---
title: "Get an API credential"
method: GET
path: "/v2/api-credentials/{apiCredentialId}"
tags: ["API credentials"]
---

# Get an API credential

`GET /v2/api-credentials/{apiCredentialId}`

## Request

- Base URL: `https://api.sigmacomputing.com`
- URL: `https://api.sigmacomputing.com/v2/api-credentials/{apiCredentialId}`
- Auth: HTTP bearer

This endpoint returns nonsensitive details for a single API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).

### Usage notes
- The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have at least **Can view** access on the credential.
- Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint.
- Secret fields (passwords, tokens, client secrets, secret access keys) are never returned.

### Usage scenarios
- **Credential inspection:** Retrieve the configuration of a credential to verify its settings before using it with a connector.

## Path parameters

- `apiCredentialId` string, required

## Response `200`

The response body.

- ApiCredentialsGetApiCredentialResponse200
  - `apiCredentialId` string, required: Unique identifier of the API credential.
  - `name` string, required: Display name of the credential.
  - `authMethod` 'basic' | 'bearer' | 'apiKey' | 'oAuthClientCredentials' | 'oAuthAuthorizationCode' | 'oAuthPasswordCredentials' | 'awsSigV4', required: Authentication method the credential uses.
  - `allowlist` string[], required: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against.
  - `credential` union, required: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential0
      - `authMethod` 'basic', required
      - `basic` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf0Basic
        - `username` string, required: Username for Basic authentication.
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential1
      - `authMethod` 'bearer', required
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential2
      - `authMethod` 'apiKey', required
      - `apiKey` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf2ApiKey
        - `key` string, required: Header or query parameter name carrying the API key.
        - `isQueryParam` boolean, required: Whether the key is sent as a query parameter; if false, it is sent as a header.
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential3
      - `authMethod` 'oAuthClientCredentials', required
      - `oAuthClientCredentials` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentials
        - `clientId` string, required: OAuth client ID.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes requested at token exchange.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential4
      - `authMethod` 'oAuthAuthorizationCode', required
      - `oAuthAuthorizationCode` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf4OAuthAuthorizationCode
        - `clientId` string, required: OAuth client ID.
        - `authorizationUrl` string, required: OAuth authorization endpoint URL.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential5
      - `authMethod` 'oAuthPasswordCredentials', required
      - `oAuthPasswordCredentials` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf5OAuthPasswordCredentials
        - `username` string, required: OAuth resource-owner username.
        - `accessTokenUrl` string, required: OAuth token endpoint URL.
        - `scopes` string[], required: OAuth scopes.
        - `accessTokenAuthMethod` 'httpBasic' | 'requestBody', required: How client credentials are presented to the token endpoint.
        - `clientId` string: OAuth client ID.
    - V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential6
      - `authMethod` 'awsSigV4', required
      - `awsSigV4` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4
        - `accessKeyId` string, required: AWS access key ID.
        - `region` string: AWS region for SigV4 signing.
        - `service` string: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
        - `temporaryCredentialsUrl` string: URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
        - `temporaryCredentialsResponseMapping` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsResponseMapping
          - `accessKeyField` string
          - `secretKeyField` string
          - `sessionTokenField` string
          - `expirationField` string
        - `temporaryCredentialsRequestParams` V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsRequestParamsItems[]: Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`).
          - `key` string, required
          - `value` string, required
          - `sendIn` 'queryParam' | 'body' | 'header', required
  - `createdBy` string, required: The identifier of the user who created this object.
  - `updatedBy` string, required: The identifier of the user or process that last updated this object.
  - `createdAt` string, date-time, required: When the object was created.
  - `updatedAt` string, date-time, required: When the object was last updated.
  - `description` string: Human-readable description.

---

[API](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api.md) - [All operations](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sigmacomputing/apis/sigma-rest-api/revisions/fb6036208c49?raw)