---
title: "Read a connection's setup"
method: GET
path: "/v1/storage-connections/{id}/setup"
tags: ["Workspaces"]
---

# Read a connection's setup

`GET /v1/storage-connections/{id}/setup`

## Request

- Base URL: `https://console.nace.ai`
- URL: `https://console.nace.ai/v1/storage-connections/{id}/setup`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/nace/apis/drex-api/docs/v1/storage-connections/:id/setup/get.ts> (a function with typed inputs; its response is checked against the schema)

What to create in your cloud so Nace can reach the destination: for S3, an IAM role trust policy carrying the connection's `external_id`, its permissions policy, a CloudFormation template and quick-create link; for Azure, the CLI commands that give a service principal access to the container. Generated from the saved `options`. Free. Only where customer storage is on for the deployment; where it is off, every storage connection route answers `404 storage_connection_unavailable` once the API key is accepted, before checking the request or its body.

## Path parameters

- `id` string, uuid, required

## Response `200`

The setup.

- StorageConnectionSetup
  - `options` union, required
    - S3SetupOptions
      - `type` 's3', required
      - `access_method` 'auto' | 'manual': `auto` for the CloudFormation stack, `manual` to write the role yourself.
      - `aws_account_id` string, nullable: The AWS account the role is created in.
      - `role_name` string, nullable: The name of the role the stack creates.
      - `kms_key_arn` string, nullable: A KMS key the role may use; the bucket's settings decide encryption.
    - AzureSetupOptions
      - `type` 'azure_blob', required
      - `subscription_id` string, uuid, nullable: The subscription the storage account is in.
      - `resource_group` string, nullable: The resource group the storage account is in.
      - `tenant_id` string, uuid, nullable: Your Microsoft Entra tenant.
      - `client_id` string, uuid, nullable: The application (client) id to give access to.
  - `trust_policy` string, nullable: S3: the IAM role trust policy, as JSON.
  - `permissions_policy` string, nullable: S3: the IAM permissions policy for the bucket and any KMS key, as JSON.
  - `cloudformation_template` string, nullable: S3: a CloudFormation template that creates the role, as JSON.
  - `launch_url` string, nullable: S3: an AWS console link that opens that stack, once the account id and role name are saved.
  - `role_arn` string, nullable: S3: the ARN the stack's role will have.
  - `azure_cli` string, nullable: Azure: the `az` commands that give the service principal access to the container.

## Other responses

- `401`: Missing or invalid API key (`authentication_error`, code `invalid_api_key`).
- `403`: Only the connection's creator, or an owner or admin of the account, can do this (`permission_error`, code `access_denied`).
- `404`: Customer storage is off on this deployment, which every storage connection route answers once the API key is accepted and before checking the request, or no such connection for this account (`not_found_error`, code `storage_connection_unavailable`).
- `429`: Over the account's requests per minute for document routes (`rate_limit_error`).
- `500`: Something failed on Drex's side (`internal_error`).
- `502`: The document service refused Drex's own request (`upstream_error`, code `ndi_refused_drex`). Retry later.
- `503`: The document service is unavailable (`service_unavailable`).

---

[API](https://skmtc.dev/nace/apis/drex-api.md) - [All operations](https://skmtc.dev/nace/apis/drex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nace/apis/drex-api/revisions/a0e62d925a61?raw)