---
title: "POST /credentials/{namespace}"
method: POST
path: "/credentials/{namespace}"
tags: ["user", "organization"]
---

# POST /credentials/{namespace}

`POST /credentials/{namespace}`

## Request

- Base URL: `/v2` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/v2/credentials/{namespace}`
- Auth: one of:
  - HTTP basic
  - API key in header `X-TILEDB-REST-API-KEY`

Create a new credential for the namespace

## Request body

- AccessCredential: A union type which may contain a credential to access any one cloud provider.
  - `uuid` string: The UUID of the credential
  - `name` string: A user-specified name for the key
  - `provider` 'AWS' | 'AZURE' | 'GCP': A service where data is stored or computations take place.
  - `provider_default` boolean, nullable: True if this is the namespace's default credential to be used when connecting to the given cloud provider. There can be at most one default for each unique provider.
  - `created_at` string, date-time: Time when the credential was created (rfc3339)
  - `updated_at` string, date-time: Time when the credential was last updated (rfc3339)
  - `allowed_in_tasks` boolean, nullable: Is this credential allowed to be used in tasks
  - `credential` object: The credential information itself. Exactly one sub-field may be set. The names match those in the CloudProvider enum.
    - `aws` AWSCredential, nullable: Credential information to access Amazon Web Services
      - `access_key_id` string: The ID of the access key
      - `secret_access_key` string: The access key's secret. Never returned in responses.
      - `endpoint` string, nullable: The endpoint used for this credential
      - `sse_kms_key_id` string, nullable: The key ID, key ARN, or key alias of the AWS KMS key to use with this credential
    - `azure` AzureCredential, nullable: Credential information to access Microsoft Azure. Each supported property is the snake_case version of its name in an Azure Storage connection string.
      - `account_name` string: The name of the Azure account to access
      - `account_key` string: The secret key. Never returned in responses.
    - `gcp` GCPInteroperabilityCredential, nullable: Credential information to access Google Cloud. using well knows key/secret pair to access storage.
      - `access_key_id` string: The ID of the access key
      - `secret_access_key` string: The access key's secret. Never returned in responses.
  - `role` object: The role information itself. Exactly one sub-field may be set. The names match those in the CloudProvider enum.
    - `aws` AWSRole, nullable: Role information to access Amazon Web Services
      - `role_arn` string: The role arn used to access
      - `external_id` string: The role external id used to access
      - `endpoint` string, nullable: The endpoint used for this role
      - `sse_kms_key_id` string, nullable: The key ID, key ARN, or key alias of the AWS KMS key to use with this credential
  - `token` object: The token information itself. Exactly one sub-field may be set. The names match those in the CloudProvider enum.
    - `azure` AzureToken, nullable: Token information to access Azure services
      - `account_name` string: The account name of the configuration
      - `sas_token` string: The token to use for this account
    - `gcp` GCPServiceAccountKey, nullable: The key to a Google Cloud Platform service account.
      - `account_id` string: The ID of the service account (i.e., its email address). This is ignored when uploading key information, and is only provided by the server when downloading metadata about an existing key.
      - `key_id` string: The ID of the particular key. This identifies it among other keys issued for this service account. This is ignored when uploading key information, and is only provided by the server when downloading metadata about an existing key.
      - `key_text` string: The full file provided by Google Cloud. This is usually in the form of a JSON document, but TileDB Cloud treats it as opaque (except to attempt to extract the service account ID and the key ID).

## Response `204`

The new credential was successfully added.

## Other responses

- `502`: Bad Gateway
- `default`: error response

## Changes

- **2023-06-30** (v2) `cc73c130972b`: 1 info
  - added the new optional `query` request parameter `type` to all path's operations
- **2023-06-02** (v2) `648866881a0f`: 1 info
  - added the new optional `query` request parameter `type` to all path's operations
- **2023-02-17** (v2) `1dc25429ac96`: 1 info
  - added the non-success response with the status `502`
- **2023-02-17** (v2) `cb4897d3247d`: 1 info
  - removed the non-success response with the status `502`
- **2022-11-03** (v2) `dd919c4fb5a3`: 1 info
  - added the non-success response with the status `502`

[Operation history](https://skmtc.dev/tiledb/apis/tiledb-storage-platform-api/changes/credentials/:namespace/post.md)

---

[API](https://skmtc.dev/tiledb/apis/tiledb-storage-platform-api.md) - [All operations](https://skmtc.dev/tiledb/apis/tiledb-storage-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tiledb/apis/tiledb-storage-platform-api/revisions/f9cbeb4407a5?raw)