# Generate Temporary Service Credential

Launch stage: GA

`POST /api/2.1/unity-catalog/temporary-service-credentials`

Returns a set of temporary credentials generated using the specified service credential.
 The caller must be a metastore admin or have the metastore privilege **ACCESS** on the service credential.

API scopes: unity-catalog

**AWS**

Returns a set of temporary credentials generated using the specified service credential.
The caller must be a metastore admin or have the metastore privilege **ACCESS** on the service credential.

The temporary credentials consist of an access key ID, a secret access key, and a security token.

**Azure**

Returns a set of temporary credentials generated using the specified service credential.
The caller must be a metastore admin or have the metastore privilege **ACCESS** on the service credential.

The temporary credentials consist of an AAD token.

## Request body

- `credential_name` (string, optional)
  The name of the service credential used to generate a temporary credential
- `azure_options` (object, required)
  - `resources` (array of string, optional)
    The resources to which the temporary Azure credential should apply. These resources
     are the scopes that are passed to the token provider (see https://learn.microsoft.com/python/api/azure-core/azure.core.credentials.tokencredential?view=azure-python)
- `gcp_options` (object, required)
  - `scopes` (array of string, optional)
    The scopes to which the temporary GCP credential should apply. These resources
     are the scopes that are passed to the token provider (see
     https://google-auth.readthedocs.io/en/latest/reference/google.auth.html#google.auth.credentials.Credentials)

## Returns

- `aws_temp_credentials` (object, required)
  - `access_key_id` (string, optional)
    The access key ID that identifies the temporary credentials.
  - `secret_access_key` (string, optional)
    The secret access key that can be used to sign AWS API requests.
  - `session_token` (string, optional)
    The token that users must pass to AWS API to use the temporary credentials.
  - `access_point` (string, optional)
    The Amazon Resource Name (ARN) of the S3 access point for
     temporary credentials related the external location.
- `azure_user_delegation_sas` (object, required)
  - `sas_token` (string, optional)
    The signed URI (SAS Token) used to access blob services for a given path
- `gcp_oauth_token` (object, required)
  - `oauth_token` (string, optional)
- `azure_aad` (object, required)
  - `aad_token` (string, optional)
    Opaque token that contains claims that you can use in Azure Active Directory to access cloud services.
- `r2_temp_credentials` (object, required)
  - `access_key_id` (string, optional)
    The access key ID that identifies the temporary credentials.
  - `secret_access_key` (string, optional)
    The secret access key associated with the access key.
  - `session_token` (string, optional)
    The generated JWT that users must pass to use the temporary credentials.
- `expiration_time` (int64, optional)
  Server time when the credential will expire, in epoch milliseconds.
   The API client is advised to cache the credential given this expiration time.
- `url` (string, optional)
  The URL of the storage path accessible by the temporary credential.

## Response

```json
{
  "aws_temp_credentials": {
    "access_key_id": "string",
    "secret_access_key": "string",
    "session_token": "string",
    "access_point": "string"
  },
  "azure_user_delegation_sas": {
    "sas_token": "string"
  },
  "gcp_oauth_token": {
    "oauth_token": "string"
  },
  "azure_aad": {
    "aad_token": "string"
  },
  "r2_temp_credentials": {
    "access_key_id": "string",
    "secret_access_key": "string",
    "session_token": "string"
  },
  "expiration_time": 0,
  "url": "string"
}
```