> ## Documentation Index
> Fetch the complete documentation index at: https://rollout.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# List Credentials

> Lists the consumer's valid credentials.

Setting `includeData=true` additionally requires a token whose `rollout.com.scopes` claim contains `credentials:read_data`, and the request must not originate from browser JavaScript. Without `includeData`, no scope beyond a valid consumer token is needed.



## OpenAPI

````yaml /openapi/rollout.json get /credentials
openapi: 3.0.3
info:
  title: Universal API Documentation
  description: Development documentation
  version: '1.0'
servers:
  - url: https://universal.rollout.com/api
security: []
paths:
  /credentials:
    get:
      tags:
        - Credentials
      summary: List Credentials
      description: >-
        Lists the consumer's valid credentials.


        Setting `includeData=true` additionally requires a token whose
        `rollout.com.scopes` claim contains `credentials:read_data`, and the
        request must not originate from browser JavaScript. Without
        `includeData`, no scope beyond a valid consumer token is needed.
      operationId: getCredentials
      parameters:
        - name: appKey
          in: query
          required: false
          schema:
            type: string
        - name: includeProfile
          in: query
          required: false
          schema:
            type: boolean
        - name: includeData
          in: query
          required: false
          schema:
            type: boolean
            description: >-
              Include the decrypted credential data in each result. Requires a
              token carrying the `credentials:read_data` scope, sent from a
              server-to-server request; otherwise the request fails with 403.
      responses:
        '200':
          description: Response for status 200
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                    createdAt:
                      type: string
                    appKey:
                      type: string
                    credentialKey:
                      type: string
                    plan:
                      type: string
                    invalidatedAt:
                      nullable: true
                      type: string
                    lastInboundSyncCompletedAt:
                      nullable: true
                      type: string
                    numInboundSyncFailedAttempts:
                      type: number
                    entitiesToSync:
                      type: object
                      additionalProperties:
                        type: object
                        properties:
                          enabled:
                            type: boolean
                        required:
                          - enabled
                    label:
                      type: string
                    avatar:
                      type: string
                    data:
                      type: object
                      additionalProperties: {}
                    permissions:
                      type: object
                      additionalProperties:
                        type: object
                        properties:
                          list:
                            type: boolean
                          create:
                            type: boolean
                          update:
                            type: boolean
                          delete:
                            type: boolean
                        required:
                          - list
                          - create
                          - update
                          - delete
                      description: >-
                        What this credential can do, per entity and operation.
                        Omitted when the connector checks the credential's
                        permissions but no result is available yet.
                  required:
                    - id
                    - createdAt
                    - appKey
        '403':
          description: >-
            Returned when `includeData=true` but the token lacks the
            `credentials:read_data` scope, or the request came from browser
            JavaScript.
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        message:
                          type: string
                      required:
                        - message
                required:
                  - errors
                description: >-
                  Returned when `includeData=true` but the token lacks the
                  `credentials:read_data` scope, or the request came from
                  browser JavaScript.
      security:
        - jwt: []
components:
  securitySchemes:
    jwt:
      type: http
      scheme: bearer
      description: Consumer JWT minted by the tenant's backend

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.