Authentication

View as Markdown

Configure OAuth 2.0 application registrations for Databricks

Create Account Federation Policy GA

POST /api/2.0/accounts/{account_id}/federationPolicies

Create account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64query: The service principal id for the federation policy.

policy_idstringquery: The identifier for the federation policy. The identifier must contain only lowercase alphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be assigned by <Databricks>.
Example: my-federation-policy
Constraints: [ 2 .. 63 ] characters

Request body

policyobject

Show child attributesHide child attributes

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

Response

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

View as Markdown

Request

{
  "policy": {
    "name": "string",
    "description": "My federation policy description.",
    "oidc_policy": {},
    "create_time": "string",
    "update_time": "string",
    "uid": "string",
    "service_principal_id": 0,
    "policy_id": "string"
  }
}

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Create Service Principal Federation Policy GA

POST /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies

Create account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64path: The service principal id for the federation policy.

policy_idstringquery: The identifier for the federation policy. The identifier must contain only lowercase alphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be assigned by <Databricks>.
Example: my-federation-policy
Constraints: [ 2 .. 63 ] characters

Request body

policyobject

Show child attributesHide child attributes

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

Response

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

View as Markdown

Request

{
  "policy": {
    "name": "string",
    "description": "My federation policy description.",
    "oidc_policy": {},
    "create_time": "string",
    "update_time": "string",
    "uid": "string",
    "service_principal_id": 0,
    "policy_id": "string"
  }
}

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Delete Account Federation Policy GA

DELETE /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

Delete account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

policy_idstringpath: The identifier for the federation policy.
Example: my-federation-policy

service_principal_idint64query: The service principal id for the federation policy.

Delete Service Principal Federation Policy GA

DELETE /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies/{policy_id}

Delete account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64path: The service principal id for the federation policy.

policy_idstringpath: The identifier for the federation policy.
Example: my-federation-policy

Get Account Federation Policy GA

GET /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

Get account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

policy_idstringpath: The identifier for the federation policy.
Example: my-federation-policy

service_principal_idint64query: The service principal id for the federation policy.

Response

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

View as Markdown

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Get Service Principal Federation Policy GA

GET /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies/{policy_id}

Get account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64path: The service principal id for the federation policy.

policy_idstringpath: The identifier for the federation policy.
Example: my-federation-policy

Response

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

View as Markdown

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

List Account Federation Policies GA

GET /api/2.0/accounts/{account_id}/federationPolicies

List account federation policies.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64query: The service principal id for the federation policy.

page_sizeint32query

page_tokenstringquery

Response

policiesarray of object

Show child attributesHide child attributes

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

next_page_tokenstring

View as Markdown

Response

{
  "policies": [
    {
      "name": "string",
      "description": "My federation policy description.",
      "oidc_policy": {},
      "create_time": "string",
      "update_time": "string",
      "uid": "string",
      "service_principal_id": 0,
      "policy_id": "string"
    }
  ],
  "next_page_token": "string"
}

List Service Principal Federation Policies GA

GET /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies

List account federation policies.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64path: The service principal id for the federation policy.

page_sizeint32query

page_tokenstringquery

Response

policiesarray of object

Show child attributesHide child attributes

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

next_page_tokenstring

View as Markdown

Response

{
  "policies": [
    {
      "name": "string",
      "description": "My federation policy description.",
      "oidc_policy": {},
      "create_time": "string",
      "update_time": "string",
      "uid": "string",
      "service_principal_id": 0,
      "policy_id": "string"
    }
  ],
  "next_page_token": "string"
}

Update Account Federation Policy GA

PATCH /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

Update account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

policy_idstringpath: The identifier for the federation policy.
Example: my-federation-policy

service_principal_idint64query: The service principal id for the federation policy.

update_maskstringquery: The field mask specifies which fields of the policy to update. To specify multiple fields in the field mask, use comma as the separator (no space). The special value '*' indicates that all fields should be updated (full replacement). If unspecified, all fields that are set in the policy provided in the update request will overwrite the corresponding fields in the existing policy. Example value: 'description,oidc_policy.audiences'.

Request body

policyobject

Show child attributesHide child attributes

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

Response

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

View as Markdown

Request

{
  "policy": {
    "name": "string",
    "description": "My federation policy description.",
    "oidc_policy": {},
    "create_time": "string",
    "update_time": "string",
    "uid": "string",
    "service_principal_id": 0,
    "policy_id": "string"
  }
}

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Update Service Principal Federation Policy GA

PATCH /api/2.0/accounts/{account_id}/servicePrincipals/{service_principal_id}/federationPolicies/{policy_id}

Update account federation policy.

API scopes: authentication

Parameters

account_idstringpath: The account id for the federation policy.

service_principal_idint64path: The service principal id for the federation policy.

policy_idstringpath: The identifier for the federation policy.
Example: my-federation-policy

update_maskstringquery: The field mask specifies which fields of the policy to update. To specify multiple fields in the field mask, use comma as the separator (no space). The special value '*' indicates that all fields should be updated (full replacement). If unspecified, all fields that are set in the policy provided in the update request will overwrite the corresponding fields in the existing policy. Example value: 'description,oidc_policy.audiences'.

Request body

policyobject

Show child attributesHide child attributes

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

Response

namestring: Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring: Description of the federation policy.
Example: My federation policy description.

oidc_policyobjectRequired

Show child attributesHide child attributes

issuerstring: The required token issuer, as specified in the 'iss' claim of federated tokens.
Example: https://myidp.example.com/oidc

subjectstring: The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string: The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.
Example: databricks

subject_claimstring: The claim that contains the subject of the token. If unspecified, the default value is 'sub'.
Example: sub

jwks_uristring: URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring: The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestring: Creation time of the federation policy.

update_timestring: Last update time of the federation policy.

uidstring: Unique, immutable id of the federation policy.

service_principal_idint64: The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstring: The ID of the federation policy. Output only.

View as Markdown

Request

{
  "policy": {
    "name": "string",
    "description": "My federation policy description.",
    "oidc_policy": {},
    "create_time": "string",
    "update_time": "string",
    "uid": "string",
    "service_principal_id": 0,
    "policy_id": "string"
  }
}

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Create Service Principal Secret Proxy GA

POST /api/2.0/accounts/servicePrincipals/{service_principal}/credentials/secrets

Create a secret for the given service principal.

API scopes: authentication

Parameters

service_principalstringpath: The service principal ID.

Request body

account_idstring: The account ID.

lifetimestring: The lifetime of the secret in seconds. If this parameter is not provided, the secret will have a default lifetime of 730 days (63072000s).
Example: 31536000s

Response

idstring: ID of the secret
Example: 09094e3230c893775eac3a9e7d912a8ad08ffd7e592feec9afd51958cb662110

secretstring: Secret Value
Example: x8ipcf0482bcaah6b3dfcb3fb217461f8b83

secret_hashstring: Secret Hash

create_timestring: UTC time when the secret was created
Example: 2023-01-01T19:30:41.000Z

update_timestring: UTC time when the secret was updated
Example: 2023-01-01T19:30:41.000Z

statusstring: Status of the secret
Example: ACTIVE

expire_timestring: UTC time when the secret will expire. If the field is not present, the secret does not expire.
Example: 2024-01-01T19:30:41.000Z

View as Markdown

Request

{
  "lifetime": "31536000s"
}

Response

{
  "id": "09094e3230c893775eac3a9e7d912a8ad08ffd7e592feec9afd51958cb662110",
  "secret": "x8ipcf0482bcaah6b3dfcb3fb217461f8b83",
  "secret_hash": "string",
  "create_time": "2023-01-01T19:30:41.000Z",
  "update_time": "2023-01-01T19:30:41.000Z",
  "status": "ACTIVE",
  "expire_time": "2024-01-01T19:30:41.000Z"
}

Delete Service Principal Secret Proxy GA

DELETE /api/2.0/accounts/servicePrincipals/{service_principal}/credentials/secrets/{secret_id}

Delete a secret from the given service principal.

API scopes: authentication

Parameters

service_principalstringpath: The service principal ID.

secret_idstringpath: The secret ID.

account_idstringquery: The account ID.

List Service Principal Secrets Proxy GA

GET /api/2.0/accounts/servicePrincipals/{service_principal}/credentials/secrets

List all secrets associated with the given service principal. This operation only returns information about the secrets themselves and does not include the secret values.

API scopes: authentication

Parameters

service_principalstringpath: The service principal ID.

account_idstringquery: The account ID.

page_tokenstringquery: An opaque page token which was the next_page_token in the response of the previous request to list the secrets for this service principal. Provide this token to retrieve the next page of secret entries. When providing a page_token, all other parameters provided to the request must match the previous request. To list all of the secrets for a service principal, it is necessary to continue requesting pages of entries until the response contains no next_page_token. Note that the number of entries returned must not be used to determine when the listing is complete.

page_sizeint32query: Default: 100

Response

secretsarray of object

List of the secrets

Show child attributesHide child attributes

idstring: ID of the secret
Example: 09094e3230c893775eac3a9e7d912a8ad08ffd7e592feec9afd51958cb662110

secretstring: Secret Value
Example: x8ipcf0482bcaah6b3dfcb3fb217461f8b83

secret_hashstring: Secret Hash

create_timestring: UTC time when the secret was created
Example: 2023-01-01T19:30:41.000Z

update_timestring: UTC time when the secret was updated
Example: 2023-01-01T19:30:41.000Z

statusstring: Status of the secret
Example: ACTIVE

expire_timestring: UTC time when the secret will expire. If the field is not present, the secret does not expire.
Example: 2024-01-01T19:30:41.000Z

next_page_tokenstring: A token, which can be sent as page_token to retrieve the next page.

View as Markdown

Response

{
  "secrets": [
    {
      "create_time": "2023-01-01T19:30:41.000Z",
      "expire_time": "2024-01-01T19:30:41.000Z",
      "id": "09094e3230c893775eac3a9e7d912a8ad08ffd7e592feec9afd51958cb662110",
      "secret_hash": "string",
      "status": "ACTIVE",
      "update_time": "2023-01-01T19:30:41.000Z"
    }
  ]
}

Create Account Federation Policy GA​

Parameters​

Request body​

Response​

Create Service Principal Federation Policy GA​

Parameters​

Request body​

Response​

Delete Account Federation Policy GA​

Parameters​

Delete Service Principal Federation Policy GA​

Parameters​

Get Account Federation Policy GA​

Parameters​

Response​

Get Service Principal Federation Policy GA​

Parameters​

Response​

List Account Federation Policies GA​

Parameters​

Response​

List Service Principal Federation Policies GA​

Parameters​

Response​

Update Account Federation Policy GA​

Parameters​

Request body​

Response​

Update Service Principal Federation Policy GA​

Parameters​

Request body​

Response​

Create Service Principal Secret Proxy GA​

Parameters​

Request body​

Response​

Delete Service Principal Secret Proxy GA​

Parameters​

List Service Principal Secrets Proxy GA​

Parameters​

Response​

Create Account Federation Policy GA

Parameters

Request body

Response

Create Service Principal Federation Policy GA

Parameters

Request body

Response

Delete Account Federation Policy GA

Parameters

Delete Service Principal Federation Policy GA

Parameters

Get Account Federation Policy GA

Parameters

Response

Get Service Principal Federation Policy GA

Parameters

Response

List Account Federation Policies GA

Parameters

Response

List Service Principal Federation Policies GA

Parameters

Response

Update Account Federation Policy GA

Parameters

Request body

Response

Update Service Principal Federation Policy GA

Parameters

Request body

Response

Create Service Principal Secret Proxy GA

Parameters

Request body

Response

Delete Service Principal Secret Proxy GA

Parameters

List Service Principal Secrets Proxy GA

Parameters

Response