Create a vault - Qoder CN Series - Alibaba Cloud Documentation Center

Creates a new vault. A vault securely stores access credentials for MCP servers, and must be created with at least one credential.

Request headers

Header	Required	Description
`Authorization`	Yes	Bearer token used to authenticate the request. Format: `Bearer $QODER_PAT`.
`Content-Type`	Yes	Must be `application/json`.

Request body

Field	Type	Required	Description
`display_name`	string	Yes	Human-readable display name for the vault.
`credentials`	array	Yes	Credentials to attach on creation. Must contain at least one credential object.

Each element of the credentials array has the following fields:

Field	Type	Required	Description
`mcp_server_url`	string	Yes	URL of the MCP server this credential authorizes.
`protocol`	string	Yes	Transport protocol. One of `sse` or `streamable_http`.
`type`	string	Yes	Credential type. Currently only `static_bearer` is supported.
`access_token`	string	Yes	Access token used by the MCP server. Required when `type` is `static_bearer`.

Example request

curl -X POST "https://api.qoder.com.cn/api/v1/cloud/vaults" \
  -H "Authorization: Bearer $QODER_PAT" \
  -H "Content-Type: application/json" \
  -d '{
    "display_name": "my-mcp-vault",
    "credentials": [
      {
        "mcp_server_url": "https://example.com/mcp",
        "protocol": "sse",
        "type": "static_bearer",
        "access_token": "your-access-token"
      }
    ]
  }'

Example response

HTTP 201 Created

{
  "id": "vault_019e3bb940277f0db05ab74291acf6ef",
  "type": "vault",
  "display_name": "my-mcp-vault",
  "status": "active",
  "metadata": {},
  "credentials": [
    {
      "id": "vcred_019e3bb940297658a632dbf920057eff",
      "vault_id": "vault_019e3bb940277f0db05ab74291acf6ef",
      "mcp_server_url": "https://example.com/mcp",
      "protocol": "sse",
      "type": "static_bearer",
      "status": "active",
      "created_at": "2026-05-18T15:34:16.876188Z",
      "updated_at": "2026-05-18T15:34:16.876188Z"
    }
  ],
  "created_at": "2026-05-18T15:34:16.874877Z",
  "updated_at": "2026-05-18T15:34:16.874877Z"
}

Errors

HTTP	Type	Trigger
400	`invalid_request_error`	Missing `credentials` array: `At least one credential is required when creating a vault.`
400	`invalid_request_error`	Missing `access_token`: `Field 'access_token' is required for static_bearer type.`
401	`authentication_error`	The authentication token is missing or invalid.

For the full error envelope, see Errors.