TOtower

Vend catalog credentials

Changed on

Mints a short-lived OAuth bearer token for browser or SDK access to a managed (tower-catalog) catalog. Defaults to read-only (mode: "read"); pass mode: "read-write" in the body (requires the catalogs:data:write scope) for a token bound to the read-write principal. Team membership is enforced before vending; the master Polaris credentials never leave Tower.

post/catalogs/{name}/credentials

Request

Path parameters

namestring required

The name of the catalog.

Query parameters

environmentstring

Environment whose catalog credentials to vend. When it has no same-named catalog, credentials for the catalog from default are vended instead.

Request body

$schemastring uri

A URL to the JSON Schema for this object.

mode'read' | 'read-write'

Access level for the vended token. "read" (default) binds the token to the catalog's read-only principal; "read-write" requires the catalogs:data:write scope and binds it to the read-write principal.

Example request

{
  "$schema": "https://api.tower.dev/v1/schemas/VendCatalogCredentialsBody.json"
}

Response

OK

$schemastring uri

A URL to the JSON Schema for this object.

environmentstring required

Environment containing the catalog definition.

Example response

{
  "$schema": "https://api.tower.dev/v1/schemas/VendCatalogCredentialsResponse.json"
}

Changes