasic`—OAuth 2.0 Client Credentials client secret. Client secrets are sent in the callout’s authorization header, as with Basic authentication. `ClientCredentialsJwtAssertion`—OAuth 2.0 Client Credentials JSON Web Token assertion. `JwtBearer`—OAuth 2.0 JSON Web Token bearer flow. `NoAuthentication`—No authentication. `RolesAnywhere`—AWS Signature Version 4 with Identity and Access Management (IAM) Roles Anywhere. If specified, the authentication protocol variant must match the actual protocol variant of the external credential.	Optional	57.0
`credentials`	Map<String, Credential Value Input>	Map of protocol-specific credentials. Authentication protocols have credential allowlists and encryption rules. `AwsSv4`—`awsAccessKeyId` (not encrypted), `awsSecretAccessKey` (encrypted), `awsRoleArn` (not encrypted) `Custom`—Any credential name is valid (user sets encryption rules)	Required	56.0
`externalCredential`	String	Fully qualified developer name of the external credential.	Required	56.0
`principalName`	String	Name of the external credential named principal.	Required if `principalType` is `NamedPrincipal`	56.0
`principalType`	String	Type of credential principal. Values are: `AwsStsPrincipal` `NamedPrincipal` `PerUserPrincipal`	Required	56.0

Response body for POST, PATCH, and PUT

Credential

Request parameters for DELETE

Parameter Name	Type	Description	Required or Optional	Available Version
`authenticationParameters`	String[]	List of authentication parameters only for custom protocols, for example `myApiKey,myApiSecret`. If unspecified, all credentials are deleted.	Optional	59.0
`externalCredential`	String	Fully qualified developer name of the external credential.	Required	56.0
`principalName`	String	Name of the external credential named principal.	Required if `principalType` is `NamedPrincipal`	56.0
`principalType`	String	Type of credential principal. Values are: `AwsStsPrincipal` `NamedPrincipal` `PerUserPrincipal`	Required	56.0

Response for DELETE

204: Successful Delete

Connect REST API Developer Guide

Credential