Endpoint
POST /v3/onboarding/managed_accounts/credentials/get
Authentication and target
A user-scoped owner credential is required. The selected managed account must be visible through the user’s active Master Account relationship. This route does not become accessible merely by adding account-targeting headers. The selected account must be active. PA does not have independent credentials. Do not send X-ISPB or X-Account-Number. This user-only management route rejects account-targeting headers. The account selector documented below belongs in the JSON request body.Request body
Send exactly one selector:Success data
Acredential object with api_key, api_secret, app_id, env, status, scope, credential_version, rotated_at, reference_id, and account.
Behavior and validation
If no active credential configuration exists, the endpoint can provision one. A newly createdapi_secret is returned in full once; later reads mask it. Store a newly returned secret immediately in secure secret storage and never log it. The current scope is openapi:transactions.
Errors
Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include:invalid_parameterfor an invalid selector.invalid_userwhen the account is not active.permission_deniedfor PA or an account outside the owner’s visibility.