Sigma Computing API Credentials API

openapi: 3.2.0
info:
  title: Sigma REST API Credentials API
  version: 1.0.0
servers:
- url: https://api.sigmacomputing.com
  description: Server for GCP (US) hosted organizations
- url: https://api.sa.gcp.sigmacomputing.com
  description: Server for GCP (KSA) hosted organizations
- url: https://aws-api.sigmacomputing.com
  description: Server for AWS US (West) hosted organizations
- url: https://api.us-a.aws.sigmacomputing.com
  description: Server for AWS US (East) hosted organizations
- url: https://api.ca.aws.sigmacomputing.com
  description: Server for AWS Canada hosted organizations
- url: https://api.eu.aws.sigmacomputing.com
  description: Server for AWS Europe hosted organizations
- url: https://api.au.aws.sigmacomputing.com
  description: Server for AWS Australia and APAC hosted organizations
- url: https://api.uk.aws.sigmacomputing.com
  description: Server for AWS UK hosted organizations
- url: https://api.us.azure.sigmacomputing.com
  description: Server for Azure US hosted organizations
- url: https://api.eu.azure.sigmacomputing.com
  description: Server for Azure Europe hosted organizations
- url: https://api.ca.azure.sigmacomputing.com
  description: Server for Azure Canada hosted organizations
- url: https://api.uk.azure.sigmacomputing.com
  description: Server for Azure United Kingdom hosted organizations
- url: https://api.au.azure.sigmacomputing.com
  description: Server for Azure Australia hosted organizations
tags:
- name: apiCredentials
paths:
  /v2/api-credentials:
    get:
      operationId: listApiCredentials
      summary: List API credentials
      description: 'This endpoint returns a paginated list of API credentials. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).


        ### Usage notes

        - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled.

        - Only returns [API credentials](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma#add-a-new-api-credential-to-sigma) that the user making this request has at least **Can view** access to.

        - Secret fields such as passwords, tokens, and client secrets are never included in the response.

        - Use the `name` query parameter to filter by credential name.

        - Use the `orderBy` query parameter to set sort order.


        ### Usage scenarios

        - **Credential management:** View and audit the credentials used by API connectors in your Sigma organization.

        - **API connector creation:** Retrieve available credentials to present as options when creating an API connector.'
      tags:
      - apiCredentials
      parameters:
      - name: pageToken
        in: query
        description: Use to specify the next set of results with the string returned in the `nextPageToken` field of the previous response.
        required: false
        schema:
          type: string
      - name: pageSize
        in: query
        description: Number of results to return per page, with a maximum of 1000. Defaults to 50.
        required: false
        schema:
          type: integer
      - name: orderBy
        in: query
        description: 'Sort order. Supported fields: `name`, `description`. Append ` desc` for descending (e.g. `name desc`). Defaults to `name` ascending.'
        required: false
        schema:
          type: string
      - name: name
        in: query
        description: Filter results to credentials whose name contains this substring.
        required: false
        schema:
          type: string
      - name: Authorization
        in: header
        description: OAuth authentication
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api-credentials_listApiCredentials_Response_200'
    post:
      operationId: createApiCredential
      summary: Create an API credential
      description: 'This endpoint creates a new API credential for use with API connectors and the **Call API** action in Sigma. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).


        ### Usage notes

        - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled.

        - The `allowlist` parameter is required and must contain at least one hostname glob pattern. Use `["*"]` to allow the credential to be used against any host.

        - The following authentication methods are supported: `basic`, `bearer`, `apiKey`, `oAuthClientCredentials`, `oAuthAuthorizationCode`, `oAuthPasswordCredentials`, `awsSigV4`.

        - Secret fields are encrypted at rest and are never returned in subsequent read responses.


        ### Usage scenarios

        - **Credential provisioning:** Automate credential creation as part of environment setup or onboarding.

        - **Multi-service authentication:** Create separate credentials for each external service, with allowlists scoped to only that service''s domains.'
      tags:
      - apiCredentials
      parameters:
      - name: Authorization
        in: header
        description: OAuth authentication
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api-credentials_createApiCredential_Response_200'
      requestBody:
        description: The request body.
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Display name of the credential.
                allowlist:
                  type: array
                  items:
                    type: string
                  description: Hostname glob patterns the credential may be used against (e.g. `["*.example.com"]`). Required and must not be empty; use `["*"]` to allow every host.
                credential:
                  $ref: '#/components/schemas/V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredential'
                description:
                  type: string
                  description: Human-readable description.
              required:
              - name
              - allowlist
              - credential
  /v2/api-credentials/{apiCredentialId}:
    get:
      operationId: getApiCredential
      summary: Get an API credential
      description: 'This endpoint returns nonsensitive details for a single API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).


        ### Usage notes

        - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have at least **Can view** access on the credential.

        - Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint.

        - Secret fields (passwords, tokens, client secrets, secret access keys) are never returned.


        ### Usage scenarios

        - **Credential inspection:** Retrieve the configuration of a credential to verify its settings before using it with a connector.'
      tags:
      - apiCredentials
      parameters:
      - name: apiCredentialId
        in: path
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        description: OAuth authentication
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api-credentials_getApiCredential_Response_200'
    delete:
      operationId: deleteApiCredential
      summary: Delete an API credential
      description: 'This endpoint archives an API credential so it can no longer be associated with new API connectors. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).


        ### Usage notes

        - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have **Can edit** access to the API credential.

        - Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint.

        - Archiving a credential does not automatically unbind any API connectors that reference it.


        ### Usage scenarios

        - **Credential decommissioning:** Remove credentials for decommissioned services or expired tokens.

        - **Security cleanup:** Archive compromised or rotated credentials to prevent accidental reuse.'
      tags:
      - apiCredentials
      parameters:
      - name: apiCredentialId
        in: path
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        description: OAuth authentication
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api-credentials_deleteApiCredential_Response_200'
    patch:
      operationId: updateApiCredential
      summary: Update an API credential
      description: 'This endpoint updates one or more fields on an existing API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).


        ### Usage notes

        - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have **Can edit** access to the API credential.

        - Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint.

        - Omitted fields are left unchanged.

        - If a `credential` is provided, the provided authentication details (ID, secret, etc.) replace the previous values. To leave secrets unchanged, omit the `credential` parameter.


        ### Usage scenarios

        - **Secret rotation:** Update the secret fields for a credential automatically for an external service.

        - **Allowlist updates:** Expand or restrict the set of hostnames the credential can be used against.'
      tags:
      - apiCredentials
      parameters:
      - name: apiCredentialId
        in: path
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        description: OAuth authentication
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api-credentials_updateApiCredential_Response_200'
      requestBody:
        description: The request body.
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: New display name.
                description:
                  type:
                  - string
                  - 'null'
                  description: New description. Pass `null` to clear.
                allowlist:
                  type: array
                  items:
                    type: string
                  description: Replacement list of hostname glob patterns. Must not be empty; use `["*"]` to allow every host.
                credential:
                  $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredential'
components:
  schemas:
    V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf5AuthMethod:
      type: string
      enum:
      - oAuthPasswordCredentials
      title: V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf5AuthMethod
    V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf0Basic:
      type: object
      properties:
        username:
          type: string
          description: Username for Basic authentication.
        password:
          type: string
          description: Password for Basic authentication. Encrypted at rest; never returned in responses.
      required:
      - username
      - password
      title: V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf0Basic
    api-credentials_listApiCredentials_Response_200:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/V2ApiCredentialsGetResponsesContentApplicationJsonSchemaEntriesItems'
          description: Array of results returned by the endpoint
        nextPageToken:
          type: string
          description: 'A string that can be passed to the `pageToken` parameter in the next request to fetch the next page of results. Not present in the last page of results.

            **Must be treated as an opaque string.**'
      required:
      - entries
      title: api-credentials_listApiCredentials_Response_200
    V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItems:
      type: object
      properties:
        key:
          type: string
        value:
          type: string
        sendIn:
          $ref: '#/components/schemas/V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItemsSendIn'
      required:
      - key
      - value
      - sendIn
      title: V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItems
    V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentials:
      type: object
      properties:
        clientId:
          type: string
          description: OAuth client ID.
        clientSecret:
          type: string
          description: OAuth client secret. Encrypted at rest; never returned in responses.
        accessTokenUrl:
          type: string
          description: OAuth token endpoint URL.
        scopes:
          type: array
          items:
            type: string
          description: OAuth scopes requested at token exchange.
        accessTokenAuthMethod:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentialsAccessTokenAuthMethod'
          description: How client credentials are presented to the token endpoint.
      required:
      - clientId
      - clientSecret
      - accessTokenUrl
      - scopes
      - accessTokenAuthMethod
      title: V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentials
    V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential4:
      type: object
      properties:
        authMethod:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf4AuthMethod'
        oAuthAuthorizationCode:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf4OAuthAuthorizationCode'
      required:
      - authMethod
      title: V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential4
    V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential:
      oneOf:
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential0'
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential1'
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential2'
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential3'
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential4'
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential5'
      - $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential6'
      description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
      title: V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential
    V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf1AuthMethod:
      type: string
      enum:
      - bearer
      title: V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf1AuthMethod
    ? V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentialsAccessTokenAuthMethod
    : type: string
      enum:
      - httpBasic
      - requestBody
      description: How client credentials are presented to the token endpoint.
      title: V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentialsAccessTokenAuthMethod
    V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf2AuthMethod:
      type: string
      enum:
      - apiKey
      title: V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf2AuthMethod
    V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf2AuthMethod:
      type: string
      enum:
      - apiKey
      title: V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf2AuthMethod
    V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential3:
      type: object
      properties:
        authMethod:
          $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf3AuthMethod'
        oAuthClientCredentials:
          $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf3OAuthClientCredentials'
      required:
      - authMethod
      title: V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential3
    ? V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItems
    : type: object
      properties:
        key:
          type: string
        value:
          type: string
        sendIn:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItemsSendIn'
      required:
      - key
      - value
      - sendIn
      title: V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItems
    V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf2ApiKey:
      type: object
      properties:
        key:
          type: string
          description: Header or query parameter name carrying the API key.
        isQueryParam:
          type: boolean
          description: Whether the key is sent as a query parameter; if false, it is sent as a header.
      required:
      - key
      - isQueryParam
      title: V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf2ApiKey
    V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential:
      oneOf:
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential0'
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential1'
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential2'
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential3'
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential4'
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential5'
      - $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential6'
      description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
      title: V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential
    ? V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItemsSendIn
    : type: string
      enum:
      - queryParam
      - body
      - header
      title: V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItemsSendIn
    ? V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsResponseMapping
    : type: object
      properties:
        accessKeyField:
          type: string
        secretKeyField:
          type: string
        sessionTokenField:
          type: string
        expirationField:
          type: string
      title: V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsResponseMapping
    V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential5:
      type: object
      properties:
        authMethod:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf5AuthMethod'
        oAuthPasswordCredentials:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf5OAuthPasswordCredentials'
      required:
      - authMethod
      title: V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredential5
    V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf4OAuthAuthorizationCode:
      type: object
      properties:
        clientId:
          type: string
          description: OAuth client ID.
        authorizationUrl:
          type: string
          description: OAuth authorization endpoint URL.
        accessTokenUrl:
          type: string
          description: OAuth token endpoint URL.
        scopes:
          type: array
          items:
            type: string
          description: OAuth scopes.
        accessTokenAuthMethod:
          $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf4OAuthAuthorizationCodeAccessTokenAuthMethod'
          description: How client credentials are presented to the token endpoint.
      required:
      - clientId
      - authorizationUrl
      - accessTokenUrl
      - scopes
      - accessTokenAuthMethod
      title: V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredentialOneOf4OAuthAuthorizationCode
    api-credentials_getApiCredential_Response_200:
      type: object
      properties:
        apiCredentialId:
          type: string
          description: Unique identifier of the API credential.
        name:
          type: string
          description: Display name of the credential.
        authMethod:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaAuthMethod'
          description: Authentication method the credential uses.
        allowlist:
          type: array
          items:
            type: string
          description: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against.
        credential:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredential'
          description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
        createdBy:
          type: string
          description: The identifier of the user who created this object.
        updatedBy:
          type: string
          description: The identifier of the user or process that last updated this object.
        createdAt:
          type: string
          format: date-time
          description: When the object was created.
        updatedAt:
          type: string
          format: date-time
          description: When the object was last updated.
        description:
          type: string
          description: Human-readable description.
      required:
      - apiCredentialId
      - name
      - authMethod
      - allowlist
      - credential
      - createdBy
      - updatedBy
      - createdAt
      - updatedAt
      title: api-credentials_getApiCredential_Response_200
    V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4:
      type: object
      properties:
        accessKeyId:
          type: string
          description: AWS access key ID.
        region:
          type: string
          description: AWS region for SigV4 signing.
        service:
          type: string
          description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
        temporaryCredentialsUrl:
          type: string
          description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
        temporaryCredentialsResponseMapping:
          $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsResponseMapping'
        temporaryCredentialsRequestParams:
          type: array
          items:
            $ref: '#/components/schemas/V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsRequestParamsItems'
          description: Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`).
      required:
      - accessKeyId
      title: V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4
    V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf2ApiKey:
      type: object
      properties:
        key:
          type: string
          description: Header or query parameter name carrying the API key.
        isQueryParam:
          type: boolean
          description: Whether the key is sent as a query parameter; if false, it is sent as a header.
      required:
      - key
      - isQueryParam
      title: V2ApiCredentialsApiCredentialIdPatchResponsesContentApplicationJsonSchemaCredentialOneOf2ApiKey
    ? V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsRequestParamsItemsSendIn
    : type: string
      enum:
      - queryParam
      - body
      - header
      title: V2ApiCredentialsApiCredentialIdGetResponsesContentApplicationJsonSchemaCredentialOneOf6AwsSigV4TemporaryCredentialsRequestParamsItemsSendIn
    V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4:
      type: object
      properties:
        accessKeyId:
          type: string
          description: AWS access key ID.
        secretAccessKey:
          type: string
          description: AWS secret access key. Encrypted at rest; never returned in responses.
        region:
          type: string
          description: AWS region for SigV4 signing.
        service:
          type: string
          description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
        sessionToken:
          type: string
          description: AWS STS session token for temporary credentials.
        temporaryCredentialsUrl:
          type: string
          description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
        temporaryCredentialsResponseMapping:
          $ref: '#/components/schemas/V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsResponseMapping'
        temporaryCredentialsRequestParams:
          type: array
          items:
            $ref: '#/components/schemas/V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4TemporaryCredentialsRequestParamsItems'
          description: 'Additional key/value parameters attached to the temporary-credentials swap request. Each entry specifies whether it is sent as a request header, body field, or query parameter (`sendIn`: `header` | `body` | `queryParam`). Use this when the swap endpoint requires its own authentication (for example, an `x-api-key` header).'
      required:
      - accessKeyId
      - secretAccessKey
      title: V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4
    V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf1Bearer:
      type: object
      properties:
        token:
          type: string
          description: Bearer token. Encrypted at rest; never returned in responses.
      required:
      - token
      title: V2ApiCredentialsApiCredentialIdPatchRequestBodyContentApplicationJsonSchemaCredentialOneOf1Bearer
    api-credentials_deleteApiCredential_Response_200:
      type: object
      properties: {}
      title: api-credentials_deleteApiCredential_Response_200
    api-credentials_createApiCredential_Response_200:
      type: object
      properties:
        apiCredentialId:
          type: string
          description: Unique identifier of the API credential.
        name:
          type: string
          description: Display name of the credential.
        authMethod:
          $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaAuthMethod'
          description: Authentication method the credential uses.
        allowlist:
          type: array
          items:
            type: string
          description: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against.
        credential:
          $ref: '#/components/schemas/V2ApiCredentialsPostResponsesContentApplicationJsonSchemaCredential'
          description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
        createdBy:
          type: string
          description: The identifier of the user who created this object.
        updatedBy:
          type: string
          description: The identifier of the user or process that last updated this object.
        createdAt:
          type: string
          format: date-time
          description: When the object was created.
        updatedAt:
          type: string
          format: date-time
          description: When the object was last updated.
        description:
          type: string
          description: Human-readable description.
      required:
      - apiCredentialId
      - name
      - authMethod
      - allowlist
      - credential
      - createdBy
      - updatedBy
      - createdAt
      - updatedAt
      title: api-credentials_createApiCredential_Response_200
    ? V2ApiCredentialsPostRequestBodyContentApplicationJsonSchemaCredentialOneOf4AwsSigV4Tempora

# --- truncated at 32 KB (87 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/sigma-computing/refs/heads/main/openapi/sigma-computing-apicredentials-api-openapi.yml