OptionalauthAuthentication mode. Exactly one variant may be set.
(-- entra_service_principal is the canonical home for the Entra triple. The
top-level tenant_id / client_id / client_secret fields are the
pre-AIGOV-188 flat form, kept for one migration cycle: on read the handler
populates BOTH the flat fields and this arm so old and new clients both
work, and on write it accepts either shape. The flat fields are removed
once all readers/writers have migrated to the oneof. --)
Microsoft AI Foundry API key. Mutually exclusive with the Entra and
service-credential modes. Supplied as inline plaintext via
ProviderSecret.plaintext.
Reference to a UC service credential authorizing Microsoft Foundry requests.
On Create the caller supplies service_credential.name in the AIP-122
resource-name form credentials/{name}. Required on Create when using
UC-service-credential auth; mutually exclusive with api_key and
entra_service_principal. The credential is
referenced by name; its value is not carried here. On read the resolved id
and is_deleted are also populated. Only supported on Azure-hosted
workspaces; Create requests from other clouds are rejected with
INVALID_PARAMETER_VALUE.
Entra ID (service principal) auth. Mutually exclusive with api_key and
service_credential. Supersedes the flat tenant_id / client_id /
client_secret fields.
OptionalbaseMicrosoft AI Foundry endpoint URL. Required on Create.
OptionalclientDeprecated flat Entra client ID. Superseded by
entra_service_principal.client_id. Kept for one migration cycle; the
handler mirrors it to/from entra_service_principal.
OptionalclientDeprecated flat Entra client secret. Superseded by
entra_service_principal.client_secret. Kept for one migration cycle; the
handler mirrors it to/from entra_service_principal. Supplied as inline
plaintext via ProviderSecret.plaintext.
OptionaltenantDeprecated flat Entra tenant ID. Superseded by
entra_service_principal.tenant_id. Kept for one migration cycle; the
handler mirrors it to/from entra_service_principal.
Direct form of Microsoft Foundry provider config.
Authentication is one of three mutually exclusive modes, exactly one of which must be supplied on Create:
api_key, leaveentra_service_principalandservice_credentialunset.entra_service_principal, leaveapi_keyandservice_credentialunset. AI Gateway exchanges these for an Entra bearer token on outbound requests via the OAuth2 client-credentials grant.service_credential.nameto the AIP-122 resource-name formcredentials/{name}, leaveapi_keyandentra_service_principalunset. The credential value lives in UC and is referenced by name, not held on this message. Only supported on Azure-hosted workspaces. Setting more than one mode is rejected.