Call a JSON API
Keep credentials in Vault and send query parameters throughparams. Read the value explicitly with await vault.get or await vault.getAccessToken, then build the outgoing header. Protect execution capture and never log credentials. Provider bodies can echo credentials; return only the fields your caller needs.
vault.get defaults to instance scope. Personal reads in saved Components require the exact grant and a verified executing owner; direct owner reads use the current account. Integration consumption follows the same saved Component or Tool grant mapping:

