List Credentials : MinionWare

Returns every stored credential -- name, type, principal, active/elevated flags, and any elevated-role findings from the last scan. The secret itself is never returned here or anywhere else in the API -- credentials are write-only by design; see Create a Credential for why.

Having trouble reaching the API, or logging in from another machine? See Network Access & Authentication Security -- by default the Api only answers localhost, and PowerShell needs an extra flag once it does answer elsewhere.

Order of Operations

Authenticate to the API.
Request the list.

The call

GET /api/credentials

No route parameters, no query parameters, no request body.

Permission needed: Credential.View.

C# example

var jsonOptions = new JsonSerializerOptions(JsonSerializerDefaults.Web);

// Step 1: Authenticate to the API.
using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var client = new HttpClient(handler) { BaseAddress = new Uri("http://your-minion-agent-server:5443") };
client.DefaultRequestHeaders.Add("X-App-Name", "MyIntegration");

// Step 2: Request the list.
var credentials = await client.GetFromJsonAsync<CredentialSummary[]>("/api/credentials", jsonOptions);
foreach (var cred in credentials!)
{
    Console.WriteLine($"{cred.CredentialId}: {cred.CredentialName} ({cred.CredentialTypeName}, principal {cred.Principal}), active = {cred.IsActive}, elevated = {cred.IsElevated}");
}

record CredentialSummary(int CredentialId, string CredentialName, byte CredentialTypeCode, string CredentialTypeName, string Principal, bool IsActive,
    bool IsElevated, string? TenantId, string? SubscriptionId, ElevatedRoleFinding[] ElevatedRoleFindings);
record ElevatedRoleFinding(string ServerName, string? DatabaseName, string RoleName);

Not on a domain machine? Swap in the app-account login from Calling the API From Your Own Code.

PowerShell example

# Step 1: Authenticate to the API.
$headers = @{ "X-App-Name" = "MyIntegration" }

# Step 2: Request the list. (-AllowUnencryptedAuthentication: PowerShell requires this for Windows auth over plain http to anything but localhost -- see "Network Access & Authentication Security".)
$credentials = Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/credentials" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
$credentials | ForEach-Object { "$($_.credentialId): $($_.credentialName) ($($_.credentialTypeName), principal $($_.principal)), active = $($_.isActive), elevated = $($_.isElevated)" }

What you get back

200 OK, an array:

[
    {
        "credentialId": 4,
        "credentialName": "SQLPROD01 Service Account",
        "credentialTypeCode": 0,
        "credentialTypeName": "WindowsUser",
        "principal": "CORP\\svc-minionagent",
        "isActive": true,
        "isElevated": true,
        "tenantId": null,
        "subscriptionId": null,
        "elevatedRoleFindings": [
            { "serverName": "SQLPROD01", "databaseName": null, "roleName": "sysadmin" }
        ]
    }
]

elevatedRoleFindings comes from the last elevated-role scan -- see Request an Elevated Role Scan. credentialTypeName is one of WindowsUser, SqlLogin, SmtpAuth, or AzureServicePrincipal.

Codes this call can return

See API Response Codes for what each one means in general. For this specific call:

200 -- the list, even if it's empty.
403 -- you don't have Credential.View.

There's no single-credential detail endpoint -- this list is the only way to read a credential's fields back. Filter it client-side if you need one by id or name.

List Credentials Print