GET | List all credentials

Description

List all credentials associated with your authorization in PAM Core, using the v2 canonical model. Returns a paginated, filterable projection of the CredentialV2 entity.

Note: This endpoint is part of the A2A API v2 surface, introduced in version 4.2.2. The v1 equivalent is documented in GET | List all credentials.

Prerequisites

• Authorization with read permission to PAM Core granted by the administrator in A2A. For more information, access How to manage authorizations in A2A.

Request

GET /api/v2/pam/credentials

Query parameters

All query parameters are optional. When no parameters are provided, the endpoint returns all credentials accessible to the authorization, using the minimum contract fields defined in the response schema.

Filters

Note: Filtering on sensitive or non-existent fields returns 422. Invalid boolean values also return 422. For full filter validation rules, AND/OR logic, and examples, see API v2 - Conventions and shared behaviors.

Sorting

sort_by accepts one or more fields in the format field:asc or field:desc. Multiple fields are comma-separated and processed left to right. Default direction is asc. Invalid fields or directions return 422. Example: sort_by=criticality:desc,credential.username.

For full sorting rules, see API v2 - Conventions and shared behaviors.

Pagination

Supports offset pagination (page, limit) and cursor-based pagination (cursor). The two strategies are mutually exclusive — sending both returns 422. Cursor-based pagination is recommended for datasets exceeding 100,000 records.

For full pagination rules and response field descriptions, see API v2 — Conventions and shared behaviors.

Example request

GET {{url}}/api/v2/pam/credentials

Response

HTTP/1.1 200 OK

Example response body

{
    "data": [
        {
            "id": "101",
            "credential": {
                "username": "svc-payments",
                "active": true,
                "tags": ["prod"],
                "criticality": "high",
                "user_credential_owner": {
                    "name": "John Doe"
                }
            },
            "device": {
                "id": 123,
                "name": "db-prod-01",
                "domain_name": "CORP"
            },
            "secret": {
                "has_secret": true,
                "type": "password"
            },
            "execution": {
                "automatic_change_enabled": true
            },
            "reconciliation": {
                "credential_enabled": true
            },
            "jit": {
                "credential_enabled": false
            }
        },
        {
            "id": "102",
            "credential": {
                "username": "db-monitor",
                "active": false,
                "tags": [],
                "criticality": null,
                "user_credential_owner": null
            },
            "device": {
                "id": 124,
                "name": "db-dev-01",
                "domain_name": null
            },
            "secret": {
                "has_secret": false,
                "type": "password"
            },
            "execution": {
                "automatic_change_enabled": false
            },
            "reconciliation": {
                "credential_enabled": false
            },
            "jit": {
                "credential_enabled": false
            }
        }
    ],
    "meta": {
        "pagination": {
            "page": 1,
            "limit": 50,
            "total_items": 1320,
            "total_pages": 27,
            "count": 50
        },
        "links": {
            "self": "/api/v2/pam/credentials?page=1&limit=50",
            "first": "/api/v2/pam/credentials?page=1&limit=50",
            "prev": null,
            "next": "/api/v2/pam/credentials?page=2&limit=50",
            "last": "/api/v2/pam/credentials?page=27&limit=50"
        }
    }
}

Note: For large datasets (>100,000 records), total_items may be null or an estimate. Use has_more as the continuation signal in those scenarios. See API v2 - Conventions and shared behaviors.

Response body fields

Errors

For authentication error messages and the 403 vs 404 policy, see API v2 - Conventions and shared behaviors.

Related documents

• API v2 - Conventions and shared behaviors
• GET | List a credential by [id] (v2)
• About applications and authorizations in A2A