> ## Documentation Index
> Fetch the complete documentation index at: https://docs.2501.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a credential

> Scope is fixed here and only here: org_id: null creates a tenant-wide credential and needs tenant-level access. Changing scope later means delete and recreate.



## OpenAPI

````yaml /0.15/openapi.json post /api/v1/credentials
openapi: 3.0.3
info:
  title: 2501 Public API
  version: v1
  description: >-
    The stable, versioned HTTP API for driving 2501 as code. See the API
    Overview for authentication, the org_id rule, cursor pagination, and the
    error envelope.
servers:
  - url: https://{command_center_host}
    variables:
      command_center_host:
        default: your-command-center-host
        description: Your Command Center host
security:
  - bearerAuth: []
paths:
  /api/v1/credentials:
    post:
      tags:
        - Credentials
      summary: Create a credential
      description: >-
        Scope is fixed here and only here: org_id: null creates a tenant-wide
        credential and needs tenant-level access. Changing scope later means
        delete and recreate.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 70
                description:
                  type: string
                type:
                  type: string
                  enum:
                    - SECRET
                    - VAULT_PATH
                    - SSH_PRIVATE_KEY
                value:
                  type: string
                vault_path:
                  type: string
                org_id:
                  type: string
                  nullable: true
              required:
                - name
                - type
      responses:
        '200':
          description: The created credential
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Credential'
        '400':
          description: >-
            Bad request - a field is missing, malformed, or not allowed
            (VALIDATION_FAILED, BAD_REQUEST, INVALID_CURSOR)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: >-
            No credentials, or a key that is invalid, revoked, or expired
            (UNAUTHORIZED)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            Authenticated but not allowed (FORBIDDEN, ORG_ACCESS_DENIED,
            STEP_UP_REFUSED, TWO_FACTOR_ENROLLMENT_REQUIRED,
            LICENSE_CAP_REACHED, LICENSE_EXPIRED)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: >-
            The write conflicts with existing data (CONFLICT, DUPLICATE_KEY,
            FOREIGN_KEY_VIOLATION, RESOURCE_IN_USE)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Credential:
      type: object
      properties:
        id:
          type: string
          example: cred_1f3c8a90-...
        name:
          type: string
          example: web-01 root key
        org_id:
          type: string
          nullable: true
          example: org_460b541c-...
          description: null means tenant-wide - readable by every org
        tenant_id:
          type: string
          example: ten_115bea44-...
        type:
          type: string
          enum:
            - SECRET
            - VAULT_PATH
            - SSH_PRIVATE_KEY
        vault_path:
          type: string
          nullable: true
          example: secret/prod/web-01
        description:
          type: string
          nullable: true
        created_at:
          type: string
          format: date-time
          example: '2026-08-26T10:00:26.380Z'
        updated_at:
          type: string
          format: date-time
          example: '2026-08-26T10:00:26.380Z'
      required:
        - id
        - name
        - org_id
        - tenant_id
        - type
        - vault_path
        - description
        - created_at
        - updated_at
      description: >-
        A credential never carries `value`: the secret is accepted on create and
        update, and never returned on any read.
    Error:
      type: object
      properties:
        code:
          type: string
          example: VALIDATION_FAILED
        message:
          type: string
          example: Validation failed
        request_id:
          type: string
          example: req_3702b7e7-...
        field:
          type: string
          description: Set when one input is at fault
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
              message:
                type: string
            required:
              - field
              - message
          description: Set when several inputs are at fault
        details:
          type: object
          additionalProperties:
            nullable: true
      required:
        - code
        - message
        - request_id
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        An API key minted in Command Center (Settings -> API Keys), sent as
        `Authorization: Bearer 2501_ak_...`. A Command Center session cookie is
        also accepted.

````