OpenAPI Specification
openapi: 3.0.1
info:
contact:
email: info@seqera.io
url: https://seqera.io
description: Seqera Platform services API
title: Seqera actions credentials API
version: 1.181.0
tags:
- description: Credentials
name: credentials
paths:
/credentials:
get:
description: Lists all available credentials in a user context. Append `?workspaceId` to list credentials in a workspace context, and `?platformId` to filter credentials by computing platform.
operationId: ListCredentials
parameters:
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
- description: Platform string identifier
in: query
name: platformId
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ListCredentialsResponse'
description: OK
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
security:
- BearerAuth: []
summary: List credentials
tags:
- credentials
post:
description: Creates new credentials in a user context. Append `?workspaceId` to create the credentials in a workspace context. For AWS credentials with IAM Role ARN, append `?useExternalId=true` to generate a Platform-managed External ID.
operationId: CreateCredentials
parameters:
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
- description: Generate External ID for AWS credentials (requires IAM Role ARN)
in: query
name: useExternalId
schema:
type: boolean
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateCredentialsRequest'
description: Credentials create request
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/CreateCredentialsResponse'
description: OK
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
security:
- BearerAuth: []
summary: Create credentials
tags:
- credentials
/credentials/validate:
get:
description: Validates the given credentials name. Append `?name=<your_credential_name>`.
operationId: ValidateCredentialsName
parameters:
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
- description: Credentials name to validate
in: query
name: name
schema:
type: string
responses:
'204':
description: OK - No content
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Duplicate element
security:
- BearerAuth: []
summary: Validate credential name
tags:
- credentials
/credentials/{credentialsId}:
delete:
description: Deletes the credentials identified by the given `credentialsId`.
operationId: DeleteCredentials
parameters:
- description: Credentials string identifier
in: path
name: credentialsId
required: true
schema:
type: string
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
- description: If set credentials deletion will be blocked by running jobs that depend on them
in: query
name: checked
schema:
type: boolean
responses:
'204':
description: OK - No content
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/DeleteCredentialsConflictResponse'
description: Running jobs block the deletion of this credentials
security:
- BearerAuth: []
summary: Delete credentials
tags:
- credentials
get:
description: Retrieves the details of the credentials identified by the given `credentialsId`.
operationId: DescribeCredentials
parameters:
- description: Credentials string identifier
in: path
name: credentialsId
required: true
schema:
type: string
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/DescribeCredentialsResponse'
description: OK
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
security:
- BearerAuth: []
summary: Describe credentials
tags:
- credentials
put:
description: Updates the details of the credentials identified by the given `credentialsId`. For AWS credentials with IAM Role ARN, append `?useExternalId=true` to generate a Platform-managed External ID.
operationId: UpdateCredentials
parameters:
- description: Credentials string identifier
in: path
name: credentialsId
required: true
schema:
type: string
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
- description: Generate External ID for AWS credentials (requires IAM Role ARN)
in: query
name: useExternalId
schema:
type: boolean
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateCredentialsRequest'
description: Credentials update request
required: true
responses:
'204':
description: OK - No content
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
security:
- BearerAuth: []
summary: Update credentials
tags:
- credentials
/credentials/{credentialsId}/keys:
get:
description: Retrieves the encrypted keys for the credentials identified by the given `credentialsId`.
operationId: GetEncryptedCredentials
parameters:
- description: Credentials string identifier
in: path
name: credentialsId
required: true
schema:
type: string
- description: Workspace numeric identifier
in: query
name: workspaceId
schema:
format: int64
type: integer
- description: Encryption key string identifier
in: query
name: pairingId
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/GetCredentialsKeysResponse'
description: OK
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
security:
- BearerAuth: []
summary: Get encrypted credentials
tags:
- credentials
/credentials/{credentialsId}/validate:
post:
operationId: ValidateCredentials
parameters:
- description: Credentials string identifier
in: path
name: credentialsId
required: true
schema:
type: string
- description: Workspace numeric identifier
in: query
name: workspaceId
required: false
schema:
format: int64
type: integer
- description: When true, skip the probe and force the credential (INVALID only) to AVAILABLE. Rejected with 409 for any other status.
in: query
name: force
required: false
schema:
type: boolean
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ValidateCredentialsResponse'
description: Validation outcome — inspect status and the transientError flag on the response body
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Bad request
'403':
description: Operation not allowed
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Credentials not found
'409':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: Force override rejected — credential is not INVALID
security:
- BearerAuth: []
summary: Validate credentials against their cloud provider and report the outcome
tags:
- credentials
components:
schemas:
DeleteCredentialsConflictResponse:
properties:
conflicts:
items:
$ref: '#/components/schemas/DeleteCredentialsConflictResponse.Conflict'
type: array
credentialsId:
type: string
type: object
DeleteCredentialsConflictResponse.Conflict:
properties:
id:
type: string
name:
type: string
type:
type: string
url:
type: string
type: object
AzureCloudKeys:
allOf:
- $ref: '#/components/schemas/AzureSecurityKeys'
- properties:
clientId:
type: string
clientSecret:
type: string
writeOnly: true
discriminator:
type: string
storageName:
type: string
subscriptionId:
type: string
tenantId:
type: string
type: object
title: Azure Cloud credentials
type: object
ValidateCredentialsResponse:
properties:
message:
description: Provider-supplied error detail. Null when the credentials are valid.
nullable: true
type: string
status:
allOf:
- $ref: '#/components/schemas/Credentials.Status'
description: Validation health resulting from the probe. AVAILABLE = the probe succeeded; INVALID = the provider authoritatively rejected the credentials; on a transient failure this carries the unchanged persisted status.
transientError:
description: True when validation could not reach the provider (network error / 5xx). When true the persisted status is left untouched and MUST NOT be interpreted as an authoritative reject.
type: boolean
type: object
SecurityKeys:
discriminator:
mapping:
aws: '#/components/schemas/AwsSecurityKeys'
azure: '#/components/schemas/AzureSecurityKeys'
azure-cloud: '#/components/schemas/AzureCloudKeys'
azure_entra: '#/components/schemas/AzureEntraKeys'
azurerepos: '#/components/schemas/AzureReposSecurityKeys'
bitbucket: '#/components/schemas/BitBucketSecurityKeys'
codecommit: '#/components/schemas/CodeCommitSecurityKeys'
container-reg: '#/components/schemas/ContainerRegistryKeys'
gitea: '#/components/schemas/GiteaSecurityKeys'
github: '#/components/schemas/GitHubSecurityKeys'
github_app: '#/components/schemas/GitHubAppSecurityKeys'
gitlab: '#/components/schemas/GitLabSecurityKeys'
google: '#/components/schemas/GoogleSecurityKeys'
k8s: '#/components/schemas/K8sSecurityKeys'
local: '#/components/schemas/LocalSecurityKeys'
s3: '#/components/schemas/S3SecurityKeys'
seqeracompute: '#/components/schemas/SeqeraComputeSecurityKeys'
ssh: '#/components/schemas/SSHSecurityKeys'
tw-agent: '#/components/schemas/AgentSecurityKeys'
propertyName: discriminator
oneOf:
- $ref: '#/components/schemas/AwsSecurityKeys'
- $ref: '#/components/schemas/GoogleSecurityKeys'
- $ref: '#/components/schemas/GitHubSecurityKeys'
- $ref: '#/components/schemas/GitHubAppSecurityKeys'
- $ref: '#/components/schemas/GitLabSecurityKeys'
- $ref: '#/components/schemas/BitBucketSecurityKeys'
- $ref: '#/components/schemas/GiteaSecurityKeys'
- $ref: '#/components/schemas/SSHSecurityKeys'
- $ref: '#/components/schemas/K8sSecurityKeys'
- $ref: '#/components/schemas/AzureSecurityKeys'
- $ref: '#/components/schemas/AzureCloudKeys'
- $ref: '#/components/schemas/AzureReposSecurityKeys'
- $ref: '#/components/schemas/ContainerRegistryKeys'
- $ref: '#/components/schemas/AgentSecurityKeys'
- $ref: '#/components/schemas/CodeCommitSecurityKeys'
- $ref: '#/components/schemas/AzureEntraKeys'
- $ref: '#/components/schemas/SeqeraComputeSecurityKeys'
- $ref: '#/components/schemas/S3SecurityKeys'
- $ref: '#/components/schemas/LocalSecurityKeys'
properties:
discriminator:
type: string
type: object
SSHSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
discriminator:
type: string
passphrase:
type: string
writeOnly: true
privateKey:
type: string
writeOnly: true
type: object
title: SSH credentials
type: object
GitHubSecurityKeys:
allOf:
- $ref: '#/components/schemas/GitKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
token:
type: string
username:
type: string
type: object
title: GitHub credentials
type: object
DescribeCredentialsResponse:
properties:
credentials:
$ref: '#/components/schemas/Credentials'
setupSnippet:
description: Server-rendered, read-only provider-side setup snippet (e.g. AWS IAM role trust policy) to paste at the cloud provider. Populated when a renderer is available for the credential type and the installation is configured for it; otherwise omitted.
nullable: true
readOnly: true
type: string
type: object
GoogleSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
data:
type: string
writeOnly: true
discriminator:
type: string
serviceAccountEmail:
type: string
tokenAudience:
type: string
workloadIdentityProvider:
type: string
type: object
title: Google credentials
type: object
AzureEntraKeys:
allOf:
- $ref: '#/components/schemas/AzureSecurityKeys'
- properties:
clientId:
type: string
clientSecret:
type: string
writeOnly: true
discriminator:
type: string
tenantId:
type: string
type: object
title: Azure Entra credentials
type: object
BitBucketSecurityKeys:
allOf:
- $ref: '#/components/schemas/GitKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
token:
type: string
writeOnly: true
username:
type: string
type: object
title: BitBucket credentials
type: object
AgentSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
connectionId:
type: string
discriminator:
type: string
shared:
type: boolean
workDir:
type: string
type: object
title: Tower Agent credentials
type: object
Credentials:
properties:
baseUrl:
maxLength: 200
pattern: ''
type: string
category:
maxLength: 20
type: string
dateCreated:
format: date-time
readOnly: true
type: string
deleted:
readOnly: true
type: boolean
description:
type: string
id:
maxLength: 22
type: string
keys:
$ref: '#/components/schemas/SecurityKeys'
lastUpdated:
format: date-time
readOnly: true
type: string
lastUsed:
format: date-time
readOnly: true
type: string
lastValidated:
description: Timestamp of the most recent completed validation probe (success or authoritative fail). Null until first probe. NOT advanced on transient probe outcomes.
format: date-time
readOnly: true
type: string
message:
description: Provider-supplied error detail captured when status transitions to INVALID. Cleared (null) whenever status returns to AVAILABLE. Truncated to 4096 characters with a trailing " (truncated)" suffix when the underlying provider message exceeds that limit.
maxLength: 4096
readOnly: true
type: string
name:
maxLength: 100
type: string
provider:
enum:
- aws
- azure
- azure_entra
- google
- github
- github_app
- gitlab
- bitbucket
- ssh
- k8s
- container-reg
- tw-agent
- codecommit
- gitea
- azurerepos
- seqeracompute
- azure-cloud
- s3
maxLength: 16
type: string
status:
allOf:
- $ref: '#/components/schemas/Credentials.Status'
description: Validation health for these credentials. AVAILABLE = last probe succeeded (or no probe has been attempted yet). INVALID = the last probe was authoritatively rejected by the provider (see message). Transient probe failures (network / 5xx) leave this field untouched.
readOnly: true
required:
- name
- provider
type: object
ErrorResponse:
properties:
message:
type: string
required:
- message
type: object
AwsCredentialsMode:
enum:
- keys
- role
type: string
x-enum-varnames:
- keys
- role
x-type: String
GetCredentialsKeysResponse:
properties:
keys:
type: string
type: object
GiteaSecurityKeys:
allOf:
- $ref: '#/components/schemas/GitKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
token:
type: string
username:
type: string
type: object
title: Gitea credentials
type: object
ContainerRegistryKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
registry:
type: string
userName:
type: string
type: object
title: Container registry credentials
type: object
GitKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
password:
type: string
token:
type: string
username:
type: string
type: object
type: object
AzureReposSecurityKeys:
allOf:
- $ref: '#/components/schemas/GitKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
token:
type: string
username:
type: string
type: object
title: Azure Repos credentials
type: object
AwsSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
accessKey:
type: string
assumeRoleArn:
type: string
discriminator:
type: string
externalId:
type: string
mode:
$ref: '#/components/schemas/AwsCredentialsMode'
secretKey:
type: string
writeOnly: true
type: object
title: AWS credentials
type: object
LocalSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
type: object
title: Local security keys
type: object
GitLabSecurityKeys:
allOf:
- $ref: '#/components/schemas/GitKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
token:
type: string
writeOnly: true
username:
type: string
type: object
title: GitLab credentials
type: object
CodeCommitSecurityKeys:
allOf:
- $ref: '#/components/schemas/GitKeys'
- properties:
discriminator:
type: string
password:
type: string
writeOnly: true
token:
type: string
username:
type: string
type: object
title: AWS CodeCommit credentials
type: object
CreateCredentialsResponse:
properties:
credentialsId:
type: string
type: object
S3SecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
accessKey:
type: string
discriminator:
type: string
pathStyleAccessEnabled:
type: boolean
secretKey:
type: string
writeOnly: true
type: object
title: S3-compatible credentials
type: object
ListCredentialsResponse:
properties:
credentials:
items:
$ref: '#/components/schemas/Credentials'
type: array
type: object
K8sSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
certificate:
type: string
discriminator:
type: string
privateKey:
type: string
writeOnly: true
token:
type: string
writeOnly: true
type: object
title: Kubernetes credentials
type: object
Credentials.Status:
enum:
- AVAILABLE
- INVALID
type: string
SeqeraComputeSecurityKeys:
allOf:
- $ref: '#/components/schemas/AwsSecurityKeys'
- properties:
discriminator:
type: string
type: object
title: Seqera Compute credentials
type: object
AzureSecurityKeys:
allOf:
- $ref: '#/components/schemas/SecurityKeys'
- properties:
batchKey:
type: string
writeOnly: true
batchName:
type: string
discriminator:
type: string
storageKey:
type: string
writeOnly: true
storageName:
type: string
type: object
title: Azure credentials
type: object
GitHubAppSecurityKeys:
properties:
appId:
type: string
clientId:
type: string
clientSecret:
type: string
writeOnly: true
discriminator:
type: string
privateKey:
type: string
writeOnly: true
slug:
type: string
webhookSecret:
type: string
writeOnly: true
type: object
CreateCredentialsRequest:
properties:
credentials:
$ref: '#/components/schemas/Credentials'
type: object
UpdateCredentialsRequest:
properties:
credentials:
$ref: '#/components/schemas/Credentials'
type: object
securitySchemes:
BearerAuth:
bearerFormat: jwt
scheme: bearer
type: http