{"command":{"effect":"write","timeoutSeconds":120,"inputSchema":{"type":"object","description":"Updates credential metadata or rotates its write-only secret. See [vaults](https://developers.openai.com/api/docs/guides/agents-api/tools/vaults).","properties":{"path":{"type":"object","properties":{"vault_id":{"type":"string","minLength":0,"maxLength":1048576,"description":"The ID of the vault."},"credential_id":{"type":"string","minLength":0,"maxLength":1048576,"description":"The ID of the vault credential."}},"required":["vault_id","credential_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/RotateVaultCredentialParams"}},"required":["path","body"],"additionalProperties":false,"definitions":{"RotateVaultCredentialParams":{"type":"object","properties":{"auth":{"$ref":"#/definitions/RotateVaultCredentialAuthParam"},"metadata":{"type":"object","additionalProperties":{"type":"string","minLength":0,"maxLength":512},"propertyNames":{"type":"string","minLength":1,"maxLength":64},"minProperties":0,"maxProperties":16,"description":"Replaces all metadata. Omit to preserve it, or pass {} to clear it. Up to 16 string key-value pairs, with keys up to 64 and values up to 512 characters."}},"additionalProperties":false,"description":"Metadata, secret, expiry, and OAuth refresh scope updates for an existing vault credential. Supply at least one of `auth` or `metadata`.","minProperties":1,"examples":[{"metadata":{}}]},"RotateVaultCredentialAuthParam":{"oneOf":[{"$ref":"#/definitions/RotateVaultCredentialAuthParamMcpOauth"},{"$ref":"#/definitions/RotateVaultCredentialAuthParamStaticBearer"},{"$ref":"#/definitions/RotateVaultCredentialAuthParamEnvironmentVariable"}],"description":"Updates to a vault credential without changing its authentication method or destination configuration."},"RotateVaultCredentialAuthParamMcpOauth":{"type":"object","properties":{"type":{"type":"string","enum":["mcp_oauth"],"default":"mcp_oauth","description":"The type of the object. Always `mcp_oauth`."},"access_token":{"type":["string","null"],"minLength":0,"maxLength":1048576,"description":"A write-only replacement OAuth access token."},"expires_at":{"type":["string","null"],"minLength":0,"maxLength":1048576,"description":"The replacement expiry as an RFC 3339 timestamp, or `null` to clear it. Omitting this field preserves the expiry unless a new access token is supplied, in which case the expiry is cleared."},"refresh":{"anyOf":[{"$ref":"#/definitions/RotateMcpOauthRefreshParam"},{"type":"null"}],"description":"Optional write-only refresh-token and client-secret updates."}},"required":["type"],"additionalProperties":false,"description":"Rotate an OAuth credential for an HTTPS MCP destination."},"RotateVaultCredentialAuthParamStaticBearer":{"type":"object","properties":{"type":{"type":"string","enum":["static_bearer"],"default":"static_bearer","description":"The type of the object. Always `static_bearer`."},"token":{"type":"string","minLength":0,"maxLength":1048576,"description":"The replacement bearer token. This secret is never returned in credential resources."}},"required":["type","token"],"additionalProperties":false,"description":"Replace the bearer token for the credential's MCP server."},"RotateVaultCredentialAuthParamEnvironmentVariable":{"type":"object","properties":{"type":{"type":"string","enum":["environment_variable"],"default":"environment_variable","description":"The type of the object. Always `environment_variable`."},"secret_value":{"type":"string","minLength":1,"maxLength":1048576,"description":"The write-only replacement secret. Never returned in credential resources or supplied directly to sandbox code. Must be nonempty and must not contain carriage returns, newlines, or NUL bytes."}},"required":["type","secret_value"],"additionalProperties":false,"description":"Replace the secret for an OpenAI-hosted environment credential. The environment variable name and networking configuration remain unchanged."},"RotateMcpOauthRefreshParam":{"type":"object","properties":{"refresh_token":{"type":["string","null"],"minLength":0,"maxLength":1048576,"description":"The replacement refresh token. Omit or pass `null` to keep the stored token. This secret is never returned in resources."},"scope":{"type":["string","null"],"minLength":0,"maxLength":1048576,"description":"Replacement space-separated OAuth scopes for refresh requests. Omit to keep the scopes, or pass `null` to stop sending a scope parameter."},"token_endpoint_auth":{"anyOf":[{"$ref":"#/definitions/RotateMcpOauthTokenEndpointAuthParam"},{"type":"null"}],"description":"Client-secret updates for the existing token endpoint authentication method."}},"additionalProperties":false,"description":"Updates to an MCP credential's existing OAuth refresh configuration."},"RotateMcpOauthTokenEndpointAuthParam":{"oneOf":[{"$ref":"#/definitions/RotateMcpOauthTokenEndpointAuthParamClientSecretBasic"},{"$ref":"#/definitions/RotateMcpOauthTokenEndpointAuthParamClientSecretPost"}],"description":"Client-secret updates that preserve the credential's OAuth authentication method."},"RotateMcpOauthTokenEndpointAuthParamClientSecretBasic":{"type":"object","properties":{"type":{"type":"string","enum":["client_secret_basic"],"default":"client_secret_basic","description":"The type of the object. Always `client_secret_basic`."},"client_secret":{"type":["string","null"],"minLength":0,"maxLength":1048576,"description":"The replacement OAuth client secret. Omit or pass `null` to keep the stored secret. This secret is never returned in resources."}},"required":["type"],"additionalProperties":false,"description":"Updates credentials sent using HTTP Basic authentication."},"RotateMcpOauthTokenEndpointAuthParamClientSecretPost":{"type":"object","properties":{"type":{"type":"string","enum":["client_secret_post"],"default":"client_secret_post","description":"The type of the object. Always `client_secret_post`."},"client_secret":{"type":["string","null"],"minLength":0,"maxLength":1048576,"description":"The replacement OAuth client secret. Omit or pass `null` to keep the stored secret. This secret is never returned in resources."}},"required":["type"],"additionalProperties":false,"description":"Updates credentials sent in the token request body."}}},"name":"Update a vault credential","id":"openai.rotatevaultcredential","example":{"path":{"vault_id":"example","credential_id":"example"},"body":{"metadata":{}}},"maxRequests":1,"summary":false}}