---
title: "Save a connection's setup options"
method: PUT
path: "/v1/storage-connections/{id}/setup"
tags: ["Workspaces"]
---

# Save a connection's setup options

`PUT /v1/storage-connections/{id}/setup`

## Request

- Base URL: `https://console.nace.ai`
- URL: `https://console.nace.ai/v1/storage-connections/{id}/setup`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/nace/apis/drex-api/docs/v1/storage-connections/:id/setup/put.ts> (a function with typed inputs; its response is checked against the schema)

Save the non-secret inputs the setup is generated from, such as the AWS account and role name, or the Azure subscription and resource group, and get the setup back. Its `type` must match the destination's. Free. Only where customer storage is on for the deployment; where it is off, every storage connection route answers `404 storage_connection_unavailable` once the API key is accepted, before checking the request or its body.

## Path parameters

- `id` string, uuid, required

## Request body

- union
  - S3SetupOptions
    - `type` 's3', required
    - `access_method` 'auto' | 'manual': `auto` for the CloudFormation stack, `manual` to write the role yourself.
    - `aws_account_id` string, nullable: The AWS account the role is created in.
    - `role_name` string, nullable: The name of the role the stack creates.
    - `kms_key_arn` string, nullable: A KMS key the role may use; the bucket's settings decide encryption.
  - AzureSetupOptions
    - `type` 'azure_blob', required
    - `subscription_id` string, uuid, nullable: The subscription the storage account is in.
    - `resource_group` string, nullable: The resource group the storage account is in.
    - `tenant_id` string, uuid, nullable: Your Microsoft Entra tenant.
    - `client_id` string, uuid, nullable: The application (client) id to give access to.

## Response `200`

The setup, generated from the saved options.

- StorageConnectionSetup
  - `options` union, required
    - S3SetupOptions
      - `type` 's3', required
      - `access_method` 'auto' | 'manual': `auto` for the CloudFormation stack, `manual` to write the role yourself.
      - `aws_account_id` string, nullable: The AWS account the role is created in.
      - `role_name` string, nullable: The name of the role the stack creates.
      - `kms_key_arn` string, nullable: A KMS key the role may use; the bucket's settings decide encryption.
    - AzureSetupOptions
      - `type` 'azure_blob', required
      - `subscription_id` string, uuid, nullable: The subscription the storage account is in.
      - `resource_group` string, nullable: The resource group the storage account is in.
      - `tenant_id` string, uuid, nullable: Your Microsoft Entra tenant.
      - `client_id` string, uuid, nullable: The application (client) id to give access to.
  - `trust_policy` string, nullable: S3: the IAM role trust policy, as JSON.
  - `permissions_policy` string, nullable: S3: the IAM permissions policy for the bucket and any KMS key, as JSON.
  - `cloudformation_template` string, nullable: S3: a CloudFormation template that creates the role, as JSON.
  - `launch_url` string, nullable: S3: an AWS console link that opens that stack, once the account id and role name are saved.
  - `role_arn` string, nullable: S3: the ARN the stack's role will have.
  - `azure_cli` string, nullable: Azure: the `az` commands that give the service principal access to the container.

## Other responses

- `401`: Missing or invalid API key (`authentication_error`, code `invalid_api_key`).
- `403`: Only the connection's creator, or an owner or admin of the account, can do this (`permission_error`, code `access_denied`).
- `404`: Customer storage is off on this deployment, which every storage connection route answers once the API key is accepted and before checking the request, or no such connection for this account (`not_found_error`, code `storage_connection_unavailable`).
- `413`: The body is over 16 KB (`invalid_request_error`, code `payload_too_large`). It is read only once the connection is found and the key may change it, so an unknown connection answers `404` and someone else's change `403` first.
- `422`: The options are invalid (`invalid_request_error`).
- `429`: Over the account's requests per minute for document routes (`rate_limit_error`).
- `500`: Something failed on Drex's side (`internal_error`).
- `502`: The document service refused Drex's own request (`upstream_error`, code `ndi_refused_drex`). Retry later.
- `503`: The document service is unavailable (`service_unavailable`).

---

[API](https://skmtc.dev/nace/apis/drex-api.md) - [All operations](https://skmtc.dev/nace/apis/drex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/nace/apis/drex-api/revisions/a0e62d925a61?raw)