Class CredentialsClient

Creates a new storage credential. The request object is specific to the cloud:

• AwsIamRole for AWS credentials
• AzureServicePrincipal for Azure credentials
• GcpServiceAccountKey for GCP credentials

The caller must be a metastore admin and have the CREATE_STORAGE_CREDENTIAL privilege on the metastore.

Creates a new credential. The type of credential to be created is determined by the purpose field, which should be either SERVICE or STORAGE.

The caller must be a metastore admin or have the metastore privilege CREATE_STORAGE_CREDENTIAL for storage credentials, or CREATE_SERVICE_CREDENTIAL for service credentials.

Creates a credential configuration that represents cloud cross-account credentials for a specified account. uses this to set up network infrastructure properly to host clusters. For your AWS IAM role, you need to trust the External ID (the Databricks Account API account ID) in the returned credential object, and configure the required access policy.

Save the response's credentials_id field, which is the ID for your new credential configuration object.

For information about how to create a new workspace with this API, see Create a new workspace using the Account API

Creates a new storage credential.

The caller must be a metastore admin or have the CREATE_STORAGE_CREDENTIAL privilege on the metastore.

Deletes a storage credential from the metastore. The caller must be an owner of the storage credential.

Deletes a service or storage credential from the metastore. The caller must be an owner of the credential.

Deletes a credential configuration object for an account, both specified by ID. You cannot delete a credential that is associated with any workspace.

Deletes a storage credential from the metastore. The caller must be an owner of the storage credential.

Get a short-lived credential for directly accessing cloud storage locations registered in . The Generate Temporary Path Credentials API is only supported for external storage paths, specifically external locations and external tables. Managed tables are not supported by this API. The metastore must have external_access_enabled flag set to true (default false). The caller must have the EXTERNAL_USE_LOCATION privilege on the external location; this privilege can only be granted by external location owners. For requests on existing external tables, the caller must also have the EXTERNAL_USE_SCHEMA privilege on the parent schema; this privilege can only be granted by catalog owners.

Returns a set of temporary credentials generated using the specified service credential. The caller must be a metastore admin or have the metastore privilege ACCESS on the service credential.

Get a short-lived credential for directly accessing the table data on cloud storage. The metastore must have external_access_enabled flag set to true (default false). The caller must have the EXTERNAL_USE_SCHEMA privilege on the parent schema and this privilege can only be granted by catalog owners.

Get a short-lived credential for directly accessing the volume data on cloud storage. The metastore must have external_access_enabled flag set to true (default false). The caller must have the EXTERNAL_USE_SCHEMA privilege on the parent schema and this privilege can only be granted by catalog owners.

Gets a storage credential from the metastore. The caller must be a metastore admin, the owner of the storage credential, or have a level of privilege on the storage credential.

Gets a service or storage credential from the metastore. The caller must be a metastore admin, the owner of the credential, or have any permission on the credential.

Gets a credential configuration object for an account, both specified by ID.

Gets a storage credential from the metastore. The caller must be a metastore admin, the owner of the storage credential, or have some permission on the storage credential.

Gets a list of all storage credentials that have been assigned to given metastore.

Gets an array of credentials (as CredentialInfo objects).

The array is limited to only the credentials that the caller has permission to access. If the caller is a metastore admin, retrieval of credentials is unrestricted. There is no guarantee of a specific ordering of the elements in the array.

PAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token. Clients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.

List credential configuration objects for an account, specified by ID.

Gets an array of storage credentials (as StorageCredentialInfo objects). The array is limited to only those storage credentials the caller has permission to access. If the caller is a metastore admin, retrieval of credentials is unrestricted. There is no guarantee of a specific ordering of the elements in the array.

NOTE: we recommend using max_results=0 to use the paginated version of this API. Unpaginated calls will be deprecated soon.

PAGINATION BEHAVIOR: When using pagination (max_results >= 0), a page may contain zero results while still providing a next_page_token. Clients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.

Updates a storage credential on the metastore. The caller must be the owner of the storage credential. If the caller is a metastore admin, only the owner credential can be changed.

Updates a service or storage credential on the metastore.

The caller must be the owner of the credential or a metastore admin or have the MANAGE permission. If the caller is a metastore admin, only the owner field can be changed.

Updates a storage credential on the metastore.

The caller must be the owner of the storage credential or a metastore admin. If the caller is a metastore admin, only the owner field can be changed.

Validates a credential.

For service credentials (purpose is SERVICE), either the credential_name or the cloud-specific credential must be provided.

For storage credentials (purpose is STORAGE), at least one of external_location_name and url need to be provided. If only one of them is provided, it will be used for validation. And if both are provided, the url will be used for validation, and external_location_name will be ignored when checking overlapping urls. Either the credential_name or the cloud-specific credential must be provided.

The caller must be a metastore admin or the credential owner or have the required permission on the metastore and the credential (e.g., CREATE_EXTERNAL_LOCATION when purpose is STORAGE).

Validates a storage credential. At least one of external_location_name and url need to be provided. If only one of them is provided, it will be used for validation. And if both are provided, the url will be used for validation, and external_location_name will be ignored when checking overlapping urls.

Either the storage_credential_name or the cloud-specific credential must be provided.

The caller must be a metastore admin or the storage credential owner or have the CREATE_EXTERNAL_LOCATION privilege on the metastore and the storage credential.