---
title: "Describe credentials"
method: GET
path: "/credentials/{credentialsId}"
tags: ["credentials"]
---

# Describe credentials

`GET /credentials/{credentialsId}`

Retrieves the details of the credentials identified by the given `credentialsId`.

## Path parameters

- `credentialsId` string, required

## Query parameters

- `workspaceId` integer

## Response `200`

OK

- DescribeCredentialsResponse
  - `credentials` Credentials
    - `baseUrl` string, nullable
    - `category` string, nullable
    - `dateCreated` string, date-time
    - `deleted` boolean, nullable
    - `description` string, nullable
    - `id` string
    - `keys` union
      - object
        - `discriminator` string
        - `accessKey` string, nullable
        - `assumeRoleArn` string, nullable
        - `externalId` string, nullable
        - `mode` 'keys' | 'role' | 'workloadIdentity'
        - `secretKey` string
      - object
        - `discriminator` string
        - `data` string
        - `serviceAccountEmail` string
        - `tokenAudience` string
        - `workloadIdentityProvider` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `appId` string
        - `clientId` string
        - `clientSecret` string
        - `privateKey` string
        - `slug` string
        - `webhookSecret` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `passphrase` string
        - `privateKey` string
      - object
        - `discriminator` string
        - `certificate` string
        - `privateKey` string
        - `token` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `storageKey` string
        - `storageName` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `clientId` string
        - `clientSecret` string
        - `storageKey` string
        - `storageName` string
        - `subscriptionId` string
        - `tenantId` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `registry` string
        - `userName` string
      - object
        - `discriminator` string
        - `connectionId` string
        - `shared` boolean
        - `workDir` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `clientId` string
        - `clientSecret` string
        - `storageKey` string
        - `storageName` string
        - `tenantId` string
      - object
        - `discriminator` string
        - `accessKey` string, nullable
        - `assumeRoleArn` string, nullable
        - `externalId` string, nullable
        - `mode` 'keys' | 'role' | 'workloadIdentity'
        - `secretKey` string
      - object
        - `discriminator` string
        - `accessKey` string
        - `pathStyleAccessEnabled` boolean
        - `secretKey` string
      - object
        - `discriminator` string
        - `password` string
    - `lastUpdated` string, date-time
    - `lastUsed` string, date-time, nullable
    - `lastValidated` string, date-time, nullable — Timestamp of the most recent completed validation probe (success or authoritative fail). Null until first probe. NOT advanced on transient probe outcomes.
    - `message` string, nullable — Provider-supplied error detail captured when status transitions to INVALID. Cleared (null) whenever status returns to AVAILABLE. Truncated to 4096 characters with a trailing " (truncated)" suffix when the underlying provider message exceeds that limit.
    - `name` string, required
    - `provider` 'aws' | 'azure' | 'azure_entra' | 'google' | 'github' | 'github_app' | 'gitlab' | 'bitbucket' | 'ssh' | 'k8s' | 'container-reg' | 'tw-agent' | 'codecommit' | 'gitea' | 'azurerepos' | 'seqeracompute' | 'azure-cloud' | 's3', required
    - `status` 'AVAILABLE' | 'INVALID'
  - `setupSnippet` string, nullable — Server-rendered, read-only provider-side setup snippet (e.g. AWS IAM role trust policy) to paste at the cloud provider. Populated when a renderer is available for the credential type and the installation is configured for it; otherwise omitted.

## Other responses

- `400` — Bad request
- `403` — Operation not allowed

## Changes

> 14 revisions in range; 1 not diffed, 3 could not be searched.

- **2026-07-09** `aa8544683897` — 4 info
  - added the optional property `credentials/lastValidated` to the response with the `200` status
  - added the optional property `credentials/message` to the response with the `200` status
  - added the optional property `credentials/status` to the response with the `200` status
  - added the optional property `setupSnippet` to the response with the `200` status
- **2026-04-20** `b2b5cc41d473` — 1 breaking, 1 warning, 4 info
  - added `#/components/schemas/GitHubAppSecurityKeys` to the `credentials/keys` response property `oneOf` list for the response status `200`
  - added the new `github_app` enum value to the `credentials/provider` response property for the response status `200`
  - added the optional property `credentials/keys/oneOf[subschema #2: Google credentials]/serviceAccountEmail` to the response with the `200` status
  - added the optional property `credentials/keys/oneOf[subschema #2: Google credentials]/tokenAudience` to the response with the `200` status
  - …2 more
- …earlier changes not shown

[Full history](https://skmtc.dev/seqeralabs/apis/seqera-api/changes/credentials/:credentialsId/get.md)

---

[API](https://skmtc.dev/seqeralabs/apis/seqera-api.md) · [All operations](https://skmtc.dev/seqeralabs/apis/seqera-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/seqeralabs/seqera-api/revisions/97f7655d105a/schema)