Lists the labels used to tag Vault credentials (id, name, hex color, order), in the order the app shows them, paginated by cursor (limit up to 200; up to 1000 labels). Use their ids in label_ids when creating or updating credentials, in vault.items.bulk.update_labels and to filter vault.items.list. Create, edit and delete them with vault.labels.create, update and delete. Requires view access to the Vault.
Escopo
vault:read
Permissão
Ver o módulo
Tool do MCP
vault_labels_listNa superfície completa; na compacta, mb_execute_operation com id: "vault.labels.list".
Custo declarado: até 1000 leituras e 0 escritas por chamada (contam na cota diária).
Parâmetros
limitintegerqueryopcional
How many items this page brings at most (see the maximum and the default in the schema).
Padrão: 50
cursorstringqueryopcional
The next_cursor of the previous page, exactly as it came (only for the same list and filters); without it, the first page.
Removes one label from every credential of the Vault that carries it, including credentials with custom access (it only touches their label list, which belongs to the organization). The label itself is not deleted (vault.labels.delete deletes it and runs this same step). It does not require the label to still exist, so it also cleans an id left behind. Idempotent: a label that no credential has returns updated 0. Requires edit access to the Vault.
Escopo
vault:write
Permissão
Editar no módulo
Tool do MCP
vault_labels_detachNa superfície completa; na compacta, mb_execute_operation com id: "vault.labels.detach".
Custo declarado: até 400 leituras e 400 escritas por chamada (contam na cota diária).
Parâmetros
label_idstringrotaobrigatório
The label's id (from vault.labels.list, or one left on a credential).
curl-X POST "https://api.mb-suite.com/v1/vault/labels/{label_id}/detach" \
-H"Authorization: Bearer $MB_API_KEY"
Testar com a sua API key de teste
Com uma API key de teste o pedido vai sempre para a sua organização de prática: dados de exemplo que você pode reiniciar.
curl-X POST "https://api.mb-suite.com/v1/vault/labels/{label_id}/detach" \
-H"Authorization: Bearer $MB_TEST_KEY"
POST/v1/vault/labels
Create a vault label
vault.labels.create
EscritaDesde 2026-11-01
Creates a Vault label (name and an optional #rrggbb color; without it, the next color of the app's palette), at the end of the manual order. Up to 200 labels per organization (409 limit_reached). Returns label_id and the label: use it in label_ids of vault.items.create or update. Requires edit access to the Vault.
Escopo
vault:write
Permissão
Editar no módulo
Tool do MCP
vault_labels_createNa superfície completa; na compacta, mb_execute_operation com id: "vault.labels.create".
Custo declarado: até 1 leituras e 1 escritas por chamada (contam na cota diária).
Parâmetros
namestringcorpoobrigatório
The label's name.
colorstringcorpoopcional
A hex color, #rrggbb (default: the next one of the app's palette).
Renames a Vault label, changes its color (#rrggbb) or its place in the manual order. Only what is sent changes; the same values change nothing (changed: false). The credentials that carry it keep it. Returns the label. Requires edit access to the Vault.
Escopo
vault:write
Permissão
Editar no módulo
Tool do MCP
vault_labels_updateNa superfície completa; na compacta, mb_execute_operation com id: "vault.labels.update".
Custo declarado: até 1 leituras e 1 escritas por chamada (contam na cota diária).
Deletes a Vault label and removes it from every credential that carries it, including credentials with custom access (it only touches their label list; up to 4,000, more is 409 too_many_labeled_items). The label goes to the 30-day trash with the credentials it was on: platform.trash.restore brings it back. Outside the app it requires a dry run (which says how many credentials carry it) and a confirm_token, except a REST DELETE with a key allowed to delete. Returns items_unlabeled. Requires edit access to the Vault.
Com uma API key, este DELETE roda direto: o registro fica 30 dias na lixeira e a resposta traz o seu trash_item_id. Com um token OAuth, e pelo MCP, pede dry_run → confirm_token.
Escopo
vault:writee «Permitir exclusões» (vault:delete no OAuth)
Permissão
Editar no módulo
Tool do MCP
vault_labels_deleteNa superfície completa; na compacta, mb_execute_operation com id: "vault.labels.delete".
Custo declarado: até 4012 leituras e 4002 escritas por chamada (contam na cota diária).
Parâmetros
label_idstringrotaobrigatório
The label's id (from vault.labels.list, or one left on a credential).
Resposta
oktrue
items_unlabelednumber
trash_item_idstring
The trash item this deletion left: the item_id of platform.trash.restore (POST /trash/{item_id}/restore). Missing if nothing went to the trash.
trash_item_idsarray<string>
Only when the deletion left more than one copy: all of them, the first being trash_item_id.
trash_expires_atnumber
When the copy leaves the trash for good (epoch ms): 30 days after the deletion.