GET | List a credential by [id]

Description

Retrieve the complete detail of a single credential in PAM Core, using the v2 canonical model CredentialV2. The response is the absolute superset of all non-sensitive credential attributes. Use the optional fields query parameter to request a projection of specific fields.

Prerequisites

• Authorization with read permission to PAM Core granted by the administrator in A2A. For more information, access How to manage authorizations in A2A.

Request

GET /api/v2/pam/credentials/{id}

Path parameters

Query parameters

Supported fields values

The following fields are available for projection. Use dot notation as shown.

credential object

device object

execution object

authentication object

reconciliation object

automation object

certificate object

Warning: certificate.key_file and certificate.key_password are classified as sensitive and can never be requested or returned. Requesting them returns 403.

session object

web_service object

jit object

Sensitive fields — never returned

The following fields are always excluded from the response regardless of the fields parameter. Requesting any of these returns 403:

• credential.password
• certificate.key_file
• certificate.key_password
• totp.secret_key

Example requests

Full canonical response (no projection):

GET {{url}}/api/v2/pam/credentials/101

Projected response — specific fields only:

GET {{url}}/api/v2/pam/credentials/101?fields=credential.username,device,execution.automatic_change_enabled,jit.credential_enabled

Response

HTTP/1.1 200 OK

Example response body — full canonical

{
    "data": {
        "id": "101",
        "credential": {
            "username": "svc-payments",
            "active": true,
            "password_type": "password",
            "tags": ["prod", "finance"],
            "criticality": "high",
            "user_credential_owner": {
                "name": "John Doe"
            },
            "parent_credential": {
                "id": "10",
                "username": "root"
            },
            "last_used_at": "2026-01-29T12:34:56Z",
            "additional_information": "Owned by Payments Team; used by CI/CD pipeline.",
            "password_policy": "medium-lowercase-only"
        },
        "device": {
            "id": 55,
            "name": "db-prod-01",
            "domain_name": "CORP",
            "management_ip": "10.10.10.10",
            "vendor": "Oracle",
            "product": "Oracle Linux VM",
            "site": "SP-DC1",
            "tags": ["prod", "database"],
            "connectivity_types": ["SSH", "SQL_Server"]
        },
        "secret": {
            "has_secret": true,
            "type": "password"
        },
        "execution": {
            "automatic_change_enabled": true,
            "change_plugin": {
                "name": "linux-passwd"
            },
            "change_template": {
                "name": "default-linux"
            },
            "agent_based_password_change": false,
            "justification": "Managed by PAM"
        },
        "authentication": {
            "use_own_credential_to_connect": false,
            "credential": {
                "id": "88",
                "username": "auth-user"
            },
            "restrict_to_remote_application_only": false,
            "notes": "Connection credential managed by infra team."
        },
        "reconciliation": {
            "credential_enabled": true,
            "autorun": true,
            "credential": {
                "id": "90",
                "username": "recon-user"
            },
            "plugin": {
                "name": "recon-linux"
            },
            "template": {
                "name": "default-recon"
            }
        },
        "automation": {
            "restrict_access_to_applications_only": true,
            "macro_remote_apps": [
                {
                    "id": "12",
                    "name": "ERP Access"
                }
            ],
            "use_own_credential_to_connect": true,
            "authentication_credential": null,
            "authentication_device": null
        },
        "certificate": {
            "file": {
                "name": "client.crt"
            },
            "has_key_file": true,
            "has_key_password": true
        },
        "session": {
            "status": "available",
            "connectivity": ["SSH", "SQL_Server"]
        },
        "web_service": {
            "identifiers": ["svc-payment-api"],
            "server_path": "/api/payments"
        },
        "jit": {
            "credential_enabled": true,
            "type": "ephemeral",
            "use_own_credential_to_connect": false,
            "authentication_credential": {
                "id": "77",
                "username": "jit-auth"
            },
            "credential_enable_plugin": {
                "name": "jit-enable"
            },
            "credential_enable_template": {
                "name": "enable-template"
            },
            "credential_disable_plugin": {
                "name": "jit-disable"
            },
            "credential_disable_template": {
                "name": "disable-template"
            },
            "credential_creation_plugin": null,
            "credential_creation_template": null,
            "credential_removal_plugin": null,
            "credential_removal_template": null
        }
    },
    "meta": {
        "links": {
            "self": "/api/v2/pam/credentials/101"
        },
        "actions": {
            "checkout": "/api/v2/pam/credentials/101/checkout",
            "rotate": "/api/v2/pam/credentials/101/rotate"
        }
    }
}

Example response body — with field projection

{
    "data": {
        "id": "101",
        "credential": {
            "username": "svc-payments"
        },
        "device": {
            "id": 55,
            "name": "db-prod-01"
        },
        "execution": {
            "automatic_change_enabled": true
        },
        "jit": {
            "credential_enabled": true
        }
    },
    "meta": {
        "links": {
            "self": "/api/v2/pam/credentials/101?fields=credential.username,device,execution.automatic_change_enabled,jit.credential_enabled"
        }
    }
}

Note: When fields is omitted, all public fields of the canonical model are returned, with null for fields that aren't applicable. When fields is provided, only the requested fields are returned.

Response body fields

Errors

Authentication errors

Related documents

• GET | List all credentials (v2)
• About applications and authorizations in A2A