> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manus.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# team.credential.list

> Lists API credentials for the authenticated user's team. `clientSecret` is **never** returned by list operations.

<sup>Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).</sup>

<Tip>
  **Auth:** Browser session token (Bearer).

  **`clientSecret` is never returned by list operations** — it is only available from [team.credential.create](/enterprise/v1/team.credential.create).

  **Pagination:** Page-based. `page` starts at 1; `pageSize` is 1–100.

  **`lastUsedAt`:** Refreshed every time the credential is used to mint an OAuth token via [oauth.token](/enterprise/v1/oauth.token). Use it to identify stale credentials worth revoking.

  **`total` is a string:** Per proto3 int64 conventions, `total` is serialized as a JSON string (e.g. `"2"`).
</Tip>


## OpenAPI

````yaml POST /team.v1.TeamManagementService/ListApiCredentials
openapi: 3.1.0
info:
  title: Manus Team User Management OpenAPI v1
  description: >-
    API for enterprise tenant administrators to manage team members
    programmatically (SailPoint, Okta, custom IDP integrations). Two surfaces:
    (1) credential management RPCs at `/team.v1.TeamManagementService/*` use a
    session token; (2) REST endpoints under `/api/user/manage/v1/*` use an OAuth
    2.0 Client Credentials access token issued by the credentials. v2 of this
    API ([User Management v2](/enterprise/v2/user-management-overview))
    consolidates everything behind `X-API-Key` — prefer it for new integrations.
  version: 1.0.0
servers:
  - url: https://api.manus.im
security: []
paths:
  /team.v1.TeamManagementService/ListApiCredentials:
    post:
      summary: ListApiCredentials
      description: >-
        Lists API credentials for the authenticated user's team. `clientSecret`
        is **never** returned by list operations.
      operationId: team.v1.TeamManagementService.ListApiCredentials
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - page
                - pageSize
              properties:
                page:
                  type: integer
                  format: int32
                  description: Page number, starting at 1.
                  default: 1
                  example: 1
                pageSize:
                  type: integer
                  format: int32
                  description: Records per page (1–100).
                  default: 10
                  example: 10
      responses:
        '200':
          description: Credentials retrieved successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  credentials:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiCredential'
                  total:
                    type: string
                    description: >-
                      Total number of credentials. Serialized as a string per
                      proto3 int64 conventions.
                    example: '2'
      security:
        - BearerSessionAuth: []
components:
  schemas:
    ApiCredential:
      type: object
      description: >-
        An API credential. `clientSecret` is intentionally omitted — it is only
        returned by
        [team.v1.TeamManagementService/CreateApiCredential](/enterprise/v1/team.credential.create).
      properties:
        clientId:
          type: string
          example: tm_RRa7dgjD_AFhru6AnZJ8W
        name:
          type: string
          example: SailPoint Production
        createdAt:
          type: string
          format: date-time
          example: '2026-01-15T10:30:00Z'
        lastUsedAt:
          type: string
          format: date-time
          description: >-
            Last time this credential was used to mint an OAuth token. Omitted
            if never used.
          example: '2026-01-20T08:45:00Z'
  securitySchemes:
    BearerSessionAuth:
      type: http
      scheme: bearer
      description: >-
        Browser session token. Open Manus, find any authenticated request in
        DevTools → Network, and copy the value after `Bearer ` from the
        `Authorization` header. Used only for credential management RPCs.

````