Interface ResolvedCredential<T>

The credential entity if loaded from database. Will be null if directValues was provided.

Whole days until the credential expires, negative once it has expired, and null when the credential has no expiry. Useful for surfacing "expires in N days" without re-deriving it from expiresAt.

The credential's lifecycle state at the moment it was resolved.

Credentials supplied via directValues always report 'valid' — the caller owns their lifetime and the engine knows nothing about it.

A resolved credential can legitimately be 'expired' here: that happens under a 'warn' policy, or inside the configured grace period. Callers that want to refuse such a credential should check this field rather than assuming a successful resolve implies a live credential.

Optional expiration date from the credential. Null if no expiration is set.

Where the credential came from.

• 'database': Loaded from the Credentials table
• 'request': Provided via directValues option

The decrypted credential values, typed according to the credential type's FieldSchema.

For example, for an "API Key" type credential:

interface APIKeyValues {
    apiKey: string;
}
const cred = await engine.getCredential<APIKeyValues>('OpenAI', options);
console.log(cred.values.apiKey); // Strongly typed!
Copy