Labels

List vault labels

vault.labels.list

Lists the labels used to tag Vault credentials (id, name, hex color, order), in the order the app shows them, paginated by cursor (limit up to 200; up to 1000 labels). Use their ids in label_ids when creating or updating credentials, in vault.items.bulk.update_labels and to filter vault.items.list. Create, edit and delete them with vault.labels.create, update and delete. Requires view access to the Vault.

Scope

vault:read

Permission

View the module

MCP tool

vault_labels_listOn the full surface; on the compact one, mb_execute_operation with id: "vault.labels.list".

Declared cost: up to 1000 reads and 0 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl "https://api.mb-suite.com/v1/vault/labels" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl "https://api.mb-suite.com/v1/vault/labels" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Remove a label from every vault credential

vault.labels.detach

Removes one label from every credential of the Vault that carries it, including credentials with custom access (it only touches their label list, which belongs to the organization). The label itself is not deleted (vault.labels.delete deletes it and runs this same step). It does not require the label to still exist, so it also cleans an id left behind. Idempotent: a label that no credential has returns updated 0. Requires edit access to the Vault.

Scope

vault:write

Permission

Edit in the module

MCP tool

vault_labels_detachOn the full surface; on the compact one, mb_execute_operation with id: "vault.labels.detach".

Declared cost: up to 400 reads and 400 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X POST "https://api.mb-suite.com/v1/vault/labels/{label_id}/detach" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X POST "https://api.mb-suite.com/v1/vault/labels/{label_id}/detach" \
  -H "Authorization: Bearer $MB_TEST_KEY"

Create a vault label

vault.labels.create

Creates a Vault label (name and an optional #rrggbb color; without it, the next color of the app's palette), at the end of the manual order. Up to 200 labels per organization (409 limit_reached). Returns label_id and the label: use it in label_ids of vault.items.create or update. Requires edit access to the Vault.

Scope

vault:write

Permission

Edit in the module

MCP tool

vault_labels_createOn the full surface; on the compact one, mb_execute_operation with id: "vault.labels.create".

Declared cost: up to 1 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X POST "https://api.mb-suite.com/v1/vault/labels" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "name": "NAME"
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X POST "https://api.mb-suite.com/v1/vault/labels" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "name": "NAME"
}'

Edit a vault label

vault.labels.update

Renames a Vault label, changes its color (#rrggbb) or its place in the manual order. Only what is sent changes; the same values change nothing (changed: false). The credentials that carry it keep it. Returns the label. Requires edit access to the Vault.

Scope

vault:write

Permission

Edit in the module

MCP tool

vault_labels_updateOn the full surface; on the compact one, mb_execute_operation with id: "vault.labels.update".

Declared cost: up to 1 reads and 1 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X PATCH "https://api.mb-suite.com/v1/vault/labels/{label_id}" \
  -H "Authorization: Bearer $MB_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "updates": {}
}'

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X PATCH "https://api.mb-suite.com/v1/vault/labels/{label_id}" \
  -H "Authorization: Bearer $MB_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "updates": {}
}'

Delete a vault label

vault.labels.delete

Deletes a Vault label and removes it from every credential that carries it, including credentials with custom access (it only touches their label list; up to 4,000, more is 409 too_many_labeled_items). The label goes to the 30-day trash with the credentials it was on: platform.trash.restore brings it back. Outside the app it requires a dry run (which says how many credentials carry it) and a confirm_token, except a REST DELETE with a key allowed to delete. Returns items_unlabeled. Requires edit access to the Vault.

With an API key, this DELETE runs directly: the record stays 30 days in the trash and the response carries its trash_item_id. With an OAuth token, and through the MCP, it needs dry_run → confirm_token.

Scope

vault:write and “Allow deletions” (vault:delete in OAuth)

Permission

Edit in the module

MCP tool

vault_labels_deleteOn the full surface; on the compact one, mb_execute_operation with id: "vault.labels.delete".

Declared cost: up to 4012 reads and 4002 writes per call (they count against the daily quota).

Parameters

Response

Errors

Example

curl -X DELETE "https://api.mb-suite.com/v1/vault/labels/{label_id}" \
  -H "Authorization: Bearer $MB_API_KEY"

Try it with your test API key

With a test API key the request always goes to your practice organization: example data you can reset.

curl -X DELETE "https://api.mb-suite.com/v1/vault/labels/{label_id}" \
  -H "Authorization: Bearer $MB_TEST_KEY"