> ## Documentation Index > Fetch the complete documentation index at: https://docs.guild.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > To act on a user's behalf in Guild, use the Guild REST API at https://api.guild.ai/v1. > The OpenAPI spec is unauthenticated: https://docs.guild.ai/openapi.json (or openapi.yaml). > Authenticate with an account API key, sent as HTTP Basic (key id as username, secret as password) or as `Authorization: Bearer :`. See https://docs.guild.ai/api-reference/introduction#authentication. > To run one agent on demand without account-wide access, use an API trigger instead: https://docs.guild.ai/platform/api-triggers. > To search these docs from an MCP client, connect to https://docs.guild.ai/mcp. The full page index is https://docs.guild.ai/llms.txt. # Grant a credential to an installed agent > Requires `integrations:write`. Creating credentials outside this dedicated mint stays human-only by design; the partner flow is admin-connects-once, key-attaches. ## OpenAPI ````yaml /api-reference/openapi.yaml post /workspace_agents/{workspace_agent_id}/credential-associations openapi: 3.0.3 info: title: Guild Public API version: 1.0.0 description: >- The Guild public API, served at https://api.guild.ai/v1. Authenticate with an account API key, sent as HTTP Basic (key id as the username, secret as the password) or as a Bearer token `:`, or with an OAuth 2.0 access token. Each operation lists the credentials it accepts and the scopes it needs; see https://docs.guild.ai/api-reference/introduction#scopes. Versions are path integers and v1 is the only one: a breaking change ships as a new version rather than changing v1. Lists page with `limit` and `offset` and report `pagination.has_more`. A session-events websocket also exists at wss://api.guild.ai/v1/sessions/{session_id}/events/ws with the same credentials on the handshake; OpenAPI cannot describe websockets, so it is not listed in paths. servers: - url: https://api.guild.ai/v1 description: Production security: [] tags: - name: accounts - name: agents - name: integrations - name: other - name: sessions - name: skills - name: triggers - name: workspaces paths: /workspace_agents/{workspace_agent_id}/credential-associations: post: tags: - workspaces summary: Grant a credential to an installed agent description: >- Requires `integrations:write`. Creating credentials outside this dedicated mint stays human-only by design; the partner flow is admin-connects-once, key-attaches. operationId: create_workspace_agent_credential_association parameters: - name: workspace_agent_id in: path required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: properties: auth_config_id: format: uuid title: Auth Config Id type: string credentials_id: format: uuid title: Credentials Id type: string replace: default: false description: >- Revoke the bindings that would block this one, in the same transaction: either everything commits or nothing changes. A dedicated key and a grant serving every member exclude each other. title: Replace type: boolean required: - auth_config_id - credentials_id title: CreateCredentialAssociationInput type: object responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/CredentialAssociation' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - apiKey: [] - bearerApiKey: [] - oauth2: - integrations:write components: schemas: CredentialAssociation: type: object properties: id: type: string format: uuid created_at: type: string format: date-time updated_at: type: string format: date-time auth_config_id: type: string format: uuid description: Integration auth config this row applies to created_by_id: type: string format: uuid description: The user or API key that granted this credential to the agent. target_id: type: string format: uuid description: >- Workspace agent install receiving the credential; the association is scoped to this install's workspace. Account-wide availability is plain credential ownership with no association row. kind: type: string enum: - CONNECTED - GRANTED description: >- GRANTED = existing credential shared with the agent; CONNECTED = credential created for the agent (connect flow). credentials_id: type: string format: uuid nullable: true description: Linked credential row; null while OAuth connect is pending. integration: {} member_owned: {} owner: {} runs_as: {} workspace: {} workspace_agent_id: {} ErrorResponse: type: object properties: error: type: string message: type: string securitySchemes: apiKey: type: http scheme: basic description: >- API key: key id as the username, secret as the password. An account API key carries the same scopes as an OAuth token and is checked against the scopes listed under oauth2 on each operation. A trigger API key is limited to its trigger's workspace and reaches only the session operations that list this scheme alongside the oauth2 scopes. bearerApiKey: type: http scheme: bearer bearerFormat: : description: >- The same API key as one Bearer token, `:`. An account API key carries the same scopes as an OAuth token and is checked against the scopes listed under oauth2 on each operation. A trigger API key is limited to its trigger's workspace and reaches only the session operations that list this scheme alongside the oauth2 scopes. oauth2: type: oauth2 description: >- OAuth 2.0 authorization code flow with PKCE (S256). Discovery: https://api.guild.ai/.well-known/oauth-authorization-server. flows: authorizationCode: authorizationUrl: https://api.guild.ai/v1/oauth/authorize tokenUrl: https://api.guild.ai/v1/oauth/token refreshUrl: https://api.guild.ai/v1/oauth/token scopes: agents:read: Read agents agents:write: Read and change agents sessions:read: Read sessions sessions:write: Read and change sessions workspaces:read: Read workspaces workspaces:write: Read and change workspaces skills:read: Read skills skills:write: Read and change skills integrations:read: Read integrations integrations:write: Read and change integrations applications:read: Read applications applications:write: Read and change applications organizations:read: Read organizations organizations:write: Read and change organizations ````