> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create service > Create a service in an Agent Vault access bundle ## OpenAPI ````yaml POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/agent-vault/access-bundles/{accessBundleId}/services: post: tags: - Agent Vault Access Bundles description: Create a service in an Agent Vault access bundle operationId: createAgentVaultService parameters: - schema: type: string format: uuid in: path name: accessBundleId required: true description: The ID of the access bundle. requestBody: required: true content: application/json: schema: type: object properties: name: type: string minLength: 1 maxLength: 64 description: The name of the service. hostPattern: type: string maxLength: 1024 description: >- A comma-separated set of hosts this service covers, each optionally with a port (defaults to `443`). A leading `*.` wildcard matches exactly one label. Paths are not supported. allowedMethods: type: array items: type: string enum: - GET - HEAD - POST - PUT - PATCH - DELETE - OPTIONS minItems: 1 maxItems: 7 nullable: true description: >- The HTTP methods this service allows. Null allows every method. Anything else is refused by the proxy with a 403. allowedPathPrefixes: type: array items: type: string minItems: 1 maxItems: 20 nullable: true description: >- The path prefixes this service allows, matched on whole segments, so `/repos` covers `/repos/octo` but not `/repositories`. `null` allows every path. A path-restricted service also refuses any request whose path would have to be normalised to judge. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9!#$%&'*+.^_`|~-]+$ description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string maxLength: 64 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: The secret. Never returned once saved. required: - type - value additionalProperties: false title: Bearer - type: object properties: type: type: string enum: - basic username: type: string maxLength: 256 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The username half of the basic credential. May be empty if a password is set. Never returned once saved, since some APIs put the whole key here. password: type: string maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The password half of the basic credential. May be empty if a username is set, for APIs that carry the whole key in the username. Never returned once saved. required: - type - username - password additionalProperties: false title: Basic Auth - type: object properties: type: type: string enum: - passthrough required: - type additionalProperties: false title: Pass-through customHeaders: type: array items: type: object properties: name: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9!#$%&'*+.^_`|~-]+$ description: >- The name of the header, which must not be the credential's own header. prefix: type: string maxLength: 64 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Written before the header value, separated by one space. Leave empty to send the value alone. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: The header value. Never returned once saved. required: - name - value additionalProperties: false maxItems: 20 description: >- Additional headers the proxy attaches to every request to this service, on top of the credential. Send the full list. A header you leave out is deleted. Send a header's `id` to change it in place and keep its stored value. Without an `id`, a header is matched by name. substitutions: type: array items: type: object properties: placeholder: type: string minLength: 1 maxLength: 255 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The fake value your agent already sends. The proxy replaces it with the real secret. Matched as a plain string, so a distinctive placeholder is worth choosing. surfaces: type: array items: type: string enum: - path - query - header - body minItems: 1 maxItems: 4 description: >- Where in the request to look for the placeholder: path, query, header or body. value: type: string minLength: 1 maxLength: 8192 pattern: ^[^\x00-\x1f\x7f]*$ description: >- The real value the placeholder is replaced with. Never returned once saved. required: - placeholder - surfaces - value additionalProperties: false maxItems: 20 description: >- Placeholders the proxy swaps for a real secret before forwarding. Send the full list. A substitution you leave out is deleted. Send a substitution's `id` to change it in place and keep its stored value. Without an `id`, it is matched by its placeholder. required: - name - hostPattern - credential additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: service: type: object properties: id: type: string format: uuid description: The ID of the service. accessBundleId: type: string format: uuid description: The ID of the access bundle. name: type: string description: The name of the service. hostPattern: type: string description: >- A comma-separated set of hosts this service covers, each optionally with a port (defaults to `443`). A leading `*.` wildcard matches exactly one label. Paths are not supported. allowedMethods: type: array items: type: string enum: - GET - HEAD - POST - PUT - PATCH - DELETE - OPTIONS nullable: true description: >- The HTTP methods this service allows. Null allows every method. Anything else is refused by the proxy with a 403. allowedPathPrefixes: type: array items: type: string nullable: true description: >- The path prefixes this service allows, matched on whole segments, so `/repos` covers `/repos/octo` but not `/repositories`. `null` allows every path. A path-restricted service also refuses any request whose path would have to be normalised to judge. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. required: - type - headerName - headerPrefix additionalProperties: false title: Bearer - type: object properties: type: type: string enum: - basic required: - type additionalProperties: false title: Basic Auth - type: object properties: type: type: string enum: - passthrough required: - type additionalProperties: false title: Pass-through customHeaders: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the custom header. Send it to change that header in place. Omit it to match by name. name: type: string description: >- The name of the header, which must not be the credential's own header. prefix: type: string description: >- Written before the header value, separated by one space. Leave empty to send the value alone. required: - id - name - prefix additionalProperties: false description: >- Additional headers the proxy attaches to every request to this service, on top of the credential. Send the full list. A header you leave out is deleted. Send a header's `id` to change it in place and keep its stored value. Without an `id`, a header is matched by name. substitutions: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the substitution. Send it to change that substitution in place. Omit it to match by placeholder. placeholder: type: string description: >- The fake value your agent already sends. The proxy replaces it with the real secret. Matched as a plain string, so a distinctive placeholder is worth choosing. surfaces: type: array items: type: string enum: - path - query - header - body description: >- Where in the request to look for the placeholder: path, query, header or body. required: - id - placeholder - surfaces additionalProperties: false description: >- Placeholders the proxy swaps for a real secret before forwarding. Send the full list. A substitution you leave out is deleted. Send a substitution's `id` to change it in place and keep its stored value. Without an `id`, it is matched by its placeholder. createdAt: type: string format: date-time description: When the service was added to the access bundle. updatedAt: type: string format: date-time description: When the service was last changed. required: - id - accessBundleId - name - hostPattern - allowedMethods - allowedPathPrefixes - credential - customHeaders - substitutions - createdAt - updatedAt additionalProperties: false required: - service additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false ````