> ## Documentation Index
> Fetch the complete documentation index at: https://hub.hcompany.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> H Platform has three products: the Agents API (managed computer-use agents, base URL https://agp.eu.hcompany.ai/api/v2 or https://agp.hcompany.ai/api/v2 for the US), the Models API (OpenAI-compatible Holo vision-language models at https://api.hcompany.ai/v1), and HoloTab (a free no-code Chrome extension that runs Holo in the user's browser, with recordable routines and schedules). The `holo` CLI (`pip install "hai-agents[cli]"`) runs Agents API agents from a terminal, drives the user's own desktop with `-a h/holo-desktop`, and serves coding agents through `holo mcp`.
> Authenticate with a bearer API key from the HAI_API_KEY environment variable. SDKs: `pip install hai-agents` (Python, `from hai_agents import Client`) and `npm install hai-agents` (TypeScript, `import { HaiAgentsClient } from "hai-agents"`). CLI: `holo`.
> Agents do work in a browser or on a desktop; describe the task as an imperative instruction. To run a task quickly, prefer the pre-built agent `h/web-surfer-flash`. Read results from the session's `latest_answer` after it reaches a terminal status.
> Sessions are the unit of work; wait for a terminal status (completed, failed, timed_out, interrupted) before reading the answer. Use webhooks or the `changes` long-poll endpoint to follow progress.

# Create an item

> Add a login to an H-hosted vault.

An item holds one login. Agents whose browser environment binds the vault fill it on pages that [match](https://hub.hcompany.ai/agents-api/vaults/overview.md#how-secrets-are-matched) its `urls`.

The response lists which fields are set, never their values. Read them back with [Reveal an item](https://hub.hcompany.ai/agents-api/vaults/reveal-item.md).

**Returns** `201` with the created [item object](https://hub.hcompany.ai/agents-api/vaults/retrieve-item.md#response).

Plaintext secrets in the request body

The values travel in clear text inside the body. Send them only over HTTPS and never log the request.

## Path parameters

**vault\_id** `string` *required*

The H-hosted vault's `id` (UUID).

## Request body

**name** `string` *required*

Label for the item, 1 to 255 characters.

**urls** `string[]` *required*

The sites this item signs in to: 1 to 20 `http` or `https` URLs with a host. A page matches when its hostname equals, or is a subdomain of, one of them.

**values** `object` *required*

Secret values by field, at least one. Keys: `username`, `password`, `email`, `totp`, `api_key`. Each value is a string of 1 to 4096 characters.

For `totp`, send the authenticator secret: base32, or an `otpauth://totp/` URI. `fill_secret_at` types the current code and [reveal](https://hub.hcompany.ai/agents-api/vaults/reveal-item.md) returns it. The secret itself is never returned.

## Examples

```bash cURL theme={"system"}
curl -X POST https://agp.eu.hcompany.ai/api/v2/vaults/3b8d9c2e-6f1a-4e5b-8c7d-0a9b8c7d6e5f/items \
  -H "Authorization: Bearer $HAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Example admin",
    "urls": ["https://example.com/login"],
    "values": {"username": "admin@example.com", "password": "s3cret", "totp": "JBSWY3DPEHPK3PXP"}
  }'
```

```python Python theme={"system"}
from hai_agents import Client

client = Client()

item = client.vaults.create_vault_item(
    vault_id="3b8d9c2e-6f1a-4e5b-8c7d-0a9b8c7d6e5f",
    name="Example admin",
    urls=["https://example.com/login"],
    values={"username": "admin@example.com", "password": "s3cret", "totp": "JBSWY3DPEHPK3PXP"},
)
print(item.id, item.fields)
```

```typescript TypeScript theme={"system"}
import { HaiAgentsClient } from "hai-agents";

const client = new HaiAgentsClient();

const item = await client.vaults.createVaultItem({
  vaultId: "3b8d9c2e-6f1a-4e5b-8c7d-0a9b8c7d6e5f",
  name: "Example admin",
  urls: ["https://example.com/login"],
  values: { username: "admin@example.com", password: "s3cret", totp: "JBSWY3DPEHPK3PXP" },
});
console.log(item.id, item.fields);
```

```json Response theme={"system"}
{
  "id": "7c1e4b2a-9d3f-4a6b-8e5c-2f1a0b9c8d7e",
  "vault_id": "3b8d9c2e-6f1a-4e5b-8c7d-0a9b8c7d6e5f",
  "name": "Example admin",
  "urls": ["https://example.com/login"],
  "fields": ["password", "totp", "username"],
  "created_at": "2026-05-08T09:15:00Z",
  "updated_at": "2026-05-08T09:15:00Z"
}
```

## Errors

| Status | Cause |
| - | - |
| `400` | The vault is not H-hosted, or the `totp` value is not a valid authenticator secret. |
| `403` | Your organization reached its [vault item limit](https://hub.hcompany.ai/agents-api/plans-and-limits.md#per-organization-limits) (1000, across all its vaults). Delete items you no longer need. |
| `404` | Vault not found or you don't have access. |
| `422` | Body failed validation: a URL that is not `http(s)`, an unknown field, an empty value, or a length out of range. Validation errors never echo the submitted values. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.