Vaults
Create a vault
Register a 1Password vault, or create an H-hosted one, so agents can sign in without secrets entering their context.
POST
/
api
/
v2
/
vaults
from hai_agents import Client, VaultCreateRequestProviderConfig_Internal, VaultCreateRequestProviderConfig_Onepassword
client = Client()
vault = client.vaults.create_vault(
name="prod-1password",
provider_config=VaultCreateRequestProviderConfig_Onepassword(op_vault_id="abcd1234efgh5678"),
token="ops_eyJ...",
)
print(vault.id)
# An H-hosted vault takes no token.
internal_vault = client.vaults.create_vault(name="team-logins", provider_config=VaultCreateRequestProviderConfig_Internal())
import { HaiAgentsClient } from "hai-agents";
const client = new HaiAgentsClient();
const vault = await client.vaults.createVault({
name: "prod-1password",
providerConfig: { provider: "onepassword", opVaultId: "abcd1234efgh5678" },
token: "ops_eyJ...",
});
console.log(vault.id);
// An H-hosted vault takes no token.
const internalVault = await client.vaults.createVault({ name: "team-logins", providerConfig: { provider: "internal" } });
curl -X POST https://agp.eu.hcompany.ai/api/v2/vaults \
-H "Authorization: Bearer $HAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"token": "ops_eyJ..."
}'
{
"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"org_id": "1c9a2f6e-4b3d-4a8c-9e5f-7d6b8a0c1e2f",
"created_by": "8d3e5a71-2c4b-4f6e-9a0d-1b2c3d4e5f60",
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"created_at": "2026-05-07T14:30:00Z",
"updated_at": "2026-05-07T14:30:00Z"
}
Behavior
A 1Password service account token travels in clear text inside the body. Send it only over HTTPS and never log the request. A vault holds the credentials agents sign in with. Pick a provider:onepassword: record which 1Password vault to read (op_vault_id) and a service account token that grants access to it. The token is validated against 1Password before it is stored, and is never returned by any endpoint.internal: an H-hosted vault, with no token. Add its credentials with Create an item.
Request body
string
required
Human-readable label for the config. Unique within your organization.
object
required
string
The 1Password service account token granting access to the vault. Required for
onepassword, rejected for internal. Write-only: validated before storage and omitted from every response.Response
201 with the created vault object.
from hai_agents import Client, VaultCreateRequestProviderConfig_Internal, VaultCreateRequestProviderConfig_Onepassword
client = Client()
vault = client.vaults.create_vault(
name="prod-1password",
provider_config=VaultCreateRequestProviderConfig_Onepassword(op_vault_id="abcd1234efgh5678"),
token="ops_eyJ...",
)
print(vault.id)
# An H-hosted vault takes no token.
internal_vault = client.vaults.create_vault(name="team-logins", provider_config=VaultCreateRequestProviderConfig_Internal())
import { HaiAgentsClient } from "hai-agents";
const client = new HaiAgentsClient();
const vault = await client.vaults.createVault({
name: "prod-1password",
providerConfig: { provider: "onepassword", opVaultId: "abcd1234efgh5678" },
token: "ops_eyJ...",
});
console.log(vault.id);
// An H-hosted vault takes no token.
const internalVault = await client.vaults.createVault({ name: "team-logins", providerConfig: { provider: "internal" } });
curl -X POST https://agp.eu.hcompany.ai/api/v2/vaults \
-H "Authorization: Bearer $HAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"token": "ops_eyJ..."
}'
{
"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"org_id": "1c9a2f6e-4b3d-4a8c-9e5f-7d6b8a0c1e2f",
"created_by": "8d3e5a71-2c4b-4f6e-9a0d-1b2c3d4e5f60",
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"created_at": "2026-05-07T14:30:00Z",
"updated_at": "2026-05-07T14:30:00Z"
}
Errors
| Status | Cause |
|---|---|
400 | 1Password rejected the token (it could not access op_vault_id). |
409 | A vault with this name already exists in your organization. |
422 | Body failed validation: a onepassword vault without a token, an internal vault with one, or an unknown provider. |
Was this page helpful?
⌘I
from hai_agents import Client, VaultCreateRequestProviderConfig_Internal, VaultCreateRequestProviderConfig_Onepassword
client = Client()
vault = client.vaults.create_vault(
name="prod-1password",
provider_config=VaultCreateRequestProviderConfig_Onepassword(op_vault_id="abcd1234efgh5678"),
token="ops_eyJ...",
)
print(vault.id)
# An H-hosted vault takes no token.
internal_vault = client.vaults.create_vault(name="team-logins", provider_config=VaultCreateRequestProviderConfig_Internal())
import { HaiAgentsClient } from "hai-agents";
const client = new HaiAgentsClient();
const vault = await client.vaults.createVault({
name: "prod-1password",
providerConfig: { provider: "onepassword", opVaultId: "abcd1234efgh5678" },
token: "ops_eyJ...",
});
console.log(vault.id);
// An H-hosted vault takes no token.
const internalVault = await client.vaults.createVault({ name: "team-logins", providerConfig: { provider: "internal" } });
curl -X POST https://agp.eu.hcompany.ai/api/v2/vaults \
-H "Authorization: Bearer $HAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"token": "ops_eyJ..."
}'
{
"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"org_id": "1c9a2f6e-4b3d-4a8c-9e5f-7d6b8a0c1e2f",
"created_by": "8d3e5a71-2c4b-4f6e-9a0d-1b2c3d4e5f60",
"name": "prod-1password",
"provider_config": {"provider": "onepassword", "op_vault_id": "abcd1234efgh5678"},
"created_at": "2026-05-07T14:30:00Z",
"updated_at": "2026-05-07T14:30:00Z"
}