Keboola SUPER - Storage Backends Management API

openapi: 3.2.0
info:
  title: Keboola Connection Management SUPER - Storage Backends Management API
  description: 'The Keboola Connection Management API covers all tasks required for managing

    projects, plus super-admin features for controlling and monitoring Keboola Connection.


    ## Projects management

    * Create, modify and delete maintainers, organizations and projects

    * Move projects between organizations

    * Define project limits

    * Provision storage backends

    * Access project management activity log


    ## Projects monitoring

    * Monitoring of projects across organizations and maintainers


    ## Super user control and monitoring

    * UI release and deployment

    * Components management

    * Final project delete

    * Workers start/shutdown, etc.


    ## Authentication

    The API authenticates with a personal access token sent in the `X-KBC-ManageApiToken`

    header. Tokens can be created in

    [Account Settings](https://connection.keboola.com/admin/account/change-password)

    in Keboola Connection. A token is tied to an administrator and inherits that

    administrator''s permissions; when the administrator is disabled or deleted, all

    their tokens become invalid.


    ```

    curl -H "X-KBC-ManageApiToken: USER_TOKEN" https://connection.keboola.com/manage/tokens/verify

    ```


    ## Token types

    | Type  | Tied to a user | Token string visible only on create | Description |

    | ----- | -------------- | ----------------------------------- | ----------- |

    | user  | Yes            | Yes                                 | Full access to maintainers, organizations and projects the user can see. |

    | super | No             | Yes                                 | KBC management. Scopes such as `super_ui_deploy`, `super_monitoring` etc. can be limited per-token. |


    Legacy Apiary reference: see the

    [Manage API blueprint](https://github.com/keboola/connection/blob/master/Package/ManageApiPhpClient/apiary.apib)

    for the historical document this OpenAPI spec is migrating from.

    '
  version: '1.0'
servers:
- url: https://connection.keboola.com
  description: AWS US East
- url: https://connection.eu-central-1.keboola.com
  description: AWS EU Central
- url: https://connection.north-europe.azure.keboola.com
  description: Azure North Europe
- url: https://connection.east-us-2.azure.keboola-testing.com
  description: Azure Testing
security:
- StorageKey: []
- ManageKey: []
- BearerAuth: []
tags:
- name: SUPER - Storage Backends Management
  description: Manage Snowflake, BigQuery and other storage backends used by projects.
paths:
  /manage/storage-backend/{backendId}/activate:
    post:
      tags:
      - SUPER - Storage Backends Management
      summary: Activate Snowflake backend
      description: Activate a Snowflake storage backend after the SQL template created via [Create a new Snowflake backend with certificate authentication](#reference/super-storage-backends-management/snowflake-storage-backend-collection/create-a-new-snowflake-backend-with-certificate-authentication) has been executed in Snowflake. This validates the backend configuration and enables it for use.
      operationId: post_/manage/storage-backend/{backendId}/activate::StorageBackendActivateAction
      parameters:
      - name: backendId
        in: path
        description: Backend ID.
        required: true
        schema:
          type: integer
          pattern: '[1-9][0-9]*'
        example: 123
      responses:
        '200':
          description: Snowflake storage backend activated successfully. The backend is now ready for use.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendResponse'
              example:
                id: 123
                backend: snowflake
                region: us-east-1
                owner: keboola
                technicalOwner: keboola
                technicalOwnerContactEmails:
                - devel@keboola.com
                host: demo.snowflakecomputing.com
                useDynamicBackends: false
                useNetworkPolicies: false
                useSso: false
                isSsoEnabled: false
                isSsoConfigured: false
                isEnabled: true
        '400':
          description: Returned when the backend cannot be activated or validation fails (connection test, missing certificate, already-enabled certificate, unsupported backend).
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the user does not have permission to activate storage backends.
        '404':
          description: Returned when the storage backend with the given ID does not exist.
  /manage/storage-backend/snowflake:
    post:
      tags:
      - SUPER - Storage Backends Management
      summary: Create a new Snowflake backend with certificate authentication
      description: 'Create a new Snowflake storage backend with RSA certificate authentication. The backend is created as disabled and returns an SQL template for setting up Snowflake roles and users, along with the public keys. After running the generated query, you can activate the backend using the [Activate Snowflake Storage Backend](#reference/super-storage-backends-management/activate-snowflake-storage-backend/activate-snowflake-backend) endpoint.


        Warehouse name cannot contain warehouse size suffixes (_X-SMALL, _SMALL, etc.) when dynamic backends are enabled. Size suffixes will be automatically added to the warehouse name.


        Registration will provide personalized queries based on this template:


        ```sql

        // base

        CREATE ROLE "KBC_STORAGE";

        GRANT CREATE DATABASE ON ACCOUNT TO ROLE "KBC_STORAGE";

        GRANT CREATE ROLE ON ACCOUNT TO ROLE "KBC_STORAGE" WITH GRANT OPTION;

        GRANT CREATE USER ON ACCOUNT TO ROLE "KBC_STORAGE" WITH GRANT OPTION;

        CREATE WAREHOUSE "WH_SMALL" WITH WAREHOUSE_SIZE = ''SMALL'' WAREHOUSE_TYPE = ''STANDARD'' AUTO_SUSPEND = 60 AUTO_RESUME = TRUE MIN_CLUSTER_COUNT = 1 MAX_CLUSTER_COUNT = 4 RESOURCE_CONSTRAINT = ''STANDARD_GEN_1'';

        GRANT USAGE ON WAREHOUSE "WH_SMALL" TO ROLE "KBC_STORAGE" WITH GRANT OPTION;

        CREATE USER "KBC_STORAGE" DEFAULT_ROLE = "KBC_STORAGE" RSA_PUBLIC_KEY = ''PUBLICKEY'';

        GRANT OWNERSHIP ON USER "KBC_STORAGE" TO ROLE "KBC_STORAGE";

        GRANT ROLE "KBC_STORAGE" TO USER "KBC_STORAGE";

        GRANT ROLE "KBC_STORAGE" TO ROLE SYSADMIN;


        // dynamic backends

        CREATE WAREHOUSE "WH_MEDIUM" WITH WAREHOUSE_SIZE = ''MEDIUM'' WAREHOUSE_TYPE = ''STANDARD'' AUTO_SUSPEND = 60 AUTO_RESUME = TRUE MIN_CLUSTER_COUNT = 1 MAX_CLUSTER_COUNT = 2 RESOURCE_CONSTRAINT = ''STANDARD_GEN_1'';

        CREATE WAREHOUSE "WH_LARGE" WITH WAREHOUSE_SIZE = ''LARGE'' WAREHOUSE_TYPE = ''STANDARD'' AUTO_SUSPEND = 60 AUTO_RESUME = TRUE MIN_CLUSTER_COUNT = 1 MAX_CLUSTER_COUNT = 1 RESOURCE_CONSTRAINT = ''STANDARD_GEN_1'';

        GRANT USAGE ON WAREHOUSE "WH_MEDIUM" TO ROLE "KBC_STORAGE" WITH GRANT OPTION;

        GRANT USAGE ON WAREHOUSE "WH_LARGE" TO ROLE "KBC_STORAGE" WITH GRANT OPTION;


        // network policies

        -- BEGIN_OPTIONAL_RESOURCES: These SQL statements are optional as the resources may already exist. In case of query failures due to existence of resources, you can skip this part.

        CREATE DATABASE "STACK_INTERNAL";

        CREATE SCHEMA "STACK_INTERNAL"."NETWORK_RULES";

        USE SCHEMA "STACK_INTERNAL"."NETWORK_RULES";

        CREATE NETWORK RULE STACK_INTERNAL.NETWORK_RULES.ALLOW_SYSTEM_IPS TYPE = IPV4 MODE = INGRESS VALUE_LIST = (''1.1.1.1/32'',''2.2.2.2/32'');

        CREATE NETWORK POLICY "STACK_SYSTEM_IPS_ONLY" allowed_network_rule_list = (STACK_INTERNAL.NETWORK_RULES.ALLOW_SYSTEM_IPS);

        ALTER USER "KBC_STORAGE" SET NETWORK_POLICY = "STACK_SYSTEM_IPS_ONLY";

        GRANT OWNERSHIP ON NETWORK POLICY "STACK_SYSTEM_IPS_ONLY" TO ROLE "KBC_STORAGE";

        GRANT OWNERSHIP ON DATABASE "STACK_INTERNAL" TO ROLE "KBC_STORAGE";

        GRANT OWNERSHIP ON SCHEMA "STACK_INTERNAL"."NETWORK_RULES" TO ROLE "KBC_STORAGE";

        GRANT OWNERSHIP ON NETWORK RULE STACK_INTERNAL.NETWORK_RULES.ALLOW_SYSTEM_IPS TO ROLE "KBC_STORAGE";

        -- END_OPTIONAL_RESOURCES


        // sso

        CREATE SECURITY INTEGRATION "STACK_SAML_INTEGRATION"

        TYPE = SAML2

        ENABLED = TRUE

        SAML2_PROVIDER = ''CUSTOM''

        SAML2_ISSUER = ''issuer''

        SAML2_SSO_URL = ''https://sso''

        SAML2_X509_CERT = ''ABC''

        SAML2_SNOWFLAKE_ACS_URL =''https://host/fed/login''

        SAML2_ENABLE_SP_INITIATED = FALSE

        SAML2_FORCE_AUTHN = FALSE

        SAML2_SIGN_REQUEST = TRUE

        SAML2_REQUESTED_NAMEID_FORMAT = ''urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'';


        GRANT OWNERSHIP ON INTEGRATION "STACK_SAML_INTEGRATION" TO ROLE "KBC_STORAGE";

        ```


        The returned `sqlTemplate` contains the actual personalized SQL to run in Snowflake.'
      operationId: post_/manage/storage-backend/snowflake::StorageBackendCreateAction
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSnowflakeBackendWithCertRequest'
      responses:
        '200':
          description: Snowflake storage backend created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSnowflakeStorageBackendResponse'
              example:
                id: 123
                host: demo.snowflakecomputing.com
                warehouse: KEBOOLA
                username: KEBOOLA_STORAGE
                owner: keboola
                technicalOwner: keboola
                region: us-east-1
                created: '2024-01-15T10:30:00Z'
                creatorName: John Doe
                creatorId: 123
                useDynamicBackends: false
                useNetworkPolicies: false
                useSso: false
                isSsoEnabled: false
                isSsoConfigured: false
                edition: standard
                sqlTemplate: CREATE ROLE "KEBOOLA_STORAGE";...
                isEnabled: false
                userPublicKey: MIIBIjANBgkqhki...
                securityIntegrationKey: null
        '400':
          description: Returned when the request validation fails.
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the user does not have permission to create storage backends.
  /manage/storage-backend:
    get:
      tags:
      - SUPER - Storage Backends Management
      summary: List backends
      description: Returns the list of registered storage backends (Snowflake, BigQuery).
      operationId: get_/manage/storage-backend::StorageBackendListAction
      responses:
        '200':
          description: Storage backend credentials list.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendListResponse'
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the current admin is not a super admin.
    post:
      tags:
      - SUPER - Storage Backends Management
      summary: Create storage backend credentials
      description: '**Deprecated.** Generic storage-backend create endpoint. Use the backend-specific endpoints instead — `POST /manage/storage-backend/snowflake` or `POST /manage/storage-backend/bigquery`.'
      operationId: post_/manage/storage-backend::StorageBackendCreateAction
      responses:
        '200':
          description: Storage backend credentials created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendResponse'
        '400':
          description: Returned when the backend is not supported or connection test fails.
        '409':
          description: Returned when support for the backend was discontinued.
      deprecated: true
  /manage/storage-backend/bigquery:
    post:
      tags:
      - SUPER - Storage Backends Management
      summary: Create a new BigQuery backend
      description: 'You must create a new project and service account in a folder in your organization,

        this service account must have the right to create new projects (roles/resourcemanager.projectCreator) in this folder (only in this folder)

        and use the generated json [keyFile](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)

        for this `service account` in the `credentials` parameter, the folder id then as `folderId`.'
      operationId: post_/manage/storage-backend/bigquery::StorageBackendCreateBigqueryAction
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StorageBackendCreateBigqueryRequest'
      responses:
        '200':
          description: BigQuery storage backend credentials created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendBigqueryResponse'
              example:
                id: 12
                region: us-east-1
                backend: bigquery
                credentials:
                  type: service_account
                  project_id: '123456789'
                  private_key_id: xxx
                  client_email: something@else.iam.gserviceaccount.com
                  client_id: '123456789'
                  auth_uri: https://accounts.google.com/o/oauth2/auth
                  token_uri: https://oauth2.googleapis.com/token
                  auth_provider_x509_cert_url: https://www.googleapis.com/oauth2/v1/certs
                  client_x509_cert_url: https://www.googleapis.com/robot/v1/metadata/x509/something
                folderId: 123
                bqExternalSharingRoleName: roles/custom.analyticsHubListingAdmin
        '422':
          description: Returned when the BigQuery backend cannot be assigned (validation of GCP project / folder fails).
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the current admin is not a super admin.
  /manage/storage-backend/{id}:
    get:
      tags:
      - SUPER - Storage Backends Management
      summary: Backend detail
      description: Returns detail of a single storage backend identified by its numeric ID.
      operationId: get_/manage/storage-backend/{id}::StorageBackendDetailAction
      parameters:
      - name: id
        in: path
        description: Backend ID.
        required: true
        schema:
          type: integer
          pattern: \d+
        example: 123
      responses:
        '200':
          description: Storage backend credentials detail.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendDetailResponse'
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the current admin is not a super admin.
        '404':
          description: Returned when the storage backend with the given ID does not exist.
    delete:
      tags:
      - SUPER - Storage Backends Management
      summary: Delete backend
      description: Deletes a storage backend. All projects using the backend must be deleted and purged before it can be deleted.
      operationId: delete_/manage/storage-backend/{id}::StorageBackendDeleteAction
      parameters:
      - name: id
        in: path
        description: Id of storage backend.
        required: true
        schema:
          type: integer
          pattern: '[0-9]+'
        example: 123
      responses:
        '204':
          description: Storage backend deleted.
        '400':
          description: Returned when the storage backend is still in use by projects or workspaces.
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the current admin is not a super admin.
        '404':
          description: Returned when the storage backend with the given ID does not exist.
    patch:
      tags:
      - SUPER - Storage Backends Management
      summary: Update backend
      description: A partial update of a storage backend; at least one of the attributes is required.
      operationId: patch_/manage/storage-backend/{id}::StorageBackendUpdateAction
      parameters:
      - name: id
        in: path
        description: Backend ID.
        required: true
        schema:
          type: integer
          pattern: '[0-9]+'
        example: 123
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StorageBackendUpdateRequest'
      responses:
        '200':
          description: Storage backend credentials updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendResponse'
              example:
                id: 123
                host: sapi-37-demo.snowflakecomputing.com
                backend: snowflake
                region: us-east-1
                technicalOwnerContactEmails:
                - devel@keboola.com
        '400':
          description: Returned when the backend connection test fails or the request payload is invalid.
        '401':
          description: Returned when the Manage token is missing or invalid.
        '403':
          description: Returned when the current admin is not a super admin.
        '404':
          description: Returned when the storage backend with the given ID does not exist.
  /manage/storage-backend/{id}/bigquery:
    patch:
      tags:
      - SUPER - Storage Backends Management
      summary: Update BigQuery storage backend credentials
      description: Update BigQuery root credentials for storage backend.
      operationId: patch_/manage/storage-backend/{id}/bigquery::StorageBackendUpdateBigqueryAction
      parameters:
      - name: id
        in: path
        description: Identifier of the storage backend credentials.
        required: true
        schema:
          type: integer
          pattern: '[0-9]+'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
              - $ref: '#/components/schemas/StorageBackendUpdateBigqueryRequest'
      responses:
        '200':
          description: BigQuery storage backend credentials updated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageBackendBigqueryResponse'
        '400':
          description: Returned when the backend connection test fails.
        '404':
          description: Returned when the storage backend credentials are not found.
        '403':
          description: Returned when access is denied.
components:
  schemas:
    StorageBackendBigqueryResponse:
      required:
      - id
      - backend
      - region
      - owner
      - technicalOwner
      - technicalOwnerContactEmails
      properties:
        id:
          description: Root credentials identifier.
          type: integer
        backend:
          description: Storage backend type. Always "bigquery" for this response.
          type: string
        region:
          description: Backend region.
          type: string
        owner:
          description: Associated GCP account owner (e.g. keboola, client-<name>).
          type: string
        technicalOwner:
          description: 'Technical owner who manages the account. One of: keboola, internal, kbdb, byodb.'
          type: string
        technicalOwnerContactEmails:
          description: Contact emails of the technical owner.
          type: array
          items:
            type: string
            format: email
        credentials:
          description: GCP service account credentials in JSON form.
          type:
          - object
          - 'null'
        folderId:
          description: GCP folder identifier under which projects are created.
          type:
          - string
          - 'null'
        bqExternalSharingRoleName:
          description: Name of the custom IAM role pre-configured for Analytics Hub external bucket sharing. When set, the bucket sharing setup guide surfaces this role name to the user. When null, the guide falls back to recommending the built-in roles/analyticshub.listingAdmin role.
          type:
          - string
          - 'null'
      type: object
    StorageBackendResponse:
      required:
      - id
      - backend
      - region
      - technicalOwner
      - technicalOwnerContactEmails
      properties:
        id:
          description: Root credentials identifier.
          type: integer
        backend:
          description: Storage backend type.
          type: string
        region:
          description: Backend region.
          type: string
        owner:
          description: 'Associated legal owner (mostly: keboola, client-<name>).'
          type:
          - string
          - 'null'
        technicalOwner:
          description: 'Associated technical owner (who technically manages the account). One of: keboola, internal, kbdb, byodb.'
          type: string
        technicalOwnerContactEmails:
          description: Array of technical owner contact emails.
          type: array
          items:
            type: string
            format: email
        host:
          description: Hostname of the backend (non-BigQuery backends).
          type:
          - string
          - 'null'
        credentials:
          description: BigQuery credentials in JSON form.
          type:
          - object
          - 'null'
        folderId:
          description: BigQuery folder identifier.
          type:
          - string
          - 'null'
        useDynamicBackends:
          description: Flag for Snowflake dynamic backends.
          type:
          - boolean
          - 'null'
        useNetworkPolicies:
          description: Flag for Snowflake network policies.
          type:
          - boolean
          - 'null'
        useSso:
          description: Deprecated; use isSsoEnabled. Snowflake SSO flag.
          type:
          - boolean
          - 'null'
          deprecated: true
        isSsoEnabled:
          description: Whether SSO (SAML2) is enabled for the Snowflake backend.
          type:
          - boolean
          - 'null'
        isSsoConfigured:
          description: Whether SAML2 SSO configuration exists for the Snowflake backend.
          type:
          - boolean
          - 'null'
        isEnabled:
          description: Whether the Snowflake backend certificate is validated and the backend is usable.
          type:
          - boolean
          - 'null'
      type: object
    StorageBackendCreateBigqueryRequest:
      description: Create a new BigQuery storage backend by providing GCP service-account credentials and folder.
      required:
      - owner
      - technicalOwner
      - folderId
      - region
      - credentials
      properties:
        owner:
          description: 'Associated GCP account owner (mostly: keboola, client-<name>).'
          type: string
          example: keboola
        technicalOwner:
          description: 'Associated technical owner (who technically manages the account). Enum: keboola, internal, kbdb, byodb.'
          type: string
          example: keboola
        folderId:
          description: GCP folder ID where the service account is allowed to create projects.
          type: string
          example: '123'
        region:
          description: Backend region.
          type: string
          example: us-east-1
        credentials:
          description: GCP service-account key file content (full JSON keyfile).
          type: object
          example:
            type: service_account
            project_id: '123456789'
            private_key_id: xxx
            private_key: '-----BEGIN PRIVATE KEY-----<key contents>-----END PRIVATE KEY-----

              '
            client_email: something@else.iam.gserviceaccount.com
            client_id: '123456789'
            auth_uri: https://accounts.google.com/o/oauth2/auth
            token_uri: https://oauth2.googleapis.com/token
            auth_provider_x509_cert_url: https://www.googleapis.com/oauth2/v1/certs
            client_x509_cert_url: https://www.googleapis.com/robot/v1/metadata/x509/something
        bqExternalSharingRoleName:
          description: Name of the custom IAM role pre-configured for Analytics Hub external bucket sharing. When set, the bucket sharing setup guide surfaces this role name to the user. When absent, the guide falls back to recommending the built-in `roles/analyticshub.listingAdmin` role.
          type:
          - string
          - 'null'
          example: roles/custom.analyticsHubListingAdmin
      type: object
    StorageBackendUpdateRequest:
      description: Partial update of a storage backend; at least one of `username`, `password`, `useDynamicBackends`, `owner`, `technicalOwner` or `technicalOwnerContactEmails` must be supplied. Individual attributes are optional on their own.
      required: []
      properties:
        username:
          description: Backend username.
          type:
          - string
          - 'null'
          example: keboola
        password:
          description: Backend password.
          type:
          - string
          - 'null'
          example: '1234'
        useDynamicBackends:
          description: Only for backends supporting dynamic sizing (Snowflake). When enabled, new projects get dynamic backends assigned automatically.
          type:
          - boolean
          - 'null'
          example: false
        owner:
          description: 'Associated legal owner (mostly: keboola, client-<name>).'
          type:
          - string
          - 'null'
          example: keboola
        technicalOwner:
          description: 'Associated technical owner (who technically manages the account). Enum: keboola, internal, kbdb, byodb.'
          type:
          - string
          - 'null'
          example: keboola
        technicalOwnerContactEmails:
          description: Array of technical owner contact emails.
          type:
          - array
          - 'null'
          items:
            type: string
            format: email
          example:
          - devel@keboola.com
        skipValidation:
          description: If true, the backend validation step is skipped during the update. Only possible to use with owner and technicalOwner not with other options.
          type: boolean
          example: false
          default: false
      type: object
    StorageBackendDetailResponse:
      required:
      - id
      - backend
      - region
      - owner
      - technicalOwner
      - stats
      - created
      - creator
      - useDynamicBackends
      - technicalOwnerContactEmails
      properties:
        id:
          description: Root credentials identifier.
          type: integer
        host:
          description: Hostname of the backend.
          type:
          - string
          - 'null'
        backend:
          description: Storage backend type.
          type: string
        region:
          description: Backend region.
          type: string
        owner:
          description: 'Associated legal owner (mostly: keboola, client-<name>).'
          type: string
        technicalOwner:
          description: 'Associated technical owner (who technically manages the account). One of: keboola, internal, kbdb, byodb.'
          type: string
        username:
          description: Username used for the connection.
          type:
          - string
          - 'null'
        stats:
          description: Backend usage statistics.
          properties:
            projectsCount:
              description: Number of projects using the backend.
              type: integer
            bucketsCount:
              description: Number of buckets.
              type: integer
            dataSizeGB:
              description: Total data size in gigabytes.
              type: integer
            rowsCount:
              description: Total rows count.
              type: integer
          type: object
        created:
          description: Credentials creation time.
          type: string
          format: date-time
        creator:
          description: Creator details.
          properties:
            id:
              type:
              - integer
              - 'null'
            name:
              type:
              - string
              - 'null'
          type: object
        warehouse:
          description: Warehouse name.
          type:
          - string
          - 'null'
        database:
          description: Database name.
          type:
          - string
          - 'null'
        useSynapseManagedIdentity:
          description: Flag for Synapse managed identity.
          type:
          - boolean
          - 'null'
        saml2Configuration:
          description: SAML2 configuration for the backend.
          properties:
            idpEntityId:
              type: string
            spEntityId:
              type: string
            spAcsUrl:
              type: string
            publicKey:
              type: string
          type:
          - object
          - 'null'
        useDynamicBackends:
          description: Flag for Snowflake dynamic backends.
          type: boolean
        useSso:
          description: Deprecated; use isSsoEnabled. Snowflake SSO flag.
          type:
          - boolean
          - 'null'
          deprecated: true
        isSsoEnabled:
          description: Whether SSO (SAML2) is enabled for the Snowflake backend.
          type:
          - boolean
          - 'null'
        isSsoConfigured:
          description: Whether SAML2 SSO configuration exists for the Snowflake backend.
          type:
          - boolean
          - 'null'
        technicalOwnerContactEmails:
          description: Array of technical owner contact emails for SAML2 certificate rotation notifications.
          type: array
          items:
            type: string
            format: email
      type: object
    StorageBackendListResponse:
      type: array
      items:
        $ref: '#/components/schemas/StorageBackendDetailResponse'
    StorageBackendUpdateBigqueryRequest:
      description: Update BigQuery storage backend settings. At least one parameter must be provided.
      minProperties: 1
      properties:
        credentials:
          description: GCP service-account key file contents (full JSON keyfile).
          required:
          - type
          - project_id
          - private_key_id
          - private_key
          - client_email
          - client_id
          - auth_uri
          - token_uri
          - auth_provider_x509_cert_url
          - client_x509_cert_url
          properties:
            type:
              type: string
              example: service_account
            project_id:
              type: string
              example: '123456789'
            private_key_id:
              type: string
              example: xxx
            private_key:
              type: string
              example: '-----BEGIN PRIVATE KEY-----<key contents>-----END PRIVATE KEY-----

                '
            client_email:
              type: string
              example: something@else.iam.gserviceaccount.com
            client_id:
              type: string
              example: '123456789'
            auth_uri:
              type: string
              example: https://accounts.google.com/o/oauth2/auth
            token_uri:
              type: string
              example: https://oauth2.googleapis.com/token
            auth_provider_x509_cert_url:
              type: string
              example: https://www.googleapis.com/oauth2/v1/certs
            client_x509_cert_url:
              type: string
              example: https://www.googleapis.com/robot/v1/metadata/x509/something
        

# --- truncated at 32 KB (37 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/keboola/refs/heads/main/openapi/keboola-super-storage-backends-management-api-openapi.yml