/iblai-vibe-credential

RBAC setup that lets an API token list and unmask integration credentials on a platform. Integration secrets are served masked by default — a token can read the sensitive fields only when it is bound to an RBAC policy granting the credential actions on the platform's integration-credentials resource.

Grant a token unmask access

1. Open Organization Settings (Account Dialog) → Integration → APIs.
2. Add a new API key and note the token you get.
3. A super admin must change the Mode → Token Policies.
4. In Organization Settings → Management → Roles, create a new Role

with a name like Unmask Sensitive Integration Credentials.

1. Under Actions, click search and add the following actions, then save:

- Ibl.Mentor/IntegrationCredentialsSensitive/action - Ibl.Mentor/IntegrationCredentialsUnmask/action - Ibl.Mentor/IntegrationCredentials/list

1. In the Policies tab, create a new policy and select the Role you

created in step 4.

1. Set the policy's Resources to

/platforms/<platform-pk>/integration-credentials/ (the platform PK — the integer, not the key), add your token under Tokens, and save.

1. A super admin needs to to to the Rbac Policies, find the policy you just created and then under Tokens, add your token and save it

The token can now hit the integration-credential endpoint with the unmask query param:

GET {dmUrl}/api/ai-account/orgs/<org>/integration-credential/?unmask_sensitive_fields=true

To restrict the token to specific credentials rather than all of them, add the credential's PK (int) to the policy's Resources instead of the whole collection.

Related

• [/iblai-vibe-rbac](../iblai-vibe-rbac/SKILL.md) — default roles, the action-definitions endpoint, and the SDK Roles + Policies components.
• [/iblai-vibe-account](../iblai-vibe-account/SKILL.md) — the Organization Settings surface where API keys, Roles, and Policies are managed.