Datasources

Rotate datasource instance credentials

Changed on

Rotates the credentials that a datasource instance uses to connect to its upstream system. Replaces the active credential material with the supplied values and returns the credential status after rotation. Access is limited to callers with the ADMIN scope; the handler enforces this check. Only keys recognized as credential material for the datasource type may be set in credentials.values (e.g. clientSecret, apiToken, privateKey, depending on the configured auth method). Unrecognized keys, or keys that correspond to non-credential configuration, cause a 400; other instance configuration must be updated via PATCH /configure/datasources/{datasourceId}/instances/{instanceId}.

post/rest/api/v1/datasource/{datasourceInstanceId}/credentials

Request

  • Base URL: https://instance-name-be.glean.com
  • URL: https://instance-name-be.glean.com/rest/api/v1/datasource/{datasourceInstanceId}/credentials
  • Auth: HTTP bearer

Path parameters

datasourceInstanceIdstring required
Example:o365sharepoint_abc123

The full datasource instance identifier (e.g. o365sharepoint_abc123)

Request body

Response

OK

status'VALID' | 'VALID_WITH_WARNINGS' | 'VALIDATING' | 'INVALID' | 'MISSING' required

Lifecycle state of the credentials installed for a datasource instance. Mirrors the internal admin Status enum so the handler can surface the same health signals already tracked today. EXPIRING_SOON is represented as VALID_WITH_WARNINGS (with detail in message); EXPIRED is surfaced as INVALID plus a non-null expiresAt in the past.

lastRotatedAtstring date-time

When the credentials were last rotated. Omitted when not known.

expiresAtstring date-time

When the active credentials expire. Omitted when not known or not applicable to this credential type.

messagestring

Optional human-readable detail about the current credential status.

Changes