Get a vault session

curl https://api.agentcard.sh/api/v2/vault_sessions/vs_2q9d1x8f3k2m4t7w \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "vault_session",
  "id": "vs_2q9d1x8f3k2m4t7w",
  "status": "linked",
  "user_id": "usr_8f3k2m",
  "linked_at": "2026-09-02T18:41:07Z",
  "poll_interval": 3,
  "code_sends": null,
  "verify_attempts": null,
  "channel": null,
  "expires_at": "2026-09-03T18:00:00Z",
  "created_at": "2026-09-02T18:00:00Z",
  "test_mode": false
}

GET

api

vault_sessions

{id}

curl https://api.agentcard.sh/api/v2/vault_sessions/vs_2q9d1x8f3k2m4t7w \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "vault_session",
  "id": "vs_2q9d1x8f3k2m4t7w",
  "status": "linked",
  "user_id": "usr_8f3k2m",
  "linked_at": "2026-09-02T18:41:07Z",
  "poll_interval": 3,
  "code_sends": null,
  "verify_attempts": null,
  "channel": null,
  "expires_at": "2026-09-03T18:00:00Z",
  "created_at": "2026-09-02T18:00:00Z",
  "test_mode": false
}

string

required

The id from the create response. Not the vs= token inside url.

curl https://api.agentcard.sh/api/v2/vault_sessions/vs_2q9d1x8f3k2m4t7w \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "vault_session",
  "id": "vs_2q9d1x8f3k2m4t7w",
  "status": "linked",
  "user_id": "usr_8f3k2m",
  "linked_at": "2026-09-02T18:41:07Z",
  "poll_interval": 3,
  "code_sends": null,
  "verify_attempts": null,
  "channel": null,
  "expires_at": "2026-09-03T18:00:00Z",
  "created_at": "2026-09-02T18:00:00Z",
  "test_mode": false
}

string

pending (wait poll_interval seconds and read again), linked (store user_id, stop), or expired (create a new session).

string | null

The id to store once linked. A connected session carries it from the start.

number | null

How many times a connected user asked for their code. Null on open sessions.

number | null

How many codes a connected user tried. Null on open sessions.

Budget. 40 reads a minute per session, 600 a minute across your account. Honor poll_interval and you never see a 429. Only the client that created the session can read it; anything else is a 404.

Overview

Access tokens

Connections

Vault

Purchases

Cards

Identity verification

Wallet

Wallet links

Webhook endpoints

Embed origins

Blooio connection

Get a vault session