OptionalauthAuthentication mode. Exactly one variant may be set.
(-- entra_service_principal is the canonical home for the Entra triple. The
top-level tenant_id / client_id / client_secret fields are the
pre-AIGOV-188 flat form, kept for one migration cycle: on read the handler
populates BOTH the flat fields and this arm so old and new clients both
work, and on write it accepts either shape. The flat fields are removed
once all readers/writers have migrated to the oneof. --)
Azure OpenAI API key. Mutually exclusive with the Entra and
service-credential modes. Supplied as inline plaintext via
ProviderSecret.plaintext.
Reference to a UC service credential authorizing Azure OpenAI requests. On
Create the caller supplies service_credential.name in the AIP-122
resource-name form credentials/{name}. Required on Create when using
UC-service-credential auth; mutually exclusive with api_key and
entra_service_principal. The credential is
referenced by name; its value is not carried here. On read the resolved id
and is_deleted are also populated. Only supported on Azure-hosted
workspaces; Create requests from other clouds are rejected with
INVALID_PARAMETER_VALUE.
Entra ID (service principal) auth. Mutually exclusive with api_key and
service_credential. Supersedes the flat tenant_id / client_id /
client_secret fields.
OptionalbaseFull Azure OpenAI endpoint base URL, e.g.
https://myresource.openai.azure.com. Required on Create.
OptionalclientDeprecated flat Entra client ID. Superseded by
entra_service_principal.client_id. Kept for one migration cycle; the
handler mirrors it to/from entra_service_principal.
OptionalclientDeprecated flat Entra client secret. Superseded by
entra_service_principal.client_secret. Kept for one migration cycle; the
handler mirrors it to/from entra_service_principal. Supplied as inline
plaintext via ProviderSecret.plaintext.
OptionaltenantDeprecated flat Entra tenant ID. Superseded by
entra_service_principal.tenant_id. Kept for one migration cycle; the
handler mirrors it to/from entra_service_principal.
Direct form of Azure OpenAI provider config. Exactly one of three mutually-exclusive auth modes must be supplied on Create:
api_key, leaveentra_service_principalandservice_credentialunset.entra_service_principal, leaveapi_keyandservice_credentialunset.service_credential.nameto the AIP-122 resource-name formcredentials/{name}, leaveapi_keyandentra_service_principalunset. The credential value lives in UC and is referenced by name, not held on this message. Only supported on Azure-hosted workspaces. Setting more than one mode is rejected.