Preview

Get credential reference

GET
/credential-owners/{ownerAccountID}/credential-references/{credentialReferenceID}

Get one credential reference. The response lists only its active and next keys; retired keys are never returned. Private keys and client secrets are never returned.

Returns 200 with the reference, 400 when an ID is malformed, 401 when your credentials are missing or invalid, 403 when the authenticated caller is not the owner account, 404 when the owner or reference is not found, and 409 when the owner account is both an FI and an integrator.

Auth: API key or bearer token. Requires the moov-money-config.read scope on the owner account.

Request
cURL
curl -X GET https://api.moov.money/credential-owners/{ownerAccountID}/credential-references/{credentialReferenceID} \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00"
Responses
200 400 401 403 404 409
The request completed successfully.
{
  "clientAuthenticationMethod": "private_key_jwt",
  "keys": [
    {
      "algorithm": "ES256",
      "state": "active"
    }
  ],
  "ownerAccountID": "acc_01HF5J9ZKQT4RXP8M2VYBN3D",
  "ownerType": "fi",
  "state": "pending"
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.
The request conflicts with the current state of the target resource.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

ownerAccountID

string required
Moov account ID.

credentialReferenceID

string required
Identifier assigned to a credential reference.

Response

A credential reference and its active or next public signing keys.

credentialReferenceID

string required
Identifier assigned to this credential reference.

ownerType

string<enum> required
Owner kind derived by Moov Money from the owner account.
Possible values: fi, integrator

ownerAccountID

string required
Account that owns this credential reference.

clientAuthenticationMethod

string<enum> required
Client authentication method used by this reference.
Possible values: private_key_jwt

state

string<enum> required
Reference state: pending, active, or revoked.
Possible values: pending, active, revoked

clientID

string required
Receiver-issued client ID. Empty while the reference is pending.

tokenURL

string required
Receiver token endpoint URL. Empty while the reference is pending.

scopes

array | null required
Scopes configured for the reference. This is null until configured.

audience

string
Configured token audience, when present.

resource

string
Configured resource indicator, when present.

jwksURL

string required
Opaque JWKS URL returned by Moov Money. Use this value as-is when registering with the receiver; do not construct it.

keys

array<object> required
Active and next key metadata. Retired keys are not returned.
Show child attributes

keys[]

keyID

string required
Identifier assigned to this key.

algorithm

string<enum> required
Signing algorithm used by this key.
Possible values: ES256, PS256, RS256

state

string<enum> required
Key state: active or next.
Possible values: active, next

createdOn

string<date-time> required
Time when the key was created.

createdOn

string<date-time> required
Time when the reference was created.

updatedOn

string<date-time> required
Time when the reference was last updated.

revokedOn

string<date-time> | null required
Time when the reference was revoked, or null if it has not been revoked.