Depot vault

Registers the collection and credential surface for one face.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

POST /api/v1/endpoints/{agentID}/remote/{sessionID}/type-credential

POSTvault:usetenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Type credential into session

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes
sessionID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
credentialIdrequired	string
justificationrequired	string
sessionIdrequired	string
ticketIdrequired	string

Responses

Status	Body	Description
200	application/json, TypeCredentialResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	That grant is no longer redeemable. Ask for the credential again.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	That remote session is no longer live, so nothing was typed. Start a new session and try again.
500	application/problem+json, ProblemDetails	Could not read the endpoint.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
auditIdrequired	integer	int64.
sessionIdrequired	string
typedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/remote/<sessionID>/type-credential' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/remote/<sessionID>/type-credential' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/remote/<sessionID>/type-credential"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "credentialId": "string",
    "justification": "string",
    "sessionId": "string",
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/remote/<sessionID>/type-credential", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/remote/<sessionID>/type-credential";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "credentialId": "string",
    "justification": "string",
    "sessionId": "string",
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/remote/<sessionID>/type-credential");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/endpoints/{agentID}/shell/grant

POSTvault:usetenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Grant shell credential

Parameters

Name	In	Type	Required	Description
agentID	path	string	Yes

Request body

Required, sent as application/json.

Field	Type	Description
credentialIdrequired	string
justificationrequired	string
sessionIdrequired	string
ticketIdrequired	string

Responses

Status	Body	Description
201	application/json, VaultUseGrantResponse	Created.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:use.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the endpoint.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

201 response body

Field	Type	Description
auditIdrequired	integer	int64.
expiresAtrequired	string (date-time)
grantIdrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/endpoints/<agentID>/shell/grant' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/endpoints/<agentID>/shell/grant' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/endpoints/<agentID>/shell/grant"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "credentialId": "string",
    "justification": "string",
    "sessionId": "string",
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/endpoints/<agentID>/shell/grant", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/endpoints/<agentID>/shell/grant";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "credentialId": "string",
    "justification": "string",
    "sessionId": "string",
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "credentialId": "string",
  "justification": "string",
  "sessionId": "string",
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/endpoints/<agentID>/shell/grant");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/ext/v1/candidates

GETNo permission neededtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

extensionCandidates answers GET /api/v1/ext/v1/candidates?url=.

DEFAULT OFF and answering the ordinary 404 when it is off, rather than a 403 naming a setting: the caller is an extension holding a token, and telling it which practices have the feature disabled is telling it which have it enabled.

ponytail: this is the server half only. The extension is not in this slice (DOCS_CONTRACTS.md 12), and when it lands it needs a fill route beside this read, which mints an ordinary VaultUseGrant.

Parameters

Name	In	Type	Required	Description
url	query	string	No

Responses

Status	Body	Description
200	application/json, object	Success.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/ext/v1/candidates?url=<url>' \
  -H 'Accept: application/json'

PowerShell

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'Accept' = 'application/json'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/ext/v1/candidates?url=<url>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# This operation is public. It takes no credentials.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/ext/v1/candidates"
params = {
    "url": "<url>",
}
headers = {
    "Accept": "application/json",
}

response = requests.get(url, params=params, headers=headers, timeout=30)
response.raise_for_status()
print(response.json())

Go

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/ext/v1/candidates?url=<url>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("Accept", "application/json")

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

const url = new URL("https://depot.example.com/api/v1/ext/v1/candidates");
url.searchParams.set("url", "<url>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "Accept": "application/json",
  },
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// This operation is public. It takes no credentials.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/ext/v1/candidates?url=<url>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/collections

GETvault:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List vault collections

Parameters

Name	In	Type	Required	Description
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
scope	query	string	No

Responses

Status	Body	Description
200	application/json, PagedResultVaultCollectionView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:read.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
itemsrequired	array of VaultCollectionView
items[].color	string
items[].createdAtrequired	string (date-time)
items[].credentialCountrequired	integer
items[].descriptionrequired	string
items[].grantrequired	string
items[].namerequired	string
items[].ownerName	string
items[].ownerUserId	string
items[].publicIdrequired	string
items[].restrictedrequired	boolean
items[].scoperequired	string
items[].updatedAtrequired	string (date-time)
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/collections?page=0&pageSize=0&scope=<scope>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/collections?page=0&pageSize=0&scope=<scope>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/collections"
params = {
    "page": "0",
    "pageSize": "0",
    "scope": "<scope>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/collections?page=0&pageSize=0&scope=<scope>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vault/collections");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("scope", "<scope>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/collections?page=0&pageSize=0&scope=<scope>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/collections

POSTvault:writeshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Create vault collection

Request body

Required, sent as application/json.

Field	Type	Description
color	string or null
description	string or null
name	string or null
ownerUserId	string or null
restricted	boolean or null
scope	string or null

Responses

Status	Body	Description
201	application/json, VaultCollectionView	Created.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:write.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

201 response body

Field	Type	Description
color	string
createdAtrequired	string (date-time)
credentialCountrequired	integer
descriptionrequired	string
grantrequired	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
restrictedrequired	boolean
scoperequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/collections' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/collections' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/collections"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "color": "string",
    "description": "string",
    "name": "string",
    "ownerUserId": "string",
    "restricted": False,
    "scope": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/collections", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/collections";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "color": "string",
    "description": "string",
    "name": "string",
    "ownerUserId": "string",
    "restricted": false,
    "scope": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/collections");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/collections/{collectionId}

GETvault:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get vault collection

Parameters

Name	In	Type	Required	Description
collectionId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, VaultCollectionView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
color	string
createdAtrequired	string (date-time)
credentialCountrequired	integer
descriptionrequired	string
grantrequired	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
restrictedrequired	boolean
scoperequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/collections/<collectionId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/collections/<collectionId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/collections/<collectionId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/collections/<collectionId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/collections/<collectionId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/collections/<collectionId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/vault/collections/{collectionId}

PATCHvault:writeshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Patch vault collection

Parameters

Name	In	Type	Required	Description
collectionId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
color	string or null
description	string or null
name	string or null
ownerUserId	string or null
restricted	boolean or null
scope	string or null

Responses

Status	Body	Description
200	application/json, VaultCollectionView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
color	string
createdAtrequired	string (date-time)
credentialCountrequired	integer
descriptionrequired	string
grantrequired	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
restrictedrequired	boolean
scoperequired	string
updatedAtrequired	string (date-time)

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/vault/collections/<collectionId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/vault/collections/<collectionId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/collections/<collectionId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "color": "string",
    "description": "string",
    "name": "string",
    "ownerUserId": "string",
    "restricted": False,
    "scope": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/vault/collections/<collectionId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/collections/<collectionId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "color": "string",
    "description": "string",
    "name": "string",
    "ownerUserId": "string",
    "restricted": false,
    "scope": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "color": "string",
  "description": "string",
  "name": "string",
  "ownerUserId": "string",
  "restricted": false,
  "scope": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/vault/collections/<collectionId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/vault/collections/{collectionId}

DELETEvault:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Delete vault collection

Parameters

Name	In	Type	Required	Description
collectionId	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/vault/collections/<collectionId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/vault/collections/<collectionId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/collections/<collectionId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/vault/collections/<collectionId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/collections/<collectionId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/vault/collections/<collectionId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/collections/{collectionId}/grants

GETvault:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List vault grants

Parameters

Name	In	Type	Required	Description
collectionId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/collections/<collectionId>/grants' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/collections/<collectionId>/grants' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PUT /api/v1/vault/collections/{collectionId}/grants

PUTvault:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List vault grants

Parameters

Name	In	Type	Required	Description
collectionId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PUT 'https://depot.example.com/api/v1/vault/collections/<collectionId>/grants' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Put `
    -Uri 'https://depot.example.com/api/v1/vault/collections/<collectionId>/grants' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.put(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPut, "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants";

const response = await fetch(url, {
  method: "PUT",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Put, "https://depot.example.com/api/v1/vault/collections/<collectionId>/grants");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/credentials

GETvault:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List vault credentials

Parameters

Name	In	Type	Required	Description
category	query	string	No
checkedOut	query	string	No
collectionId	query	string	No
dir	query	string	No
health	query	string	No
includeSuggested	query	string	No
kind	query	string	No
label	query	string	No
managed	query	string	No
ownerUserId	query	string	No
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No
relatedId	query	string	No
relatedKind	query	string	No
scope	query	string	No
sort	query	string	No
state	query	string	No

Responses

Status	Body	Description
200	application/json, PagedResultCredentialSummary	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:read.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
itemsrequired	array of CredentialSummary
items[].breachCheckedAt	string (date-time) or null
items[].breachCountrequired	integer
items[].categoryrequired	string
items[].checkout	CheckoutView
items[].checkout.checkedOutAtrequired	string (date-time)
items[].checkout.dueAtrequired	string (date-time)
items[].checkout.isMinerequired	boolean
items[].checkout.userIdrequired	string
items[].checkout.userNamerequired	string
items[].checkoutEnabledrequired	boolean
items[].checkoutMinutesrequired	integer
items[].checkoutRotateOnCheckInrequired	boolean
items[].collectionIdrequired	string
items[].collectionNamerequired	string
items[].collectionScoperequired	string
items[].createdAtrequired	string (date-time)
items[].grantrequired	string
items[].hasNotesrequired	boolean
items[].hasSecretrequired	boolean
items[].hasTotprequired	boolean
items[].healthrequired	array of string
items[].kindrequired	string
items[].labelsrequired	array of string
items[].lastRotatedAt	string (date-time) or null
items[].lastUsedAt	string (date-time) or null
items[].linkCountrequired	integer
items[].managedAccountSid	string
items[].managedAgentId	string
items[].managedByrequired	string
items[].managedState	string
items[].namerequired	string
items[].ownerName	string
items[].ownerUserId	string
items[].publicIdrequired	string
items[].requireJustificationrequired	boolean
items[].requireStepUprequired	boolean
items[].restrictedrequired	boolean
items[].reviewByOn	string (date-time) or null
items[].rotateByOn	string (date-time) or null
items[].secretRevisionrequired	integer	int64.
items[].snmp	Options
items[].snmp.authProtocol	string
items[].snmp.contextName	string
items[].snmp.mode	string
items[].snmp.privProtocol	string
items[].snmp.samePassword	boolean
items[].snmp.securityLevel	string
items[].snmp.username	string
items[].snmp.versionrequired	string
items[].sourceRef	string
items[].sourceSystem	string
items[].staterequired	string
items[].strengthScorerequired	integer
items[].updatedAtrequired	string (date-time)
items[].urlsrequired	array of CredentialURLView
items[].urls[].matchrequired	string
items[].urls[].urlrequired	string
items[].usernamerequired	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/credentials?category=<category>&checkedOut=<checkedOut>&collectionId=<collectionId>&dir=<dir>&health=<health>&includeSuggested=<includeSuggested>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/credentials?category=<category>&checkedOut=<checkedOut>&collectionId=<collectionId>&dir=<dir>&health=<health>&includeSuggested=<includeSuggested>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/credentials"
params = {
    "category": "<category>",
    "checkedOut": "<checkedOut>",
    "collectionId": "<collectionId>",
    "dir": "<dir>",
    "health": "<health>",
    "includeSuggested": "<includeSuggested>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/credentials?category=<category>&checkedOut=<checkedOut>&collectionId=<collectionId>&dir=<dir>&health=<health>&includeSuggested=<includeSuggested>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vault/credentials");
url.searchParams.set("category", "<category>");
url.searchParams.set("checkedOut", "<checkedOut>");
url.searchParams.set("collectionId", "<collectionId>");
url.searchParams.set("dir", "<dir>");
url.searchParams.set("health", "<health>");
url.searchParams.set("includeSuggested", "<includeSuggested>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/credentials?category=<category>&checkedOut=<checkedOut>&collectionId=<collectionId>&dir=<dir>&health=<health>&includeSuggested=<includeSuggested>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials

POSTvault:writeshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Create vault credential

Request body

Required, sent as application/json.

Field	Type	Description
category	string or null
checkoutEnabled	boolean or null
checkoutMinutes	integer or null
checkoutRotateOnCheckIn	boolean or null
collectionId	string or null
kind	string or null
labels	array of string or null
name	string or null
notes	string or null
ownerUserId	string or null
requireJustification	boolean or null
requireStepUp	boolean or null
reviewByOn	string (date-time) or null
rotateByOn	string (date-time) or null
secret	string or null
snmp	Write
snmp.authPassword	string or null
snmp.authProtocol	string
snmp.community	string or null
snmp.contextName	string
snmp.mode	string
snmp.privPassword	string or null
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
state	string or null
totpSeed	string or null
urls	array of CredentialURLView or null
urls[].matchrequired	string
urls[].urlrequired	string
username	string or null

Responses

Status	Body	Description
201	application/json, CredentialSummary	Created.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

201 response body

Field	Type	Description
breachCheckedAt	string (date-time) or null
breachCountrequired	integer
categoryrequired	string
checkout	CheckoutView
checkout.checkedOutAtrequired	string (date-time)
checkout.dueAtrequired	string (date-time)
checkout.isMinerequired	boolean
checkout.userIdrequired	string
checkout.userNamerequired	string
checkoutEnabledrequired	boolean
checkoutMinutesrequired	integer
checkoutRotateOnCheckInrequired	boolean
collectionIdrequired	string
collectionNamerequired	string
collectionScoperequired	string
createdAtrequired	string (date-time)
grantrequired	string
hasNotesrequired	boolean
hasSecretrequired	boolean
hasTotprequired	boolean
healthrequired	array of string
kindrequired	string
labelsrequired	array of string
lastRotatedAt	string (date-time) or null
lastUsedAt	string (date-time) or null
linkCountrequired	integer
managedAccountSid	string
managedAgentId	string
managedByrequired	string
managedState	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
requireJustificationrequired	boolean
requireStepUprequired	boolean
restrictedrequired	boolean
reviewByOn	string (date-time) or null
rotateByOn	string (date-time) or null
secretRevisionrequired	integer	int64.
snmp	Options
snmp.authProtocol	string
snmp.contextName	string
snmp.mode	string
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
sourceRef	string
sourceSystem	string
staterequired	string
strengthScorerequired	integer
updatedAtrequired	string (date-time)
urlsrequired	array of CredentialURLView
urls[].matchrequired	string
urls[].urlrequired	string
usernamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "category": "string",
    "checkoutEnabled": False,
    "checkoutMinutes": 0,
    "checkoutRotateOnCheckIn": False,
    "collectionId": "string",
    "kind": "string",
    "labels": [
        "string",
    ],
    "name": "string",
    "notes": "string",
    "ownerUserId": "string",
    "requireJustification": False,
    "requireStepUp": False,
    "reviewByOn": "2026-01-01T00:00:00Z",
    "rotateByOn": "2026-01-01T00:00:00Z",
    "secret": "string",
    "snmp": {
        "authPassword": "string",
        "authProtocol": "string",
        "community": "string",
        "contextName": "string",
        "mode": "string",
        "privPassword": "string",
        "privProtocol": "string",
        "samePassword": False,
        "securityLevel": "string",
        "username": "string",
        "version": "string",
    },
    "state": "string",
    "totpSeed": "string",
    "urls": [
        {
            "match": "string",
            "url": "string",
        },
    ],
    "username": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "category": "string",
    "checkoutEnabled": false,
    "checkoutMinutes": 0,
    "checkoutRotateOnCheckIn": false,
    "collectionId": "string",
    "kind": "string",
    "labels": [
      "string"
    ],
    "name": "string",
    "notes": "string",
    "ownerUserId": "string",
    "requireJustification": false,
    "requireStepUp": false,
    "reviewByOn": "2026-01-01T00:00:00Z",
    "rotateByOn": "2026-01-01T00:00:00Z",
    "secret": "string",
    "snmp": {
      "authPassword": "string",
      "authProtocol": "string",
      "community": "string",
      "contextName": "string",
      "mode": "string",
      "privPassword": "string",
      "privProtocol": "string",
      "samePassword": false,
      "securityLevel": "string",
      "username": "string",
      "version": "string"
    },
    "state": "string",
    "totpSeed": "string",
    "urls": [
      {
        "match": "string",
        "url": "string"
      }
    ],
    "username": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/credentials/{credId}

GETvault:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, CredentialSummary	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
breachCheckedAt	string (date-time) or null
breachCountrequired	integer
categoryrequired	string
checkout	CheckoutView
checkout.checkedOutAtrequired	string (date-time)
checkout.dueAtrequired	string (date-time)
checkout.isMinerequired	boolean
checkout.userIdrequired	string
checkout.userNamerequired	string
checkoutEnabledrequired	boolean
checkoutMinutesrequired	integer
checkoutRotateOnCheckInrequired	boolean
collectionIdrequired	string
collectionNamerequired	string
collectionScoperequired	string
createdAtrequired	string (date-time)
grantrequired	string
hasNotesrequired	boolean
hasSecretrequired	boolean
hasTotprequired	boolean
healthrequired	array of string
kindrequired	string
labelsrequired	array of string
lastRotatedAt	string (date-time) or null
lastUsedAt	string (date-time) or null
linkCountrequired	integer
managedAccountSid	string
managedAgentId	string
managedByrequired	string
managedState	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
requireJustificationrequired	boolean
requireStepUprequired	boolean
restrictedrequired	boolean
reviewByOn	string (date-time) or null
rotateByOn	string (date-time) or null
secretRevisionrequired	integer	int64.
snmp	Options
snmp.authProtocol	string
snmp.contextName	string
snmp.mode	string
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
sourceRef	string
sourceSystem	string
staterequired	string
strengthScorerequired	integer
updatedAtrequired	string (date-time)
urlsrequired	array of CredentialURLView
urls[].matchrequired	string
urls[].urlrequired	string
usernamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/credentials/<credId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/credentials/<credId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/credentials/<credId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/vault/credentials/{credId}

PATCHvault:writeshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Patch vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
category	string or null
checkoutEnabled	boolean or null
checkoutMinutes	integer or null
checkoutRotateOnCheckIn	boolean or null
collectionId	string or null
kind	string or null
labels	array of string or null
name	string or null
notes	string or null
ownerUserId	string or null
requireJustification	boolean or null
requireStepUp	boolean or null
reviewByOn	string (date-time) or null
rotateByOn	string (date-time) or null
secret	string or null
snmp	Write
snmp.authPassword	string or null
snmp.authProtocol	string
snmp.community	string or null
snmp.contextName	string
snmp.mode	string
snmp.privPassword	string or null
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
state	string or null
totpSeed	string or null
urls	array of CredentialURLView or null
urls[].matchrequired	string
urls[].urlrequired	string
username	string or null

Responses

Status	Body	Description
200	application/json, CredentialSummary	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
breachCheckedAt	string (date-time) or null
breachCountrequired	integer
categoryrequired	string
checkout	CheckoutView
checkout.checkedOutAtrequired	string (date-time)
checkout.dueAtrequired	string (date-time)
checkout.isMinerequired	boolean
checkout.userIdrequired	string
checkout.userNamerequired	string
checkoutEnabledrequired	boolean
checkoutMinutesrequired	integer
checkoutRotateOnCheckInrequired	boolean
collectionIdrequired	string
collectionNamerequired	string
collectionScoperequired	string
createdAtrequired	string (date-time)
grantrequired	string
hasNotesrequired	boolean
hasSecretrequired	boolean
hasTotprequired	boolean
healthrequired	array of string
kindrequired	string
labelsrequired	array of string
lastRotatedAt	string (date-time) or null
lastUsedAt	string (date-time) or null
linkCountrequired	integer
managedAccountSid	string
managedAgentId	string
managedByrequired	string
managedState	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
requireJustificationrequired	boolean
requireStepUprequired	boolean
restrictedrequired	boolean
reviewByOn	string (date-time) or null
rotateByOn	string (date-time) or null
secretRevisionrequired	integer	int64.
snmp	Options
snmp.authProtocol	string
snmp.contextName	string
snmp.mode	string
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
sourceRef	string
sourceSystem	string
staterequired	string
strengthScorerequired	integer
updatedAtrequired	string (date-time)
urlsrequired	array of CredentialURLView
urls[].matchrequired	string
urls[].urlrequired	string
usernamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X PATCH 'https://depot.example.com/api/v1/vault/credentials/<credId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "category": "string",
    "checkoutEnabled": False,
    "checkoutMinutes": 0,
    "checkoutRotateOnCheckIn": False,
    "collectionId": "string",
    "kind": "string",
    "labels": [
        "string",
    ],
    "name": "string",
    "notes": "string",
    "ownerUserId": "string",
    "requireJustification": False,
    "requireStepUp": False,
    "reviewByOn": "2026-01-01T00:00:00Z",
    "rotateByOn": "2026-01-01T00:00:00Z",
    "secret": "string",
    "snmp": {
        "authPassword": "string",
        "authProtocol": "string",
        "community": "string",
        "contextName": "string",
        "mode": "string",
        "privPassword": "string",
        "privProtocol": "string",
        "samePassword": False,
        "securityLevel": "string",
        "username": "string",
        "version": "string",
    },
    "state": "string",
    "totpSeed": "string",
    "urls": [
        {
            "match": "string",
            "url": "string",
        },
    ],
    "username": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/vault/credentials/<credId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "category": "string",
    "checkoutEnabled": false,
    "checkoutMinutes": 0,
    "checkoutRotateOnCheckIn": false,
    "collectionId": "string",
    "kind": "string",
    "labels": [
      "string"
    ],
    "name": "string",
    "notes": "string",
    "ownerUserId": "string",
    "requireJustification": false,
    "requireStepUp": false,
    "reviewByOn": "2026-01-01T00:00:00Z",
    "rotateByOn": "2026-01-01T00:00:00Z",
    "secret": "string",
    "snmp": {
      "authPassword": "string",
      "authProtocol": "string",
      "community": "string",
      "contextName": "string",
      "mode": "string",
      "privPassword": "string",
      "privProtocol": "string",
      "samePassword": false,
      "securityLevel": "string",
      "username": "string",
      "version": "string"
    },
    "state": "string",
    "totpSeed": "string",
    "urls": [
      {
        "match": "string",
        "url": "string"
      }
    ],
    "username": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "category": "string",
  "checkoutEnabled": false,
  "checkoutMinutes": 0,
  "checkoutRotateOnCheckIn": false,
  "collectionId": "string",
  "kind": "string",
  "labels": [
    "string"
  ],
  "name": "string",
  "notes": "string",
  "ownerUserId": "string",
  "requireJustification": false,
  "requireStepUp": false,
  "reviewByOn": "2026-01-01T00:00:00Z",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "state": "string",
  "totpSeed": "string",
  "urls": [
    {
      "match": "string",
      "url": "string"
    }
  ],
  "username": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/vault/credentials/<credId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/vault/credentials/{credId}

DELETEvault:writeshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Delete vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/vault/credentials/<credId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/vault/credentials/<credId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/vault/credentials/<credId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/checkin

POSTvault:writeshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Check in vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, CheckoutView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
checkedOutAtrequired	string (date-time)
dueAtrequired	string (date-time)
isMinerequired	boolean
userIdrequired	string
userNamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/checkin' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/checkin' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/checkin"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/checkin", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>/checkin";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/checkin");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/checkout

POSTvault:writeshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Check out vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
justificationrequired	string
minutesrequired	integer
ticketIdrequired	string

Responses

Status	Body	Description
200	application/json, CheckoutView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
checkedOutAtrequired	string (date-time)
dueAtrequired	string (date-time)
isMinerequired	boolean
userIdrequired	string
userNamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/checkout' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/checkout' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/checkout"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "justification": "string",
    "minutes": 0,
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/checkout", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>/checkout";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "justification": "string",
    "minutes": 0,
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/checkout");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/force-checkin

POSTvault:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Force check in vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
justificationrequired	string
minutesrequired	integer
ticketIdrequired	string

Responses

Status	Body	Description
200	application/json, CheckoutView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
checkedOutAtrequired	string (date-time)
dueAtrequired	string (date-time)
isMinerequired	boolean
userIdrequired	string
userNamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/force-checkin' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/force-checkin' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/force-checkin"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "justification": "string",
    "minutes": 0,
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/force-checkin", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>/force-checkin";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "justification": "string",
    "minutes": 0,
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "justification": "string",
  "minutes": 0,
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/force-checkin");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/credentials/{credId}/history

GETvault:revealshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

readVaultHistory is the one disclosure route that is a GET, and the one that additionally requires grant EDIT.

Edit and not view, because the history is every password this credential has ever had: a reader who may see the current one has been trusted with one secret, and the history is every secret it ever was, including ones still live on a restored image.

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.
justification	query	string	No
ticketId	query	string	No

Responses

Status	Body	Description
200	application/json, CredentialHistoryResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
auditIdrequired	integer	int64.
itemsrequired	array of CredentialHistoryItem
items[].changedAtrequired	string (date-time)
items[].changedByName	string
items[].changedByUserId	string
items[].reasonrequired	string
items[].secretrequired	string
items[].versionNorequired	integer
publicIdrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/credentials/<credId>/history?justification=<justification>&ticketId=<ticketId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/history?justification=<justification>&ticketId=<ticketId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/history"
params = {
    "justification": "<justification>",
    "ticketId": "<ticketId>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/credentials/<credId>/history?justification=<justification>&ticketId=<ticketId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vault/credentials/<credId>/history");
url.searchParams.set("justification", "<justification>");
url.searchParams.set("ticketId", "<ticketId>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/credentials/<credId>/history?justification=<justification>&ticketId=<ticketId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/reveal

POSTvault:revealshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Reveal vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.
justification	query	string	No
ticketId	query	string	No

Request body

Required, sent as application/json.

Field	Type	Description
justificationrequired	string
ticketIdrequired	string

Responses

Status	Body	Description
200	application/json, CredentialRevealResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
auditIdrequired	integer	int64.
notes	string
publicIdrequired	string
secretrequired	string
totpCode	string
totpRemainingSeconds	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/reveal?justification=<justification>&ticketId=<ticketId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "justification": "string",
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "justification": "string",
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/reveal?justification=<justification>&ticketId=<ticketId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/reveal"
params = {
    "justification": "<justification>",
    "ticketId": "<ticketId>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "justification": "string",
    "ticketId": "string",
}

response = requests.post(url, params=params, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "justification": "string",
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/reveal?justification=<justification>&ticketId=<ticketId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vault/credentials/<credId>/reveal");
url.searchParams.set("justification", "<justification>");
url.searchParams.set("ticketId", "<ticketId>");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "justification": "string",
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "justification": "string",
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/reveal?justification=<justification>&ticketId=<ticketId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/rotate

POSTvault:rotateshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Rotate vault credential

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
expectedRevision	integer or null	int64.
justificationrequired	string
reasonrequired	string
rotateByOn	string (date-time) or null
secretrequired	string
snmp	Write
snmp.authPassword	string or null
snmp.authProtocol	string
snmp.community	string or null
snmp.contextName	string
snmp.mode	string
snmp.privPassword	string or null
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
ticketIdrequired	string

Responses

Status	Body	Description
200	application/json, CredentialSummary	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
breachCheckedAt	string (date-time) or null
breachCountrequired	integer
categoryrequired	string
checkout	CheckoutView
checkout.checkedOutAtrequired	string (date-time)
checkout.dueAtrequired	string (date-time)
checkout.isMinerequired	boolean
checkout.userIdrequired	string
checkout.userNamerequired	string
checkoutEnabledrequired	boolean
checkoutMinutesrequired	integer
checkoutRotateOnCheckInrequired	boolean
collectionIdrequired	string
collectionNamerequired	string
collectionScoperequired	string
createdAtrequired	string (date-time)
grantrequired	string
hasNotesrequired	boolean
hasSecretrequired	boolean
hasTotprequired	boolean
healthrequired	array of string
kindrequired	string
labelsrequired	array of string
lastRotatedAt	string (date-time) or null
lastUsedAt	string (date-time) or null
linkCountrequired	integer
managedAccountSid	string
managedAgentId	string
managedByrequired	string
managedState	string
namerequired	string
ownerName	string
ownerUserId	string
publicIdrequired	string
requireJustificationrequired	boolean
requireStepUprequired	boolean
restrictedrequired	boolean
reviewByOn	string (date-time) or null
rotateByOn	string (date-time) or null
secretRevisionrequired	integer	int64.
snmp	Options
snmp.authProtocol	string
snmp.contextName	string
snmp.mode	string
snmp.privProtocol	string
snmp.samePassword	boolean
snmp.securityLevel	string
snmp.username	string
snmp.versionrequired	string
sourceRef	string
sourceSystem	string
staterequired	string
strengthScorerequired	integer
updatedAtrequired	string (date-time)
urlsrequired	array of CredentialURLView
urls[].matchrequired	string
urls[].urlrequired	string
usernamerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/rotate' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "expectedRevision": 0,
  "justification": "string",
  "reason": "string",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "expectedRevision": 0,
  "justification": "string",
  "reason": "string",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/rotate' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "expectedRevision": 0,
    "justification": "string",
    "reason": "string",
    "rotateByOn": "2026-01-01T00:00:00Z",
    "secret": "string",
    "snmp": {
        "authPassword": "string",
        "authProtocol": "string",
        "community": "string",
        "contextName": "string",
        "mode": "string",
        "privPassword": "string",
        "privProtocol": "string",
        "samePassword": False,
        "securityLevel": "string",
        "username": "string",
        "version": "string",
    },
    "ticketId": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "expectedRevision": 0,
  "justification": "string",
  "reason": "string",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "expectedRevision": 0,
    "justification": "string",
    "reason": "string",
    "rotateByOn": "2026-01-01T00:00:00Z",
    "secret": "string",
    "snmp": {
      "authPassword": "string",
      "authProtocol": "string",
      "community": "string",
      "contextName": "string",
      "mode": "string",
      "privPassword": "string",
      "privProtocol": "string",
      "samePassword": false,
      "securityLevel": "string",
      "username": "string",
      "version": "string"
    },
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "expectedRevision": 0,
  "justification": "string",
  "reason": "string",
  "rotateByOn": "2026-01-01T00:00:00Z",
  "secret": "string",
  "snmp": {
    "authPassword": "string",
    "authProtocol": "string",
    "community": "string",
    "contextName": "string",
    "mode": "string",
    "privPassword": "string",
    "privProtocol": "string",
    "samePassword": false,
    "securityLevel": "string",
    "username": "string",
    "version": "string"
  },
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/rotate-now

POSTvault:rotateshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Rotate vault credential now

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Responses

Status	Body	Description
202	application/json, RotateNowResponse	Accepted.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
502	application/problem+json, ProblemDetails	Could not ask the endpoint to rotate.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

202 response body

Field	Type	Description
commandIdrequired	string
deliveredrequired	boolean
staterequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/rotate-now' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/rotate-now' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate-now"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate-now", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate-now";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/rotate-now");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/credentials/{credId}/rotations

GETvault:readshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List vault rotations

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/credentials/<credId>/rotations' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/rotations' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/rotations"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/credentials/<credId>/rotations", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/credentials/<credId>/rotations";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/credentials/<credId>/rotations");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/credentials/{credId}/totp

POSTvault:revealshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Read vault totp

Parameters

Name	In	Type	Required	Description
credId	path	string	Yes	A uuid.
justification	query	string	No
ticketId	query	string	No

Request body

Required, sent as application/json.

Field	Type	Description
justificationrequired	string
ticketIdrequired	string

Responses

Status	Body	Description
200	application/json, CredentialTotpResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold the required permission.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	Could not read the credential.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
auditIdrequired	integer	int64.
publicIdrequired	string
totpCoderequired	string
totpRemainingSecondsrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/credentials/<credId>/totp?justification=<justification>&ticketId=<ticketId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "justification": "string",
  "ticketId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "justification": "string",
  "ticketId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/credentials/<credId>/totp?justification=<justification>&ticketId=<ticketId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/credentials/<credId>/totp"
params = {
    "justification": "<justification>",
    "ticketId": "<ticketId>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "justification": "string",
    "ticketId": "string",
}

response = requests.post(url, params=params, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "justification": "string",
  "ticketId": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/credentials/<credId>/totp?justification=<justification>&ticketId=<ticketId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vault/credentials/<credId>/totp");
url.searchParams.set("justification", "<justification>");
url.searchParams.set("ticketId", "<ticketId>");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "justification": "string",
    "ticketId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "justification": "string",
  "ticketId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/credentials/<credId>/totp?justification=<justification>&ticketId=<ticketId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/extension-tokens

GETtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List extension tokens

Responses

Status	Body	Description
200	application/json, object	Success.
401	application/problem+json, ProblemDetails	Authentication is required.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/extension-tokens' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/extension-tokens' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/extension-tokens"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/extension-tokens", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/extension-tokens";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/extension-tokens");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/extension-tokens

POSTtenant facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Mint extension token

Request body

Required, sent as application/json.

Field	Type	Description
labelrequired	string
scoperequired	string, one of read, use

Responses

Status	Body	Description
201	application/json, ExtensionTokenMinted	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	Authentication is required.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

201 response body

Field	Type	Description
createdAtrequired	string (date-time)
expiresAtrequired	string (date-time)
labelrequired	string
lastUsedAt	string (date-time) or null
publicIdrequired	string
revokedAt	string (date-time) or null
scoperequired	string
tokenrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/extension-tokens' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "label": "string",
  "scope": "read"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "label": "string",
  "scope": "read"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/extension-tokens' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/extension-tokens"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "label": "string",
    "scope": "read",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "label": "string",
  "scope": "read"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/extension-tokens", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/extension-tokens";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "label": "string",
    "scope": "read"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "label": "string",
  "scope": "read"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/extension-tokens");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/vault/extension-tokens/{tokenId}

DELETEtenant facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Revoke extension token

Parameters

Name	In	Type	Required	Description
tokenId	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	Authentication is required.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/vault/extension-tokens/<tokenId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/vault/extension-tokens/<tokenId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/extension-tokens/<tokenId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/vault/extension-tokens/<tokenId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/extension-tokens/<tokenId>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/vault/extension-tokens/<tokenId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/vault/personal/{userId}/reclaim

POSTvault:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Reclaim personal vault

Parameters

Name	In	Type	Required	Description
userId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
destinationCollectionIdrequired	string
reasonrequired	string

Responses

Status	Body	Description
200	application/json, ReclaimResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

200 response body

Field	Type	Description
auditIdrequired	integer	int64.
destinationCollectionIdrequired	string
destinationCollectionNamerequired	string
movedrequired	array of ReclaimedCredental
moved[].namerequired	string
moved[].publicIdrequired	string
moved[].usernamerequired	string
movedCountrequired	integer
ownerNamerequired	string
ownerUserIdrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/vault/personal/<userId>/reclaim' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "destinationCollectionId": "string",
  "reason": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "destinationCollectionId": "string",
  "reason": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/vault/personal/<userId>/reclaim' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/vault/personal/<userId>/reclaim"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "destinationCollectionId": "string",
    "reason": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "destinationCollectionId": "string",
  "reason": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/vault/personal/<userId>/reclaim", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/vault/personal/<userId>/reclaim";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "destinationCollectionId": "string",
    "reason": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "destinationCollectionId": "string",
  "reason": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/vault/personal/<userId>/reclaim");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/vault/usable

GETvault:useshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listUsableCredentials answers GET /api/v1/vault/usable?agentId=.

It exists BECAUSE vault:use does not imply vault:read. Without it the session picker would be built from a list read the technician lacks, and the split would be true in the permission table and false in the product. A holder of vault:use alone gets 200 here and 403 on /vault/credentials.

Parameters

Name	In	Type	Required	Description
agentId	query	string	No

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold vault:use.
404	application/problem+json, ProblemDetails	No resource matches.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no client database for this request yet.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/vault/usable?agentId=<agentId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/vault/usable?agentId=<agentId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/vault/usable"
params = {
    "agentId": "<agentId>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/vault/usable?agentId=<agentId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/vault/usable");
url.searchParams.set("agentId", "<agentId>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/vault/usable?agentId=<agentId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());