# List Credentials

Launch stage: GA

`GET /api/2.1/unity-catalog/credentials`

Gets an array of credentials (as __CredentialInfo__ objects).

 The array is limited to only the credentials that the caller has permission to access.
 If the caller is a metastore admin, retrieval of credentials is unrestricted.
 There is no guarantee of a specific ordering of the elements in the array.

 PAGINATION BEHAVIOR: The API is by default paginated, a page may contain zero results while still providing a next_page_token.
 Clients must continue reading pages until next_page_token is absent, which is the only indication that the end of results has been reached.

API scopes: unity-catalog

## Query parameters

- `include_unbound` (boolean, optional)
  Whether to include credentials not bound to the workspace.
   Effective only if the user has permission to update the credential–workspace binding.
- `max_results` (int32, optional)
  Maximum number of credentials to return.
     - If not set, the default max page size is used.
     - When set to a value greater than 0, the page length is the minimum of
   this value and a server-configured value.
     - When set to 0, the page length is set to a server-configured value
   (recommended).
     - When set to a value less than 0, an invalid parameter error is
   returned.
- `page_token` (string, optional)
  Opaque token to retrieve the next page of results.

## Returns

- `credentials` (array of object, optional)
  - `name` (string, optional)
    The credential name. The name must be unique among storage and service
     credentials within the metastore.
  - `aws_iam_role` (object, required)
    The AWS IAM role configuration.
    - `role_arn` (string, optional)
      The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.
    - `unity_catalog_iam_arn` (string, optional)
      The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>.
       This is the identity that is going to assume the AWS IAM role.
    - `external_id` (string, optional)
      The external ID used in role assumption to prevent the confused deputy problem.
  - `azure_service_principal` (object, required)
    The Azure service principal configuration.
    - `directory_id` (string, optional)
      The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application.
    - `application_id` (string, optional)
      The application ID of the application registration within the referenced AAD tenant.
    - `client_secret` (string, optional)
      The client secret generated for the above app ID in AAD.
  - `gcp_service_account_key` (object, required)
    - `email` (string, optional)
      The email of the service account.
    - `private_key_id` (string, optional)
      The ID of the service account's private key.
    - `private_key` (string, optional)
      The service account's RSA private key.
  - `azure_managed_identity` (object, required)
    The Azure managed identity configuration.
    - `access_connector_id` (string, optional)
      The Azure resource ID of the Azure Databricks Access Connector. Use the format
       `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.
    - `managed_identity_id` (string, optional)
      The Azure resource ID of the managed identity. Use the format,
       `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`
       This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.
       If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.
    - `credential_id` (string, optional)
      The <Databricks> internal ID that represents this managed identity.
  - `databricks_gcp_service_account` (object, required)
    The <Databricks> managed GCP service account configuration.
    - `email` (string, optional)
      The email of the service account.
    - `private_key_id` (string, optional)
      The ID that represents the private key for this Service Account
    - `credential_id` (string, optional)
      The <Databricks> internal ID that represents this managed identity.
  - `comment` (string, optional)
    Comment associated with the credential.
  - `read_only` (boolean, optional)
    Whether the credential is usable only for read operations. Only applicable
     when purpose is **STORAGE**.
  - `owner` (string, optional)
    Username of current owner of credential.
  - `id` (string, optional)
    The unique identifier of the credential.
  - `metastore_id` (string, optional)
    Unique identifier of the parent metastore.
  - `created_at` (int64, optional)
    Time at which this credential was created, in epoch milliseconds.
  - `created_by` (string, optional)
    Username of credential creator.
  - `updated_at` (int64, optional)
    Time at which this credential was last modified, in epoch milliseconds.
  - `updated_by` (string, optional)
    Username of user who last modified the credential.
  - `used_for_managed_storage` (boolean, optional)
    Whether this credential is the current metastore's root storage credential.
     Only applicable when purpose is **STORAGE**.
  - `full_name` (string, optional)
    The full name of the credential.
  - `isolation_mode` (string, optional)
    Whether the current securable is accessible from all workspaces or a
     specific set of workspaces.
    Possible values: `ISOLATION_MODE_UNSPECIFIED`, `ISOLATION_MODE_OPEN`, `ISOLATION_MODE_ISOLATED`
- `next_page_token` (string, optional)
  Opaque token to retrieve the next page of results. Absent if there are no
   more pages.
   __page_token__ should be set to this value for the next request (for the
   next page of results).

## Response

```json
{
  "credentials": [
    {
      "name": "string",
      "aws_iam_role": {},
      "azure_service_principal": {},
      "gcp_service_account_key": {},
      "azure_managed_identity": {},
      "databricks_gcp_service_account": {},
      "comment": "string",
      "read_only": true,
      "owner": "string",
      "id": "string",
      "metastore_id": "string",
      "created_at": 0,
      "created_by": "string",
      "updated_at": 0,
      "updated_by": "string",
      "used_for_managed_storage": true,
      "full_name": "string",
      "isolation_mode": "string"
    }
  ],
  "next_page_token": "string"
}
```