# Manage & Operate › Key and Secret Manager › Credentials API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Manage & Operate product's sections: https://developers.eu.ovhcloud.com/reference/manage-operate/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 4 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/credentials/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager/credentials.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/manage-operate/key-and-secret-manager/credentials.json?format=openapi3

## Operations

- `GET /okms/resource/{okmsId}/credential` — List access credentials
- `POST /okms/resource/{okmsId}/credential` — Create an access credential
- `GET /okms/resource/{okmsId}/credential/{credentialId}` — Get an access credential
- `DELETE /okms/resource/{okmsId}/credential/{credentialId}` — Delete an access credential

## List access credentials

`GET /v2/okms/resource/{okmsId}/credential`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/credentials/#get-okms-resource-okmsid-credential

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:credential/get`

Returns the access credentials of the service, with their identity, status and expiry. Private keys are never returned.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.credential.GetResponse[] | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificatePEM` | string | read-only | Certificate PEM of the credential |
| `certificateType` | okms.CertificateTypeEnum | read-only | Type of the certificate (ECDSA or RSA) — one of `ECDSA`, `RSA` |
| `createdAt` | string (date-time) | read-only | Creation time of the credential |
| `description` | string | read-only | Description of the credential |
| `expiredAt` | string (date-time) | read-only | Expiration time of the credential |
| `fromCSR` | boolean | read-only | Is the credential generated from CSR |
| `id` | string (uuid) | read-only | Unique identifier of the credential |
| `identityURNs` | string[] | read-only | List of identity URNs associated with the credential |
| `name` | string | read-only | Name of the credential |
| `status` | okms.CredentialStatusEnum | read-only | Status of the credential — one of `CREATING`, `DELETING`, `ERROR`, `EXPIRED`, `READY` |

```json
[
  {
    "certificatePEM": "string",
    "certificateType": "ECDSA",
    "createdAt": "2024-01-01T12:00:00Z",
    "description": "string",
    "expiredAt": "2024-01-01T12:00:00Z",
    "fromCSR": true,
    "id": "00000000-0000-0000-0000-000000000000",
    "identityURNs": [
      "string"
    ],
    "name": "string",
    "status": "CREATING"
  }
]
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/resource/{okmsId}/credential")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/resource/{okmsId}/credential");

print_r($result);
?>
```

## Create an access credential

`POST /v2/okms/resource/{okmsId}/credential`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/credentials/#post-okms-resource-okmsid-credential

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:credential/create`

Issues a certificate-based access credential bound to the given identity URNs.

With a CSR, only the signed certificate is produced. Without one, a key pair is generated and the private key is returned in this response only. It can never be retrieved afterward.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Request body (required)

Type: `okms.credential.Creation`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificateType` | okms.CertificateTypeEnum |  | Type of the certificate (ECDSA or RSA, incompatible with CSR) — one of `ECDSA`, `RSA` |
| `csr` | string |  | Valid Certificate Signing Request |
| `description` | string |  | Description of the credential. At most 200. |
| `identityURNs` | string[] | yes | List of identity URNs associated with the credential. At most 25. |
| `name` | string | yes | Name of the credential. At most 50. |
| `validity` | integer |  | Validity in days (default 365, max 365) |

```json
{
  "certificateType": "ECDSA",
  "csr": "string",
  "description": "string",
  "identityURNs": [
    "string"
  ],
  "name": "string",
  "validity": 0
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.credential.CreationResponse | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificateType` | okms.CertificateTypeEnum | read-only | Type of the certificate (ECDSA or RSA) — one of `ECDSA`, `RSA` |
| `createdAt` | string (date-time) | read-only | Creation time of the credential |
| `description` | string | read-only | Description of the credential |
| `expiredAt` | string (date-time) | read-only | Expiration time of the credential |
| `fromCSR` | boolean | read-only | Is the credential generated from CSR |
| `id` | string (uuid) | read-only | Unique identifier of the credential |
| `identityURNs` | string[] | read-only | List of identity URNs associated with the credential |
| `name` | string | read-only | Name of the credential |
| `privateKeyPEM` | string (password) | read-only | Private Key PEM of the credential if no CSR is provided (cannot be retrieve later) |
| `status` | okms.CredentialStatusEnum | read-only | Status of the credential — one of `CREATING`, `DELETING`, `ERROR`, `EXPIRED`, `READY` |

```json
{
  "certificateType": "ECDSA",
  "createdAt": "2024-01-01T12:00:00Z",
  "description": "string",
  "expiredAt": "2024-01-01T12:00:00Z",
  "fromCSR": true,
  "id": "00000000-0000-0000-0000-000000000000",
  "identityURNs": [
    "string"
  ],
  "name": "string",
  "privateKeyPEM": "string",
  "status": "CREATING"
}
```

### Example

```bash
curl -X POST \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: okms.credential.Creation
result = client.post("/v2/okms/resource/{okmsId}/credential",
	certificateType = None, # Type of the certificate (ECDSA or RSA, incompatible with CSR) (type: okms.CertificateTypeEnum, nullable)
	csr = None, # Valid Certificate Signing Request (type: string, nullable)
	description = None, # Description of the credential. At most 200. (type: string, nullable)
	identityURNs = None, # List of identity URNs associated with the credential. At most 25. (type: array)
	name = None, # Name of the credential. At most 50. (type: string)
	validity = None, # Validity in days (default 365, max 365) (type: integer, nullable)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: okms.credential.Creation
$result = $ovh->post("/v2/okms/resource/{okmsId}/credential", array(
	certificateType => null, // Type of the certificate (ECDSA or RSA, incompatible with CSR) (type: okms.CertificateTypeEnum, nullable)
	csr => null, // Valid Certificate Signing Request (type: string, nullable)
	description => null, // Description of the credential. At most 200. (type: string, nullable)
	identityURNs => null, // List of identity URNs associated with the credential. At most 25. (type: array)
	name => null, // Name of the credential. At most 50. (type: string)
	validity => null, // Validity in days (default 365, max 365) (type: integer, nullable)
));

print_r($result);
?>
```

## Get an access credential

`GET /v2/okms/resource/{okmsId}/credential/{credentialId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/credentials/#get-okms-resource-okmsid-credential-credentialid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:credential/get`

Returns the metadata and certificate of an access credential. The private key is returned only when the credential is created and can never be retrieved afterward.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `credentialId` | path | string (uuid) | yes | Credential ID |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.credential.GetResponse | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificatePEM` | string | read-only | Certificate PEM of the credential |
| `certificateType` | okms.CertificateTypeEnum | read-only | Type of the certificate (ECDSA or RSA) — one of `ECDSA`, `RSA` |
| `createdAt` | string (date-time) | read-only | Creation time of the credential |
| `description` | string | read-only | Description of the credential |
| `expiredAt` | string (date-time) | read-only | Expiration time of the credential |
| `fromCSR` | boolean | read-only | Is the credential generated from CSR |
| `id` | string (uuid) | read-only | Unique identifier of the credential |
| `identityURNs` | string[] | read-only | List of identity URNs associated with the credential |
| `name` | string | read-only | Name of the credential |
| `status` | okms.CredentialStatusEnum | read-only | Status of the credential — one of `CREATING`, `DELETING`, `ERROR`, `EXPIRED`, `READY` |

```json
{
  "certificatePEM": "string",
  "certificateType": "ECDSA",
  "createdAt": "2024-01-01T12:00:00Z",
  "description": "string",
  "expiredAt": "2024-01-01T12:00:00Z",
  "fromCSR": true,
  "id": "00000000-0000-0000-0000-000000000000",
  "identityURNs": [
    "string"
  ],
  "name": "string",
  "status": "CREATING"
}
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential/{credentialId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/okms/resource/{okmsId}/credential/{credentialId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/okms/resource/{okmsId}/credential/{credentialId}");

print_r($result);
?>
```

## Delete an access credential

`DELETE /v2/okms/resource/{okmsId}/credential/{credentialId}`

Link: https://developers.eu.ovhcloud.com/reference/manage-operate/key-and-secret-manager/credentials/#delete-okms-resource-okmsid-credential-credentialid

**Status:** Stable production version  
**IAM actions:** `okms:apiovh:credential/delete`

Revokes the credential and removes it. It can no longer be used to authenticate to the KMS.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `credentialId` | path | string (uuid) | yes | Credential ID |
| `okmsId` | path | string (uuid) | yes | Okms ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | okms.credential.GetResponse | successful operation |
| 400 | object | Error 400 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `certificatePEM` | string | read-only | Certificate PEM of the credential |
| `certificateType` | okms.CertificateTypeEnum | read-only | Type of the certificate (ECDSA or RSA) — one of `ECDSA`, `RSA` |
| `createdAt` | string (date-time) | read-only | Creation time of the credential |
| `description` | string | read-only | Description of the credential |
| `expiredAt` | string (date-time) | read-only | Expiration time of the credential |
| `fromCSR` | boolean | read-only | Is the credential generated from CSR |
| `id` | string (uuid) | read-only | Unique identifier of the credential |
| `identityURNs` | string[] | read-only | List of identity URNs associated with the credential |
| `name` | string | read-only | Name of the credential |
| `status` | okms.CredentialStatusEnum | read-only | Status of the credential — one of `CREATING`, `DELETING`, `ERROR`, `EXPIRED`, `READY` |

```json
{
  "certificatePEM": "string",
  "certificateType": "ECDSA",
  "createdAt": "2024-01-01T12:00:00Z",
  "description": "string",
  "expiredAt": "2024-01-01T12:00:00Z",
  "fromCSR": true,
  "id": "00000000-0000-0000-0000-000000000000",
  "identityURNs": [
    "string"
  ],
  "name": "string",
  "status": "CREATING"
}
```

### Example

```bash
curl -X DELETE \
  "https://api.eu.ovhcloud.com/v2/okms/resource/{okmsId}/credential/{credentialId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.delete("/v2/okms/resource/{okmsId}/credential/{credentialId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->delete("/v2/okms/resource/{okmsId}/credential/{credentialId}");

print_r($result);
?>
```