# Create

Launch stage: GA

`POST /api/2.0/data-sharing/recipients/{recipient_name}/federation-policies`

Create a federation policy for an OIDC_FEDERATION recipient for sharing data from <Databricks> to non-<Databricks> recipients.
 The caller must be the owner of the recipient.
 When sharing data from <Databricks> to non-<Databricks> clients,
 you can define a federation policy to authenticate non-<Databricks> recipients.
 The federation policy validates OIDC claims in federated tokens and is defined at the recipient level.
 This enables secretless sharing clients to authenticate using OIDC tokens.

 Supported scenarios for federation policies:
 1. **User-to-Machine (U2M) flow** (e.g., PowerBI): A user accesses a resource using their own identity.
 2. **Machine-to-Machine (M2M) flow** (e.g., OAuth App): An OAuth App accesses a resource using its own identity,
    typically for tasks like running nightly jobs.

 For an overview, refer to:
 - Blog post: Overview of feature: https://www.databricks.com/blog/announcing-oidc-token-federation-enhanced-delta-sharing-security

 For detailed configuration guides based on your use case:
   - Creating a Federation Policy as a provider: https://docs.databricks.com/en/delta-sharing/create-recipient-oidc-fed
   - Configuration and usage for Machine-to-Machine (M2M) applications (e.g., Python Delta Sharing Client): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-m2m
   - Configuration and usage for User-to-Machine (U2M) applications (e.g., PowerBI): https://docs.databricks.com/aws/en/delta-sharing/sharing-over-oidc-u2m

API scopes: sharing

## Path parameters

- `recipient_name` (string, optional)
  Name of the recipient. This is the name of the recipient for which the policy is being created.

## Request body

- `policy` (object, optional)
  Name of the policy. This is the name of the policy to be created.
  - `name` (string, optional)
    Name of the federation policy. A recipient can have multiple policies with different names.
     The name must contain only lowercase alphanumeric characters, numbers, and hyphens.
    Example: `my-federation-policy1`
  - `oidc_policy` (object, required)
    Specifies the policy to use for validating OIDC claims in the federated tokens.
    - `issuer` (string, optional)
      The required token issuer, as specified in the 'iss' claim of federated tokens.
      Example: `https://myidp.example.com/oidc`
    - `subject_claim` (string, optional)
      The claim that contains the subject of the token.
       Depending on the identity provider and the use case (U2M or M2M), this can vary:
       - For Entra ID (AAD):
         * U2M flow (group access): Use `groups`.
         * U2M flow (user access): Use `oid`.
         * M2M flow (OAuth App access): Use `azp`.
       - For other IdPs, refer to the specific IdP documentation.
      
       Supported `subject_claim` values are:
       - `oid`: Object ID of the user.
       - `azp`: Client ID of the OAuth app.
       - `groups`: Object ID of the group.
       - `sub`: Subject identifier for other use cases.
      Example: `azp`
    - `subject` (string, optional)
      The required token subject, as specified in the subject claim of federated tokens.
       The subject claim identifies the identity of the user or machine accessing the resource.
       Examples for Entra ID (AAD):
       - U2M flow (group access): If the subject claim is `groups`, this must be the Object ID of the group in Entra ID.
       - U2M flow (user access): If the subject claim is `oid`, this must be the Object ID of the user in Entra ID.
       - M2M flow (OAuth App access): If the subject claim is `azp`, this must be the client ID of the OAuth app registered in Entra ID.
    - `audiences` (array of string, optional)
      The allowed token audiences, as specified in the 'aud' claim of federated tokens.
       The audience identifier is intended to represent the recipient of the token.
       Can be any non-empty string value. As long as the audience in the token matches at least one audience in the policy,
  - `create_time` (string, optional)
    System-generated timestamp indicating when the policy was created.
  - `comment` (string, optional)
    Description of the policy. This is a user-provided description.
    Example: `My federation policy description.`
  - `update_time` (string, optional)
    System-generated timestamp indicating when the policy was last updated.
  - `id` (string, optional)
    Unique, immutable system-generated identifier for the federation policy.

## Returns

Returns the FederationPolicy object.

## Response

```json
{
  "name": "my-federation-policy1",
  "oidc_policy": {
    "issuer": "https://myidp.example.com/oidc",
    "subject_claim": "azp",
    "subject": "string",
    "audiences": [
      "string"
    ]
  },
  "create_time": "string",
  "comment": "My federation policy description.",
  "update_time": "string",
  "id": "string"
}
```