secrets-uc command group
Databricks CLI use is subject to the Databricks License and Databricks Privacy Notice, including any Usage Data provisions.
This feature is in Public Preview.
The secrets-uc command group within the Databricks CLI manages Unity Catalog secrets. A secret is a Unity Catalog securable object that stores sensitive credential data (such as passwords, tokens, and keys) within a three-level namespace (catalog_name.schema_name.secret_name). Secrets can be managed using standard Unity Catalog permissions and are scoped to a schema within a catalog.
databricks secrets-uc create-secret
Creates a new secret in Unity Catalog. You must be the owner of the parent schema or have the CREATE_SECRET and USE SCHEMA privileges on the parent schema and USE CATALOG on the parent catalog. The secret is stored in the specified catalog and schema, and the value field contains the sensitive data to be securely stored.
databricks secrets-uc create-secret NAME CATALOG_NAME SCHEMA_NAME VALUE [flags]
Arguments
NAME
The name of the secret, relative to its parent schema.
CATALOG_NAME
The name of the catalog where the schema and the secret reside.
SCHEMA_NAME
The name of the schema where the secret resides.
VALUE
The secret value to store. This field is input-only and is not returned in responses — use the effective_value field (via GetSecret with include_value set to true) to read the secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes passwords, tokens, keys, and other sensitive credential data.
Options
--comment string
User-provided free-form text description of the secret.
--expire-time string
User-provided expiration time of the secret.
--json JSON
The inline JSON string or the @path to the JSON file with the request body.
--owner string
The owner of the secret.
databricks secrets-uc delete-secret
Deletes a secret by its three-level (fully qualified) name. You must be the owner of the secret or a metastore admin.
databricks secrets-uc delete-secret FULL_NAME [flags]
Arguments
FULL_NAME
The three-level (fully qualified) name of the secret (for example, catalog_name.schema_name.secret_name).
Options
databricks secrets-uc get-secret
Gets a secret by its three-level (fully qualified) name. You must be a metastore admin, the owner of the secret, or have the MANAGE privilege on the secret. The secret value isn't returned by default. To retrieve it, you must also have the READ_SECRET privilege and set include_value to true in the request.
databricks secrets-uc get-secret FULL_NAME [flags]
Arguments
FULL_NAME
The three-level (fully qualified) name of the secret (for example, catalog_name.schema_name.secret_name).
Options
databricks secrets-uc list-secrets
Lists secrets in Unity Catalog. You must be a metastore admin, the owner of the secret, or have the MANAGE privilege on the secret. Both catalog_name and schema_name must be specified together to filter secrets within a specific schema. Results are paginated; use the page_token field from the response to retrieve subsequent pages.
databricks secrets-uc list-secrets [flags]
Options
--catalog-name string
The name of the catalog under which to list secrets.
--limit int
Maximum number of results to return.
--page-size int
Maximum number of secrets to return.
--schema-name string
The name of the schema under which to list secrets.
databricks secrets-uc update-secret
Updates an existing secret in Unity Catalog. You must be the owner of the secret or a metastore admin. If you are a metastore admin, only the owner field can be changed. Use the update_mask field to specify which fields to update. Supported updatable fields include value, comment, owner, and expire_time.
databricks secrets-uc update-secret FULL_NAME UPDATE_MASK NAME CATALOG_NAME SCHEMA_NAME VALUE [flags]
Arguments
FULL_NAME
The three-level (fully qualified) name of the secret (for example, catalog_name.schema_name.secret_name).
UPDATE_MASK
The field mask specifying which fields of the secret to update. If update_mask is "*", all fields specified in secret are updated. If update_mask specifies one or more fields, only those fields are updated. Each specified field must be set in secret. Supported fields: value, comment, owner, expire_time. To change the secret name, delete and recreate the secret.
NAME
The name of the secret, relative to its parent schema.
CATALOG_NAME
The name of the catalog where the schema and the secret reside.
SCHEMA_NAME
The name of the schema where the secret resides.
VALUE
The secret value to store. This field is input-only and is not returned in responses — use the effective_value field (via GetSecret with include_value set to true) to read the secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes passwords, tokens, keys, and other sensitive credential data.
Options
--comment string
User-provided free-form text description of the secret.
--expire-time string
User-provided expiration time of the secret.
--json JSON
The inline JSON string or the @path to the JSON file with the request body.
--owner string
The owner of the secret.
Global flags
--debug
Whether to enable debug logging.
-h or --help
Display help for the Databricks CLI or the related command group or the related command.
--log-file string
A string representing the file to write output logs to. If this flag is not specified then the default is to write output logs to stderr.
--log-format format
The log format type, text or json. The default value is text.
--log-level string
A string representing the log format level. If not specified then the log format level is disabled.
-o, --output type
The command output type, text or json. The default value is text.
-p, --profile string
The name of the profile in the ~/.databrickscfg file to use to run the command. If this flag is not specified then if it exists, the profile named DEFAULT is used.
--progress-format format
The format to display progress logs: default, append, inplace, or json
-t, --target string
If applicable, the bundle target to use