Apideck Vault API
Browse all Apideck APIs✓ Official Vendor SpecIdentity AuthAuthenticationapiKey31 EndpointsREST
For Agents
Manage OAuth connections, consumers, custom field mappings, and request logs that authorise every other Apideck Unified API call.
Use for: Create a Vault session so the user can authorise a Salesforce connection, List all connections a specific consumer has set up, Refresh the OAuth access token for an existing connection, Validate that a connection is still active before calling a Unified API
Not supported: Does not call connector-native endpoints, manage end-user passwords, or run workflow logic — use only for OAuth connection lifecycle, consumers, custom mappings, and request logs.
The Apideck Vault API manages connections, OAuth flows, consumer records, and custom field mappings that power every Apideck Unified API call. Thirty-one endpoints cover creating Vault sessions for end-user authorisation UIs, listing and configuring connections per consumer, importing pre-existing tokens, validating and refreshing connection state, and exposing logs for debugging. Custom-mappings endpoints let teams map their internal field IDs to each connector's native fields so Unified API payloads pass through correctly. Authentication uses the Apideck Authorization header alongside x-apideck-app-id; consumer IDs identify which end user a connection belongs to.
Install Jentic One Beta
Connect the Vault API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Vault API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Vault API.
Create a Vault session URL via POST /vault/sessions for an end user to authorise a connection in-browser
List, create, get, update, and delete consumer records that scope connections to specific end users
Manage connections per consumer with /vault/connections/{unified_api}/{service_id} including update and delete
Import pre-existing OAuth tokens via POST /vault/connections/{unified_api}/{service_id}/import
Validate connection state and refresh access tokens with the /token and /validate sub-endpoints
List, create, get, update, and delete custom mappings between internal and connector-native field IDs
Pull request logs via GET /vault/logs and per-consumer request stats for debugging and usage tracking
Use Cases
Patterns agents use Vault API for, with concrete tasks.
★ End-User OAuth via Hosted Vault
Embed Apideck's hosted Vault UI into a SaaS product so end users can connect their own CRM, HRIS, or accounting system without the product building each OAuth flow itself. POST /vault/sessions returns a session URL that opens the Vault UI; the user picks a connector, completes OAuth, and the resulting connection is stored under their consumer ID. Subsequent Unified API calls use that consumer ID.
Create a Vault session for consumer_id 'cust_42' scoped to the 'crm' Unified API, return the session URL, and store the consumer_id for subsequent CRM calls
Connection Health Monitoring
Detect broken connections before Unified API calls fail. POST /vault/connections/{unified_api}/{service_id}/validate checks whether the stored OAuth token is still valid and POST /vault/connections/{unified_api}/{service_id}/token forces a refresh. A scheduled job that runs validate over each connection lets a SaaS product proactively prompt users to re-authorise.
List connections for consumer 'cust_42', call /validate on each, and for any that return inactive POST to /token to attempt refresh — then return the list of connections that still need user re-authorisation
Custom Field Mapping
Map an application's internal field IDs to each connector's native field names so Unified API payloads work correctly across customers using different CRMs. POST /vault/custom-mappings/{unified_api}/{service_id}/{target_field_id} creates a mapping; GET lists existing mappings; PATCH and DELETE manage updates and removals. Necessary for products that need to round-trip vendor-specific data through unified calls.
For consumer 'cust_42' on the 'crm' Unified API, list custom mappings, then POST a new mapping for target_field_id 'lead_score' to the connector-native field ID provided in the input
AI Agent Connection Management via Jentic
An AI agent helps a customer connect their CRM and then troubleshoots failures. Through Jentic, the agent searches 'create a vault session' to start the OAuth flow, then 'list vault logs' to inspect request failures. Jentic stores the Apideck Authorization and x-apideck-app-id values separately so the agent never holds raw credentials, even while debugging connection state.
Through Jentic, create a Vault session for the customer, return the URL, and after they authorise call /validate on the new connection to confirm it is active
Key Endpoints
31 endpoints — the apideck vault api manages connections, oauth flows, consumer records, and custom field mappings that power every apideck unified api call.
METHOD
PATH
DESCRIPTION
POST
/vault/sessions
Create a Vault session URL for end-user OAuth
GET
/vault/connections
List all connections
POST
/vault/connections/{unified_api}/{service_id}
Create a connection
POST
/vault/connections/{unified_api}/{service_id}/validate
Validate a connection's state
POST
/vault/connections/{unified_api}/{service_id}/token
Refresh the access token for a connection
POST
/vault/consumers
Create a consumer
GET
/vault/logs
List recent request logs for debugging
POST
/vault/custom-mappings/{unified_api}/{service_id}/{target_field_id}
Create a custom field mapping
POST
/vault/sessions
Create a Vault session URL for end-user OAuth
GET
/vault/connections
List all connections
POST
/vault/connections/{unified_api}/{service_id}
Create a connection
POST
/vault/connections/{unified_api}/{service_id}/validate
Validate a connection's state
POST
/vault/connections/{unified_api}/{service_id}/token
Refresh the access token for a connection
POST
/vault/consumers
Create a consumer
GET
/vault/logs
List recent request logs for debugging
POST
/vault/custom-mappings/{unified_api}/{service_id}/{target_field_id}
Create a custom field mapping
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Apideck application keys and x-apideck-app-id values are stored encrypted in the Jentic vault — and so are the per-consumer OAuth tokens that Apideck Vault itself manages, so neither Jentic agents nor your application code ever holds the upstream provider's secrets in plain text.
Intent-based discovery
Agents search by intent (for example 'create a vault session' or 'list vault connections') and Jentic returns the matching Vault operation with its input schema, so an agent can manage connections and debug failures without consulting Apideck docs.
Time to first call
Direct Apideck Vault integration: 1-2 days to wire session creation, redirect handling, and validate/refresh logic. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Vault API through Jentic.
What authentication does the Apideck Vault API use?
An apiKey scheme on the `Authorization` header with your Apideck application key, plus the `x-apideck-app-id` header. The `x-apideck-consumer-id` scopes operations to a specific end user. Through Jentic these values are stored encrypted in the vault and injected at execution time.
Can I import an existing OAuth token instead of running a new authorisation flow?
Yes. POST /vault/connections/{unified_api}/{service_id}/import takes an access token, refresh token, and metadata for an existing connection and stores it as if Vault had run the OAuth flow itself. Useful when migrating from a custom integration to Apideck.
What are the rate limits for the Apideck Vault API?
The OpenAPI spec does not publish per-endpoint rate limits. Apideck applies plan-based limits at unify.apideck.com — Vault calls (sessions, connections, custom mappings) count toward the same gateway quota as Unified API calls. See https://developers.apideck.com for your plan's numbers.
How do I create a Vault session through Jentic?
Install with `pip install jentic`, then run the search query 'create a vault session'. Jentic returns POST /vault/sessions — load its schema, supply consumer_id and the Unified APIs to scope the session to, then execute. The response includes a URL you redirect the end user to.
How do I detect that a user's connection has expired?
Call POST /vault/connections/{unified_api}/{service_id}/validate. If it reports the connection is no longer active, call POST /vault/connections/{unified_api}/{service_id}/token to attempt a refresh. If refresh fails, prompt the user to re-authorise via a fresh Vault session.
What are custom mappings used for in this API?
Custom mappings translate between the internal field IDs your product uses and each connector's native field ID. For example, your 'lead_score' might map to a custom Salesforce property — POST /vault/custom-mappings/{unified_api}/{service_id}/{target_field_id} stores the mapping so subsequent Unified API calls round-trip the value correctly.
GET STARTED