Create Workflow Credential
POST/api/automation/workflow-credentials
Creates a new workflow credential. Secret fields listed in CredentialTypeEnum::secretFields are redacted in the response fields object.
Any valid API token can call this endpoint — no specific scope required. Manage tokens.
Validation (StoreWorkflowCredentialRequest):
name— required, string, max 128type— required, string, must be a validCredentialTypeEnum:basic_auth,api_key,bearer_token,ftp,sftp,google_oauth,webhook_tokendata— required, array (shape varies by type)
Expected data shape per type:
basic_auth:{ username, password }api_key:{ key, header?: "X-API-Key" }bearer_token:{ token }ftp/sftp:{ host, port, username, password?, privateKey?, passphrase? }google_oauth:{ accessToken, refreshToken, clientId, clientSecret }webhook_token:{ token }
Response: 201 Created with workflow credential object:
{
"data": {
"uuid": "...",
"name": "...",
"type": "sftp",
"typeLabel": "SFTP",
"fields": { "host": "...", "port": 22, "username": "...", "password": "********", "privateKey": "********", "passphrase": "********" },
"createdBy": { "id": 1, "name": "Jane Doe" },
"createdAt": "2026-04-16T12:34:56+00:00",
"updatedAt": "2026-04-16T12:34:56+00:00"
}
}
Route name: automation.credentials.store
Request
Responses
- 200
- 401
- 403
- 422
- 429
Successful response
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.