ReferenceHTTP APIAgents
Bind a credential name to an agent
POST
Owners, admins and the agent's admins; never an API key. credential_ref names a credential held outside Werft (a secret store entry, a remote MCP server connection). Binding a name already bound answers created: false and a null receipt_id; otherwise writes a bind_credential receipt. A name an agent identity holds answers 409 CREDENTIAL_REF_IN_USE.
Auth: cookie session only; no scope. Idempotency-Key: ignored.
cookieSessioncookie
__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
id*stringThe agent's id.
Match
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$Format
uuidX-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
Value in
"werft-web"application/json- body
credential_ref*stringMatch
^[a-z0-9][a-z0-9._:/-]{0,127}$Success
application/json- response
binding*created*booleanreceipt_id*|nullcurl -X POST 'https://example.com/v1/agents/497f6eca-6276-4993-bfeb-53cbbbba6f08/credential-bindings' \ -H 'Content-Type: application/json' \ -d '{ "credential_ref": "string"}'Example Response
{ "binding": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "agent_id": "2b1e3b65-2c04-4fa2-a2d7-467901e98978", "credential_ref": "string", "bound_by": "f885367a-4556-40be-b295-386f020c1354", "bound_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "running_sessions": 0 }, "created": true, "receipt_id": "64d0a161-468e-472a-b00e-a06ee9ab7de7"}