buckets

Rotate bucket credentials

Replace a bucket's stored credentials.

Only available for access_key buckets — assume_role buckets store no credentials (manage access via the role's trust policy instead). The new credentials are re-validated against the bucket's existing (immutable) identity before they are persisted. The credentials version is bumped so cached storage clients rebuild.

Args: bucket_id: The ID of the bucket to rotate credentials for. params: The new bucket access credentials.

Returns: Bucket: The updated bucket. Credentials are never returned.

post/v1/buckets/{bucket_id}/credentials

Request

Base URL
https://api.mixedbread.com
URL
https://api.mixedbread.com/v1/buckets/{bucket_id}/credentials
Auth
HTTP bearer

Path parameters

bucket_idstring uuid required

The ID of the bucket to rotate credentials for

Request body

Response

The bucket with rotated credentials

idstring required

The ID of the bucket

created_atstring date-time required

Creation time

updated_atstring date-time required

Last update time

namestring required

Display name

provider'aws_s3' required

Object-storage provider backing a bring-your-own bucket.

bucketstring required

The bucket name

regionstring nullable required

The bucket region

endpoint_urlstring nullable required

Custom S3-compatible endpoint

prefixstring required

Key prefix within the bucket

sse_kms_key_idstring nullable required

KMS key id/ARN used to encrypt writes (SSE-KMS)

auth_type'assume_role' | 'access_key' required

How omni authenticates against a customer bucket.

ASSUME_ROLE is the recommended default for AWS: nothing secret is stored, every service assumes the customer's IAM role via STS on use. ACCESS_KEY remains for S3-compatible providers that have no STS.

role_arnstring nullable required

IAM role Mixedbread assumes (auth_type=assume_role); not a secret

external_idstring nullable required

sts:ExternalId the role's trust policy must require (auth_type=assume_role); not a secret

status'pending' | 'active' | 'error' required

Validation lifecycle of a customer bucket.

last_validated_atstring date-time nullable required

When the bucket was last validated

has_credentialsboolean required

Whether secret credentials are stored (always false for assume-role buckets)

credentials_versioninteger required

Increments on every credential rotation

object'bucket'

The type of the object

Changes

No recorded changes to this operation across all 44 revisions of this API.