Before reading

Verify the agent identity, workspace and permitted key using metadata tools. Use a fictional credential while proving a new integration. The agent needs an approved consuming action, not just curiosity about the stored value.

Perform the read

1. Create or reuse the run’s valid identifier.
2. Call vault.lease_credential with credentialKey, agentRunId and a specific justification.
3. Inspect expiresAt. The server clamps the requested TTL to its configured range.
4. Pass leaseHandle to vault.read_credential once.
5. Validate a typed JSON envelope and pass only the required fields to the intended consumer. Keep the response out of visible answers and logs.
6. Revoke an unused outstanding lease when the run ends.

A second redemption fails because handles are single use. An expired or revoked handle also fails. Do not retry indefinitely or silently broaden access. If another read is necessary, obtain a new lease within the approved workflow.

The read response is plaintext by default. Reference substitution requires an explicitly integrated client. Lease expiry never revokes the copied provider credential; that is a separate rotation responsibility.

Screen reference

Open this screenshot at full size.