> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get access bundle > Get an Agent Vault access bundle with its services ## OpenAPI ````yaml GET /api/v1/agent-vault/access-bundles/{accessBundleId} openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/agent-vault/access-bundles/{accessBundleId}: get: tags: - Agent Vault Access Bundles description: Get an Agent Vault access bundle with its services operationId: getAgentVaultAccessBundle parameters: - schema: type: string format: uuid in: path name: accessBundleId required: true description: The ID of the access bundle. responses: '200': description: Default Response content: application/json: schema: type: object properties: accessBundle: type: object properties: id: type: string format: uuid name: type: string description: type: string nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time services: type: array items: type: object properties: id: type: string format: uuid description: The ID of the service. accessBundleId: type: string format: uuid description: The ID of the access bundle. name: type: string description: The name of the service. type: type: string enum: - http - mcp description: >- The service type: `http` for an HTTP API, or `mcp` for a remote MCP server. Can't be changed after the service is created. serverUrl: type: string nullable: true description: >- The MCP server's full URL. Null for an `http` service. transport: type: string enum: - streamable-http - sse nullable: true description: >- How the agent talks to the MCP server: `streamable-http`, or `sse` for the legacy HTTP+SSE transport. Null for an `http` service. hostPattern: type: string description: >- A comma-separated set of hosts this service covers, each optionally with a port (defaults to `443`). A leading `*.` wildcard matches exactly one label. Paths are not supported. allowedMethods: type: array items: type: string enum: - GET - HEAD - POST - PUT - PATCH - DELETE - OPTIONS nullable: true description: >- The HTTP methods this service allows. Null allows every method. Anything else is refused by the proxy with a 403. allowedPathPrefixes: type: array items: type: string nullable: true description: >- The path prefixes this service allows, matched on whole segments, so `/repos` covers `/repos/octo` but not `/repositories`. `null` allows every path. A path-restricted service also refuses any request whose path would have to be normalised to judge. allowedTools: type: array items: type: string nullable: true description: >- The MCP tools agents can call through this service, by exact, case-sensitive name. Each name is 1 to 128 letters, numbers, underscores (_), hyphens (-), or dots (.). `null` allows every tool. The proxy refuses a call to any other tool and leaves it out of the server's tool list. MCP services only. credential: anyOf: - type: object properties: type: type: string enum: - bearer headerName: type: string description: >- The header the credential is written to. Defaults to `Authorization`. headerPrefix: type: string description: >- Written before the credential value, separated by one space. Leave empty for a header that carries the value alone, such as DD-API-KEY. Can't contain `{{` or `}}`. On update a field left out keeps its stored value, so send an empty string to clear the prefix when changing the header. memberProvidedFields: type: array items: type: string enum: - credential-value description: >- The credential fields each member sets for themselves: credential-value (a bearer token, a basic password, or an OAuth sign-in) and credential-username. Empty when the admin sets the whole credential. required: - type - headerName - headerPrefix - memberProvidedFields additionalProperties: false title: Bearer - type: object properties: type: type: string enum: - basic memberProvidedFields: type: array items: type: string enum: - credential-value - credential-username description: >- The credential fields each member sets for themselves: credential-value (a bearer token, a basic password, or an OAuth sign-in) and credential-username. Empty when the admin sets the whole credential. required: - type - memberProvidedFields additionalProperties: false title: Basic Auth - type: object properties: type: type: string enum: - passthrough required: - type additionalProperties: false title: Pass-through - type: object properties: type: type: string enum: - oauth memberProvidedFields: type: array items: type: string enum: - credential-value description: >- The credential fields each member sets for themselves: credential-value (a bearer token, a basic password, or an OAuth sign-in) and credential-username. Empty when the admin sets the whole credential. status: type: string enum: - connected - needs-reauthorization - needs-additional-scopes description: >- Whether the OAuth connection works: `connected`, `needs-reauthorization` (the tokens can no longer be refreshed), or `needs-additional-scopes` (the MCP server asked for scopes the connection lacks). Absent when each member signs in for themselves. issuer: type: string description: >- The OAuth authorization server that issued the tokens. registration: type: string enum: - dynamic - manual description: >- With the sign-in left to members: `manual` when every member signs in with your own OAuth app, `dynamic` when each sign-in registers its own client. clientId: type: string nullable: true description: >- With the sign-in left to members and your own OAuth app: its client ID. grantedScopes: type: array items: type: string description: >- The scopes the authorization server granted. requiredScopes: type: array items: type: string description: >- Scopes the MCP server asked for that the connection lacks. Reauthorize to request them. expiresAt: type: string nullable: true description: >- When the current access token expires, or null if the server didn't say. Not returned to Agent Vault members. authorizedAt: type: string nullable: true description: >- When the connection was last authorized. Not returned to Agent Vault members. lastError: type: string nullable: true description: >- The last refresh failure, if any. Never contains a token. Not returned to Agent Vault members. required: - type - memberProvidedFields - issuer - grantedScopes - requiredScopes additionalProperties: false title: OAuth customHeaders: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the custom header. Send it to change that header in place. Omit it to match by name. name: type: string description: >- The name of the header, which must not be the credential's own header. prefix: type: string description: >- Written before the header value, separated by one space. Leave empty to send the value alone. Can't contain `{{` or `}}`. required: - id - name - prefix additionalProperties: false description: >- Additional headers the proxy attaches to every request to this service, on top of the credential. Send the full list. A header you leave out is deleted. Send a header's `id` to change it in place and keep its stored value. Without an `id`, a header is matched by name. substitutions: type: array items: type: object properties: id: type: string format: uuid description: >- The ID of the substitution. Send it to change that substitution in place. Omit it to match by placeholder. placeholder: type: string description: >- The fake value your agent already sends. The proxy replaces it with the real secret. Matched as a plain string, so a distinctive placeholder is worth choosing. Can't contain `{{` or `}}`. surfaces: type: array items: type: string enum: - path - query - header - body description: >- Where in the request to look for the placeholder: path, query, header or body. required: - id - placeholder - surfaces additionalProperties: false description: >- Placeholders the proxy swaps for a real secret before forwarding. Send the full list. A substitution you leave out is deleted. Send a substitution's `id` to change it in place and keep its stored value. Without an `id`, it is matched by its placeholder. variableReferences: type: array items: anyOf: - type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. field: type: string enum: - credential-value - credential-username description: >- Which value uses the variable: credential-value (a bearer token or a basic password), credential-username, custom-header or substitution. required: - variableId - key - field additionalProperties: false title: Credential - type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. field: type: string enum: - custom-header description: >- Which value uses the variable: credential-value (a bearer token or a basic password), credential-username, custom-header or substitution. customHeaderId: type: string format: uuid description: >- The custom header whose value uses the variable. required: - variableId - key - field - customHeaderId additionalProperties: false title: Custom Header - type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. field: type: string enum: - substitution description: >- Which value uses the variable: credential-value (a bearer token or a basic password), credential-username, custom-header or substitution. substitutionId: type: string format: uuid description: >- The substitution whose value uses the variable. required: - variableId - key - field - substitutionId additionalProperties: false title: Substitution description: >- The global variables this service's credential, custom header values and substitution values use. Not returned to Agent Vault members, since only admins can see global variables. A member's own personal variables are listed under personalValues. createdAt: type: string format: date-time description: When the service was added to the access bundle. updatedAt: type: string format: date-time description: When the service was last changed. personalValues: type: object properties: isConfigured: type: boolean description: >- Whether you have set every value this service requires from you. Until you do, the proxy refuses this service's requests from your sessions. fields: type: array items: type: object properties: field: type: string enum: - credential-value - credential-username description: >- Which value: credential-value (a bearer token, a basic password, or an OAuth sign-in) or credential-username (a basic username). isSet: type: boolean description: Whether you have set this value. updatedAt: type: string format: date-time nullable: true description: >- When this value last changed, or null if you haven't set it. variableReferences: type: array items: type: object properties: variableId: type: string format: uuid description: The ID of the variable. key: type: string description: >- The name values use to refer to the variable, as `{{KEY}}`. Starts with a letter and uses only upper case letters, numbers and underscores. required: - variableId - key additionalProperties: false description: >- Your personal variables that this value uses. oauth: type: object properties: status: type: string enum: - connected - needs-reauthorization - needs-additional-scopes description: >- `connected`, `needs-reauthorization` (your login is no longer accepted, so connect again; until then your sessions can't use the service), or `needs-additional-scopes` (the MCP server asked for scopes your connection lacks; connect again to grant them). issuer: type: string description: >- The OAuth authorization server that issued the tokens. grantedScopes: type: array items: type: string description: >- The scopes the authorization server granted. requiredScopes: type: array items: type: string description: >- Scopes the MCP server asked for that your connection lacks. Connect again to grant them. expiresAt: type: string nullable: true description: >- When your current access token expires, or null if the server didn't say. authorizedAt: type: string nullable: true description: When you last connected your account. lastError: type: string nullable: true description: >- The last refresh failure for your connection, if any. Never contains a token. required: - status - issuer - grantedScopes - requiredScopes - expiresAt - authorizedAt - lastError additionalProperties: false nullable: true description: >- For the credential-value field of a service that leaves its OAuth sign-in to members: your connection's status, or null if you haven't connected. Null for every other field. required: - field - isSet - updatedAt - variableReferences - oauth additionalProperties: false description: >- Each value the service requires from you, and whether you have set it. required: - isConfigured - fields additionalProperties: false description: >- Your personal values for the service, or null if the service leaves no fields to its members. Only you can see these, and a stored value never comes back. nullable: true required: - id - accessBundleId - name - type - serverUrl - transport - hostPattern - allowedMethods - allowedPathPrefixes - allowedTools - credential - customHeaders - substitutions - createdAt - updatedAt - personalValues additionalProperties: false required: - id - name - createdAt - updatedAt - services additionalProperties: false required: - accessBundle additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.