# Generate Temporary Table Credential

Launch stage: GA

`POST /api/2.0/unity-catalog/temporary-table-credentials`

Get a short-lived credential for directly accessing the table data on cloud storage.
 The metastore must have **external_access_enabled** flag set to true (default false).
 The caller must have the **EXTERNAL_USE_SCHEMA** privilege on the parent schema and this privilege can only be granted
 by catalog owners.

API scopes: unity-catalog

## Request body

- `table_id` (string, optional)
  UUID of the table to read or write.
- `operation` (string, optional)
  The operation performed against the table data, either READ or READ_WRITE. If READ_WRITE is specified,
   the credentials returned will have write permissions, otherwise, it will be read only.
  Possible values: `READ`, `READ_WRITE`

## Returns

- `aws_temp_credentials` (object, required)
  - `access_key_id` (string, optional)
    The access key ID that identifies the temporary credentials.
  - `secret_access_key` (string, optional)
    The secret access key that can be used to sign AWS API requests.
  - `session_token` (string, optional)
    The token that users must pass to AWS API to use the temporary credentials.
  - `access_point` (string, optional)
    The Amazon Resource Name (ARN) of the S3 access point for
     temporary credentials related the external location.
- `azure_user_delegation_sas` (object, required)
  - `sas_token` (string, optional)
    The signed URI (SAS Token) used to access blob services for a given path
- `gcp_oauth_token` (object, required)
  - `oauth_token` (string, optional)
- `azure_aad` (object, required)
  - `aad_token` (string, optional)
    Opaque token that contains claims that you can use in Azure Active Directory to access cloud services.
- `r2_temp_credentials` (object, required)
  - `access_key_id` (string, optional)
    The access key ID that identifies the temporary credentials.
  - `secret_access_key` (string, optional)
    The secret access key associated with the access key.
  - `session_token` (string, optional)
    The generated JWT that users must pass to use the temporary credentials.
- `expiration_time` (int64, optional)
  Server time when the credential will expire, in epoch milliseconds.
   The API client is advised to cache the credential given this expiration time.
- `url` (string, optional)
  The URL of the storage path accessible by the temporary credential.

## Response

```json
{
  "aws_temp_credentials": {
    "access_key_id": "string",
    "secret_access_key": "string",
    "session_token": "string",
    "access_point": "string"
  },
  "azure_user_delegation_sas": {
    "sas_token": "string"
  },
  "gcp_oauth_token": {
    "oauth_token": "string"
  },
  "azure_aad": {
    "aad_token": "string"
  },
  "r2_temp_credentials": {
    "access_key_id": "string",
    "secret_access_key": "string",
    "session_token": "string"
  },
  "expiration_time": 0,
  "url": "string"
}
```