API reference · Identity and tokens

List how the caller signs in: password, second factors, passkeys, recovery codes

GET/v1/credentials

Permission: authenticated: any signed-in caller or API token
Operation: iam.credentials.list

Response 200

Field	Type	Required	Notes
`items`	array of object	yes
`items[].id`	string	yes	1 to 100 characters
`items[].type`	string	yes	one of `"password"`, `"authenticator_app"`, `"security_key"`, `"passkey"`, `"recovery_codes"`
`items[].label`	string or null	yes
`items[].createdAt`	string (date-time)	yes	UTC, ISO 8601.
`items[].removable`	boolean	yes

Request shaped from the schemas

curl

curl 'https://api.obhut.io/v1/credentials' \
  -H "Authorization: Bearer $OBHUT_TOKEN"

Response 200

{
  "items": [
    {
      "id": "string",
      "type": "password",
      "label": "string",
      "createdAt": "2026-01-01T12:00:00.000Z",
      "removable": true
    }
  ]
}