# Generate Temporary Path Credential

Launch stage: GA

`POST /api/2.0/unity-catalog/temporary-path-credentials`

Get a short-lived credential for directly accessing cloud storage locations registered in <Databricks>.
 The Generate Temporary Path Credentials API is only supported for external storage paths, specifically external
 locations and external tables. Managed tables are not supported by this API.
 The metastore must have **external_access_enabled** flag set to true (default false).
 The caller must have the **EXTERNAL_USE_LOCATION** privilege on the external location; this privilege can only be granted
 by external location owners.
 For requests on existing external tables, the caller must also have the **EXTERNAL_USE_SCHEMA** privilege on the parent schema;
 this privilege can only be granted by catalog owners.

API scopes: unity-catalog

## Request body

- `url` (string, optional)
  URL for path-based access.
- `operation` (string, optional)
  The operation being performed on the path.
  Possible values: `PATH_READ`, `PATH_READ_WRITE`, `PATH_CREATE_TABLE`
- `dry_run` (boolean, optional)
  Optional. When set to true, the service will not validate that the generated
   credentials can perform write operations, therefore no new paths will be created
   and the response will not contain valid credentials. Defaults to false.

## Returns

- `aws_temp_credentials` (object, required)
  - `access_key_id` (string, optional)
    The access key ID that identifies the temporary credentials.
  - `secret_access_key` (string, optional)
    The secret access key that can be used to sign AWS API requests.
  - `session_token` (string, optional)
    The token that users must pass to AWS API to use the temporary credentials.
  - `access_point` (string, optional)
    The Amazon Resource Name (ARN) of the S3 access point for
     temporary credentials related the external location.
- `azure_user_delegation_sas` (object, required)
  - `sas_token` (string, optional)
    The signed URI (SAS Token) used to access blob services for a given path
- `gcp_oauth_token` (object, required)
  - `oauth_token` (string, optional)
- `azure_aad` (object, required)
  - `aad_token` (string, optional)
    Opaque token that contains claims that you can use in Azure Active Directory to access cloud services.
- `r2_temp_credentials` (object, required)
  - `access_key_id` (string, optional)
    The access key ID that identifies the temporary credentials.
  - `secret_access_key` (string, optional)
    The secret access key associated with the access key.
  - `session_token` (string, optional)
    The generated JWT that users must pass to use the temporary credentials.
- `expiration_time` (int64, optional)
  Server time when the credential will expire, in epoch milliseconds.
   The API client is advised to cache the credential given this expiration time.
- `url` (string, optional)
  The URL of the storage path accessible by the temporary credential.

## Response

```json
{
  "aws_temp_credentials": {
    "access_key_id": "string",
    "secret_access_key": "string",
    "session_token": "string",
    "access_point": "string"
  },
  "azure_user_delegation_sas": {
    "sas_token": "string"
  },
  "gcp_oauth_token": {
    "oauth_token": "string"
  },
  "azure_aad": {
    "aad_token": "string"
  },
  "r2_temp_credentials": {
    "access_key_id": "string",
    "secret_access_key": "string",
    "session_token": "string"
  },
  "expiration_time": 0,
  "url": "string"
}
```