Account Federation Policy

View as Markdown

GetGET /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}ListGET /api/2.0/accounts/{account_id}/federationPoliciesCreatePOST /api/2.0/accounts/{account_id}/federationPoliciesUpdatePATCH /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}DeleteDELETE /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

FederationPolicy object

namestringOutput onlyImmutable

Resource name for the federation policy. Example values include accounts/<account-id>/federationPolicies/my-federation-policy for Account Federation Policies, and accounts/<account-id>/servicePrincipals/<service-principal-id>/federationPolicies/my-federation-policy for Service Principal Federation Policies. Typically an output parameter, which does not need to be specified in create or update requests. If specified in a request, must match the value in the request URL.

descriptionstring

Description of the federation policy.

Example: My federation policy description.

oidc_policyobject

Show child attributesHide child attributes

issuerstring

The required token issuer, as specified in the 'iss' claim of federated tokens.

Example: https://myidp.example.com/oidc

subjectstring

The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string

The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.

Example: databricks

subject_claimstring

The claim that contains the subject of the token. If unspecified, the default value is 'sub'.

Example: sub

jwks_uristring

URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring

The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

create_timestringOutput onlyImmutable

Creation time of the federation policy.

update_timestringOutput only

Last update time of the federation policy.

uidstringOutput onlyImmutable

Unique, immutable id of the federation policy.

service_principal_idint64Output onlyImmutable

The service principal ID that this federation policy applies to. Output only. Only set for service principal federation policies.

policy_idstringOutput onlyImmutable

The ID of the federation policy. Output only.

View as Markdown

The FederationPolicy object

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Get GA

GET /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

Get account federation policy.

API scopes: authentication

Parameters

account_idstringRequiredpath

The account id for the federation policy.

policy_idstringRequiredpath

The identifier for the federation policy.

Example: my-federation-policy

service_principal_idint64Requiredquery

The service principal id for the federation policy.

Response

Returns the FederationPolicy object.

View as Markdown

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

List GA

GET /api/2.0/accounts/{account_id}/federationPolicies

List account federation policies.

API scopes: authentication

Parameters

account_idstringRequiredpath

The account id for the federation policy.

service_principal_idint64Requiredquery

The service principal id for the federation policy.

page_sizeint32query

page_tokenstringquery

Response

Returns a list of FederationPolicy objects.

View as Markdown

Response

{
  "policies": [
    {
      "name": "string",
      "description": "My federation policy description.",
      "oidc_policy": {},
      "create_time": "string",
      "update_time": "string",
      "uid": "string",
      "service_principal_id": 0,
      "policy_id": "string"
    }
  ],
  "next_page_token": "string"
}

Create GA

POST /api/2.0/accounts/{account_id}/federationPolicies

Create account federation policy.

API scopes: authentication

Parameters

account_idstringRequiredpath

The account id for the federation policy.

service_principal_idint64Requiredquery

The service principal id for the federation policy.

policy_idstringquery

The identifier for the federation policy. The identifier must contain only lowercase alphanumeric characters, numbers, hyphens, and slashes. If unspecified, the id will be assigned by <Databricks>.

Example: my-federation-policy

Constraints: [ 2 .. 63 ] characters

Request body

policyobjectRequired

Show child attributesHide child attributes

descriptionstring

Description of the federation policy.

Example: My federation policy description.

oidc_policyobject

Show child attributesHide child attributes

issuerstring

The required token issuer, as specified in the 'iss' claim of federated tokens.

Example: https://myidp.example.com/oidc

subjectstring

The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string

The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.

Example: databricks

subject_claimstring

The claim that contains the subject of the token. If unspecified, the default value is 'sub'.

Example: sub

jwks_uristring

URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring

The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

Response

Returns the FederationPolicy object.

View as Markdown

Request

{
  "policy": {
    "description": "My federation policy description.",
    "oidc_policy": {}
  }
}

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Update GA

PATCH /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

Update account federation policy.

API scopes: authentication

Parameters

account_idstringRequiredpath

The account id for the federation policy.

policy_idstringRequiredpath

The identifier for the federation policy.

Example: my-federation-policy

service_principal_idint64Requiredquery

The service principal id for the federation policy.

update_maskstringquery

The field mask specifies which fields of the policy to update. To specify multiple fields in the field mask, use comma as the separator (no space). The special value '*' indicates that all fields should be updated (full replacement). If unspecified, all fields that are set in the policy provided in the update request will overwrite the corresponding fields in the existing policy. Example value: 'description,oidc_policy.audiences'.

Request body

policyobjectRequired

Show child attributesHide child attributes

descriptionstring

Description of the federation policy.

Example: My federation policy description.

oidc_policyobject

Show child attributesHide child attributes

issuerstring

The required token issuer, as specified in the 'iss' claim of federated tokens.

Example: https://myidp.example.com/oidc

subjectstring

The required token subject, as specified in the subject claim of federated tokens. Must be specified for service principal federation policies. Must not be specified for account federation policies.

audiencesarray of string

The allowed token audiences, as specified in the 'aud' claim of federated tokens. The audience identifier is intended to represent the recipient of the token. Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy, the token is considered a match. If audiences is unspecified, defaults to your <Databricks> account id.

Example: databricks

subject_claimstring

The claim that contains the subject of the token. If unspecified, the default value is 'sub'.

Example: sub

jwks_uristring

URL of the public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

jwks_jsonstring

The public keys used to validate the signature of federated tokens, in JWKS format. Most use cases should not need to specify this field. If jwks_uri and jwks_json are both unspecified (recommended), <Databricks> automatically fetches the public keys from your issuer’s well known endpoint. Databricks strongly recommends relying on your issuer’s well known endpoint for discovering public keys.

Response

Returns the FederationPolicy object.

View as Markdown

Request

{
  "policy": {
    "description": "My federation policy description.",
    "oidc_policy": {}
  }
}

Response

{
  "name": "string",
  "description": "My federation policy description.",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject": "string",
    "audiences": "databricks",
    "subject_claim": "sub",
    "jwks_uri": "string",
    "jwks_json": "string"
  },
  "create_time": "string",
  "update_time": "string",
  "uid": "string",
  "service_principal_id": 0,
  "policy_id": "string"
}

Delete GA

DELETE /api/2.0/accounts/{account_id}/federationPolicies/{policy_id}

Delete account federation policy.

API scopes: authentication

Parameters

account_idstringRequiredpath

The account id for the federation policy.

policy_idstringRequiredpath

The identifier for the federation policy.

Example: my-federation-policy

service_principal_idint64Requiredquery

The service principal id for the federation policy.

View as Markdown

Response

{}