feat: Return credential value keys and support removing values on update

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-61dab8d0d01c2838febaf4319114ae35aa169a813a102e93af6598ca0d445da2.yml
-openapi_spec_hash: c9fbe809670384dc5141dccb60e45672
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ba32039d3975da7aa6d28e5184f0a44c9fbfe36ab7dbc71985d14e2ecc0867b9.yml
+openapi_spec_hash: a9f32fc90c2add2ae85af828c298e35b
 config_hash: 06186eb40e0058a2a87ac251fc07415d

src/kernel/resources/credentials.py

@@ -7,7 +7,7 @@
 import httpx
 
 from ..types import credential_list_params, credential_create_params, credential_update_params
-from .._types import Body, Omit, Query, Headers, NoneType, NotGiven, omit, not_given
+from .._types import Body, Omit, Query, Headers, NoneType, NotGiven, SequenceNotStr, omit, not_given
 from .._utils import path_template, maybe_transform, async_maybe_transform
 from .._compat import cached_property
 from .._resource import SyncAPIResource, AsyncAPIResource
@@ -145,6 +145,7 @@ def update(
         id_or_name: str,
         *,
         name: str | Omit = omit,
+        remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
@@ -163,6 +164,9 @@ def update(
         Args:
           name: New name for the credential
 
+          remove_value_keys: Field names to remove from the credential's stored values. Removals are applied
+              before `values` are merged, so a key present in both is kept with its new value.
+
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
@@ -187,6 +191,7 @@ def update(
             body=maybe_transform(
                 {
                     "name": name,
+                    "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
                     "totp_secret": totp_secret,
                     "values": values,
@@ -445,6 +450,7 @@ async def update(
         id_or_name: str,
         *,
         name: str | Omit = omit,
+        remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
@@ -463,6 +469,9 @@ async def update(
         Args:
           name: New name for the credential
 
+          remove_value_keys: Field names to remove from the credential's stored values. Removals are applied
+              before `values` are merged, so a key present in both is kept with its new value.
+
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
@@ -487,6 +496,7 @@ async def update(
             body=await async_maybe_transform(
                 {
                     "name": name,
+                    "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
                     "totp_secret": totp_secret,
                     "values": values,

src/kernel/types/credential.py

@@ -1,6 +1,6 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Optional
+from typing import List, Optional
 from datetime import datetime
 
 from .._models import BaseModel
@@ -48,3 +48,10 @@ class Credential(BaseModel):
 
     totp_code_expires_at: Optional[datetime] = None
     """When the totp_code expires. Only included when totp_code is present."""
+
+    value_keys: Optional[List[str]] = None
+    """The field names stored in this credential's values (e.g., username, password).
+
+    Values themselves are never returned. Included on single-credential responses
+    (create, get by id or name, update); omitted from list responses.
+    """

src/kernel/types/credential_update_params.py

@@ -5,13 +5,22 @@
 from typing import Dict, Optional
 from typing_extensions import TypedDict
 
+from .._types import SequenceNotStr
+
 __all__ = ["CredentialUpdateParams"]
 
 
 class CredentialUpdateParams(TypedDict, total=False):
     name: str
     """New name for the credential"""
 
+    remove_value_keys: SequenceNotStr[str]
+    """Field names to remove from the credential's stored values.
+
+    Removals are applied before `values` are merged, so a key present in both is
+    kept with its new value.
+    """
+
     sso_provider: Optional[str]
     """If set, indicates this credential should be used with the specified SSO
     provider.

tests/api_resources/test_credentials.py

@@ -141,6 +141,7 @@ def test_method_update_with_all_params(self, client: Kernel) -> None:
         credential = client.credentials.update(
             id_or_name="id_or_name",
             name="my-updated-login",
+            remove_value_keys=["old_field"],
             sso_provider="google",
             totp_secret="JBSWY3DPEHPK3PXP",
             values={
@@ -433,6 +434,7 @@ async def test_method_update_with_all_params(self, async_client: AsyncKernel) ->
         credential = await async_client.credentials.update(
             id_or_name="id_or_name",
             name="my-updated-login",
+            remove_value_keys=["old_field"],
             sso_provider="google",
             totp_secret="JBSWY3DPEHPK3PXP",
             values={