> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pagsmile.com.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Managed Account Credential

> Retrieve or provision managed-account credentials.

Retrieve account-level Open API credentials for an active MOR or VA managed account.

### Endpoint

`POST /v3/onboarding/managed_accounts/credentials/get`

### Authentication and target

A user-scoped owner credential is required. The selected managed account must be visible through the user's active Master Account relationship. This route does not become accessible merely by adding account-targeting headers. The selected account must be active. PA does not have independent credentials.

Do not send X-ISPB or X-Account-Number. This user-only management route rejects account-targeting headers. The account selector documented below belongs in the JSON request body.

### Request body

Send exactly one selector:

| Field          | Required    | Description                                    |
| -------------- | ----------- | ---------------------------------------------- |
| `reference_id` | Conditional | Managed-account merchant reference.            |
| `account`      | Conditional | Object containing `ispb` and `account_number`. |

### Success data

A `credential` object with `api_key`, `api_secret`, `app_id`, `env`, `status`, `scope`, `credential_version`, `rotated_at`, `reference_id`, and `account`.

### Behavior and validation

If no active credential configuration exists, the endpoint can provision one. A newly created `api_secret` is returned in full once; later reads mask it. Store a newly returned secret immediately in secure secret storage and never log it. The current scope is `openapi:transactions`.

### Errors

Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include:

* `invalid_parameter` for an invalid selector.
* `invalid_user` when the account is not active.
* `permission_denied` for PA or an account outside the owner's visibility.

### Example request

```bash theme={null}
curl --request POST "${BASE_URL}/v3/onboarding/managed_accounts/credentials/get" \
  --header "Content-Type: application/json" \
  --header "X-Client-ID: ${CLIENT_ID}" \
  --header "X-Timestamp: ${TIMESTAMP_MS}" \
  --header "X-Nonce: ${NONCE}" \
  --header "X-Signature: ${SIGNATURE}" \
  --data '{"reference_id":"managed-va-demo-001"}'
```

### Example response

```json theme={null}
{"code":200,"message":"success","data":{"credential":{"api_key":"demo_api_key_001","api_secret":"demo_secret_returned_once","status":"active","scope":"openapi:transactions","credential_version":1,"reference_id":"managed-va-demo-001"}},"time":1710002400000}
```