Vault API

Name: Vault API API
Brand: Vault API
Availability: InStock

✓ Official Vendor SpecIdentity AuthAuthenticationapiKey31 EndpointsREST

For Agents

Manage OAuth connections, consumers, custom field mappings, and request logs that authorise every other Apideck Unified API call.

Connect the Vault API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Vault API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Vault API API.

Create a Vault session URL via POST /vault/sessions for an end user to authorise a connection in-browser

List, create, get, update, and delete consumer records that scope connections to specific end users

Manage connections per consumer with /vault/connections/{unified_api}/{service_id} including update and delete

Import pre-existing OAuth tokens via POST /vault/connections/{unified_api}/{service_id}/import

GET STARTED

Start building with Vault API API

Explore with Jentic

View OpenAPI Document

Use for: Create a Vault session so the user can authorise a Salesforce connection, List all connections a specific consumer has set up, Refresh the OAuth access token for an existing connection, Validate that a connection is still active before calling a Unified API

Not supported: Does not call connector-native endpoints, manage end-user passwords, or run workflow logic — use only for OAuth connection lifecycle, consumers, custom mappings, and request logs.

The Apideck Vault API manages connections, OAuth flows, consumer records, and custom field mappings that power every Apideck Unified API call. Thirty-one endpoints cover creating Vault sessions for end-user authorisation UIs, listing and configuring connections per consumer, importing pre-existing tokens, validating and refreshing connection state, and exposing logs for debugging. Custom-mappings endpoints let teams map their internal field IDs to each connector's native fields so Unified API payloads pass through correctly. Authentication uses the Apideck Authorization header alongside x-apideck-app-id; consumer IDs identify which end user a connection belongs to.

Use Cases

Patterns agents use Vault API API for, with concrete tasks.

★ End-User OAuth via Hosted Vault

Embed Apideck's hosted Vault UI into a SaaS product so end users can connect their own CRM, HRIS, or accounting system without the product building each OAuth flow itself. POST /vault/sessions returns a session URL that opens the Vault UI; the user picks a connector, completes OAuth, and the resulting connection is stored under their consumer ID. Subsequent Unified API calls use that consumer ID.

Create a Vault session for consumer_id 'cust_42' scoped to the 'crm' Unified API, return the session URL, and store the consumer_id for subsequent CRM calls

Connection Health Monitoring

Detect broken connections before Unified API calls fail. POST /vault/connections/{unified_api}/{service_id}/validate checks whether the stored OAuth token is still valid and POST /vault/connections/{unified_api}/{service_id}/token forces a refresh. A scheduled job that runs validate over each connection lets a SaaS product proactively prompt users to re-authorise.

List connections for consumer 'cust_42', call /validate on each, and for any that return inactive POST to /token to attempt refresh — then return the list of connections that still need user re-authorisation

Custom Field Mapping

Map an application's internal field IDs to each connector's native field names so Unified API payloads work correctly across customers using different CRMs. POST /vault/custom-mappings/{unified_api}/{service_id}/{target_field_id} creates a mapping; GET lists existing mappings; PATCH and DELETE manage updates and removals. Necessary for products that need to round-trip vendor-specific data through unified calls.

For consumer 'cust_42' on the 'crm' Unified API, list custom mappings, then POST a new mapping for target_field_id 'lead_score' to the connector-native field ID provided in the input

AI Agent Connection Management via Jentic

An AI agent helps a customer connect their CRM and then troubleshoots failures. Through Jentic, the agent searches 'create a vault session' to start the OAuth flow, then 'list vault logs' to inspect request failures. Jentic stores the Apideck Authorization and x-apideck-app-id values separately so the agent never holds raw credentials, even while debugging connection state.

Through Jentic, create a Vault session for the customer, return the URL, and after they authorise call /validate on the new connection to confirm it is active

Key Endpoints

31 endpoints — the apideck vault api manages connections, oauth flows, consumer records, and custom field mappings that power every apideck unified api call.

METHOD

PATH

DESCRIPTION

POST

/vault/sessions

Create a Vault session URL for end-user OAuth

GET

/vault/connections

List all connections

POST

/vault/connections/{unified_api}/{service_id}

Create a connection

POST

/vault/connections/{unified_api}/{service_id}/validate

Validate a connection's state

POST

/vault/connections/{unified_api}/{service_id}/token

Refresh the access token for a connection

POST

/vault/consumers

Create a consumer

GET

/vault/logs

List recent request logs for debugging

POST

/vault/custom-mappings/{unified_api}/{service_id}/{target_field_id}

Create a custom field mapping

POST

/vault/sessions

Create a Vault session URL for end-user OAuth

GET

/vault/connections

List all connections

POST

/vault/connections/{unified_api}/{service_id}

Create a connection

POST

/vault/connections/{unified_api}/{service_id}/validate

Validate a connection's state

POST

/vault/connections/{unified_api}/{service_id}/token

Refresh the access token for a connection

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Apideck application keys and x-apideck-app-id values are stored encrypted in the Jentic vault — and so are the per-consumer OAuth tokens that Apideck Vault itself manages, so neither Jentic agents nor your application code ever holds the upstream provider's secrets in plain text.

Intent-based discovery

Agents search by intent (for example 'create a vault session' or 'list vault connections') and Jentic returns the matching Vault operation with its input schema, so an agent can manage connections and debug failures without consulting Apideck docs.

Time to first call

Direct Apideck Vault integration: 1-2 days to wire session creation, redirect handling, and validate/refresh logic. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Apideck Proxy API

Proxy reuses the OAuth tokens stored by Vault to forward requests to connector-native endpoints.

Use Vault to set up the connection; use Proxy when calling endpoints that no Unified API covers, sharing the same stored token.

Complementary

Apideck CRM Unified API

Every CRM Unified API call requires a Vault-managed connection identified by consumer ID.

Use Vault first to authorise the customer's CRM connection; then call CRM Unified endpoints scoped to that consumer.

Alternative

Pipedream Connect

Pipedream Connect provides a similar managed-OAuth and connection layer with workflow execution baked in.

Choose Pipedream Connect when you also want workflow runtime; choose Apideck Vault when sticking with the Unified API model.

FAQs

Specific to using Vault API API through Jentic.

What authentication does the Apideck Vault API use?

An apiKey scheme on the `Authorization` header with your Apideck application key, plus the `x-apideck-app-id` header. The `x-apideck-consumer-id` scopes operations to a specific end user. Through Jentic these values are stored encrypted in the vault and injected at execution time.

Can I import an existing OAuth token instead of running a new authorisation flow?

Yes. POST /vault/connections/{unified_api}/{service_id}/import takes an access token, refresh token, and metadata for an existing connection and stores it as if Vault had run the OAuth flow itself. Useful when migrating from a custom integration to Apideck.

What are the rate limits for the Apideck Vault API?

The OpenAPI spec does not publish per-endpoint rate limits. Apideck applies plan-based limits at unify.apideck.com — Vault calls (sessions, connections, custom mappings) count toward the same gateway quota as Unified API calls. See https://developers.apideck.com for your plan's numbers.

How do I create a Vault session through Jentic?

Install with `pip install jentic`, then run the search query 'create a vault session'. Jentic returns POST /vault/sessions — load its schema, supply consumer_id and the Unified APIs to scope the session to, then execute. The response includes a URL you redirect the end user to.

How do I detect that a user's connection has expired?

Call POST /vault/connections/{unified_api}/{service_id}/validate. If it reports the connection is no longer active, call POST /vault/connections/{unified_api}/{service_id}/token to attempt a refresh. If refresh fails, prompt the user to re-authorise via a fresh Vault session.

What are custom mappings used for in this API?

Custom mappings translate between the internal field IDs your product uses and each connector's native field ID. For example, your 'lead_score' might map to a custom Salesforce property — POST /vault/custom-mappings/{unified_api}/{service_id}/{target_field_id} stores the mapping so subsequent Unified API calls round-trip the value correctly.