# Validate Credential

Launch stage: GA

`POST /api/2.1/unity-catalog/validate-credentials`

Validates a credential.

 For service credentials (purpose is **SERVICE**), either the __credential_name__ or the cloud-specific credential
 must be provided.

 For storage credentials (purpose is **STORAGE**), at least one of __external_location_name__ and __url__ need to be
 provided. If only one of them is provided, it will be used for validation. And if both are provided, the __url__
 will be used for validation, and __external_location_name__ will be ignored when checking overlapping urls. Either
 the __credential_name__ or the cloud-specific credential must be provided.

 The caller must be a metastore admin or the credential owner or have the required permission on the metastore and
 the credential (e.g., **CREATE_EXTERNAL_LOCATION** when purpose is **STORAGE**).

API scopes: unity-catalog

## Request body

- `credential_name` (string, required)
  Required. The name of an existing credential or long-lived cloud
   credential to validate.
- `aws_iam_role` (object, required)
  - `role_arn` (string, optional)
    The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials.
  - `unity_catalog_iam_arn` (string, optional)
    The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>.
     This is the identity that is going to assume the AWS IAM role.
  - `external_id` (string, optional)
    The external ID used in role assumption to prevent the confused deputy problem.
- `azure_managed_identity` (object, required)
  - `access_connector_id` (string, optional)
    The Azure resource ID of the Azure Databricks Access Connector. Use the format
     `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.
  - `managed_identity_id` (string, optional)
    The Azure resource ID of the managed identity. Use the format,
     `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`
     This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.
     If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.
  - `credential_id` (string, optional)
    The <Databricks> internal ID that represents this managed identity.
- `databricks_gcp_service_account` (object, required)
  - `email` (string, optional)
    The email of the service account.
  - `private_key_id` (string, optional)
    The ID that represents the private key for this Service Account
  - `credential_id` (string, optional)
    The <Databricks> internal ID that represents this managed identity.
- `external_location_name` (string, optional)
  The name of an existing external location to validate. Only applicable for
   storage credentials (purpose is
   **STORAGE**.)
- `url` (string, optional)
  The external location url to validate. Only applicable when purpose is
   **STORAGE**.
- `read_only` (boolean, optional)
  Whether the credential is only usable for read operations. Only applicable
   for storage credentials (purpose is
   **STORAGE**.)

## Returns

- `results` (array of object, optional)
  The results of the validation check.
  - `result` (string, optional)
    The results of the tested operation.
    Possible values: `PASS`, `FAIL`, `SKIP`
  - `message` (string, optional)
    Error message would exist when the result does not equal to **PASS**.
- `isDir` (boolean, optional)
  Whether the tested location is a directory in cloud storage. Only
   applicable for when purpose is **STORAGE**.

## Response

```json
{
  "results": [
    {
      "result": "string",
      "message": "string"
    }
  ],
  "isDir": true
}
```