Create a vault
curl --request POST \
--url https://agp.eu.hcompany.ai/api/v2/vaults \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"provider_config": {},
"token": "<string>"
}
'import requests
url = "https://agp.eu.hcompany.ai/api/v2/vaults"
payload = {
"name": "<string>",
"provider_config": {},
"token": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', provider_config: {}, token: '<string>'})
};
fetch('https://agp.eu.hcompany.ai/api/v2/vaults', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://agp.eu.hcompany.ai/api/v2/vaults",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'provider_config' => [
],
'token' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://agp.eu.hcompany.ai/api/v2/vaults"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"provider_config\": {},\n \"token\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://agp.eu.hcompany.ai/api/v2/vaults")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"provider_config\": {},\n \"token\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://agp.eu.hcompany.ai/api/v2/vaults")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"provider_config\": {},\n \"token\": \"<string>\"\n}"
response = http.request(request)
puts response.read_bodyVaults
Create a vault
Register a secrets provider for your organization.
POST
/
api
/
v2
/
vaults
Create a vault
curl --request POST \
--url https://agp.eu.hcompany.ai/api/v2/vaults \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"provider_config": {},
"token": "<string>"
}
'import requests
url = "https://agp.eu.hcompany.ai/api/v2/vaults"
payload = {
"name": "<string>",
"provider_config": {},
"token": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', provider_config: {}, token: '<string>'})
};
fetch('https://agp.eu.hcompany.ai/api/v2/vaults', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://agp.eu.hcompany.ai/api/v2/vaults",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'provider_config' => [
],
'token' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://agp.eu.hcompany.ai/api/v2/vaults"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"provider_config\": {},\n \"token\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://agp.eu.hcompany.ai/api/v2/vaults")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"provider_config\": {},\n \"token\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://agp.eu.hcompany.ai/api/v2/vaults")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"provider_config\": {},\n \"token\": \"<string>\"\n}"
response = http.request(request)
puts response.read_bodyRegisters a vault (a link between your organization and an external secrets provider) so an agent can sign in to the sites it works on without you passing the secrets through the API. Today the only provider is 1Password: you record which 1Password vault to read (
op_vault_id) and a service account token that grants access to it.
The token is validated against the provider before it is stored, and is never returned by any endpoint.
Returns 201 with the created vault object (see Retrieve for the full field list).
The request body carries a plaintext service account token. Send it only over HTTPS and never log it.
Request body
Human-readable label for the config.
Provider settings.
provider(string, optional): Secrets provider. Defaults toonepassword, the only supported value.op_vault_id(string, required): Identifier of the 1Password vault to read credentials from.
The 1Password service account token granting access to the vault. Write-only: validated before storage and omitted from every response.
Examples
curl -X POST https://agp.eu.hcompany.ai/api/v2/vaults \
-H "Authorization: Bearer $HAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"token": "ops_eyJ..."
}'
from hai_agents import Client, OnePasswordConfig
client = Client()
vault = client.vaults.create_vault(
name="prod-1password",
provider_config=OnePasswordConfig(op_vault_id="abcd1234efgh5678"),
token="ops_eyJ...",
)
print(vault.id)
import { HaiAgentsClient } from "hai-agents";
const client = new HaiAgentsClient();
const vault = await client.vaults.createVault({
name: "prod-1password",
providerConfig: { opVaultId: "abcd1234efgh5678" },
token: "ops_eyJ...",
});
console.log(vault.id);
Response
{
"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"org_id": "1c9a2f6e-4b3d-4a8c-9e5f-7d6b8a0c1e2f",
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"created_at": "2026-05-07T14:30:00Z",
"updated_at": "2026-05-07T14:30:00Z"
}
Errors
| Status | Cause |
|---|---|
409 | A vault with this name already exists in your organization. Names are unique per org. |
422 | Body failed validation, or the provider rejected the token (it could not access op_vault_id). |
Was this page helpful?
⌘I