openapi: 3.2.0 info: title: Lakekeeper Warehouse API version: 0.0.0 description: 'Operations tagged warehouse across 2 of this provider''s published API definitions: lakekeeper-management-api-openapi.yml, lakekeeper-management-plus-api-openapi.yml. Each path carries the servers of the definition it was published in.' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https security: - bearerAuth: [] tags: - name: warehouse description: Manage Warehouses paths: /management/v1/warehouse: get: tags: - warehouse summary: List Warehouses description: 'Returns all warehouses in the project that the current user has access to. By default, deactivated warehouses are not included in the results. Set the `include_deactivated` query parameter to `true` to include them.' operationId: list_warehouses parameters: - name: warehouseStatus in: query description: 'Optional filter to return only warehouses with the specified status. If not provided, only active warehouses are returned.' required: false schema: type: array items: $ref: '#/components/schemas/WarehouseStatus' - name: projectId in: query description: 'The project ID to list warehouses for. Deprecated: Please use the `x-project-id` header instead.' required: false schema: type: - string - 'null' responses: '200': description: List of warehouses content: application/json: schema: $ref: '#/components/schemas/ListWarehousesResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' post: tags: - warehouse summary: Create Warehouse description: 'Creates a new warehouse in the specified project with the provided configuration. The project of a warehouse cannot be changed after creation. This operation validates the storage configuration.' operationId: create_warehouse requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateWarehouseRequest' required: true responses: '201': description: Warehouse created successfully content: application/json: schema: $ref: '#/components/schemas/CreateWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}: get: tags: - warehouse summary: Get Warehouse description: Retrieves detailed information about a specific warehouse. operationId: get_warehouse parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid responses: '200': description: Warehouse details content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' delete: tags: - warehouse summary: Delete Warehouse description: 'Permanently removes a warehouse and all its associated resources. Use the `force` parameter to delete protected warehouses.' operationId: delete_warehouse parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid responses: '204': description: Warehouse deleted successfully 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/actions: get: tags: - warehouse summary: Get allowed actions for a warehouse operationId: get_warehouse_actions parameters: - name: principalUser in: query description: 'The user to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string - name: principalRole in: query description: 'The role to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string format: uuid - name: warehouse_id in: path description: Warehouse ID required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/GetLakekeeperWarehouseActionsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/activate: post: tags: - warehouse summary: Activate Warehouse description: Re-enables access to a previously deactivated warehouse. operationId: activate_warehouse parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid responses: '200': description: Warehouse activated successfully 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/deactivate: post: tags: - warehouse summary: Deactivate Warehouse description: Temporarily disables access to a warehouse without deleting its data. operationId: deactivate_warehouse parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid responses: '200': description: Warehouse deactivated successfully 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/delete-profile: post: tags: - warehouse summary: Update Deletion Profile description: Configures the soft-delete behavior for a warehouse. operationId: update_warehouse_delete_profile parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateWarehouseDeleteProfileRequest' required: true responses: '200': description: Deletion Profile updated successfully content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/deleted-tabulars: get: tags: - warehouse summary: List Soft-Deleted Tabulars description: Returns all soft-deleted tables and views in the warehouse that are visible to the current user. operationId: list_deleted_tabulars parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: namespaceId in: query description: Filter by Namespace ID required: false schema: type: string format: uuid - name: pageToken in: query description: Next page token required: false schema: type: - string - 'null' - name: pageSize in: query description: 'Signals an upper bound of the number of results that a client will receive. Default: 100' required: false schema: type: - integer - 'null' format: int64 responses: '200': description: List of soft-deleted tabulars content: application/json: schema: $ref: '#/components/schemas/ListDeletedTabularsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/deleted-tabulars/undrop: post: tags: - warehouse summary: Undrop Tabular description: Restores previously deleted tables or views to make them accessible again. operationId: undrop_tabulars parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UndropTabularsRequest' required: true responses: '204': description: Tabular undropped successfully 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/format-version-policy: post: tags: - warehouse summary: Update Format Version Policy description: 'Configures which Iceberg table format versions may be created in, or upgraded to, within a warehouse, and the default version applied when a create-table request does not specify one.' operationId: update_warehouse_format_version_policy parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateWarehouseFormatVersionPolicyRequest' required: true responses: '200': description: Format version policy updated successfully content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/generic-table/{generic_table_id}/actions: get: tags: - warehouse summary: Get allowed actions for a generic table operationId: get_generic_table_actions parameters: - name: principalUser in: query description: 'The user to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string - name: principalRole in: query description: 'The role to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string format: uuid - name: warehouse_id in: path required: true schema: type: string format: uuid - name: generic_table_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/GetLakekeeperGenericTableActionsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/generic-table/{generic_table_id}/protection: get: tags: - warehouse summary: Get Generic Table Protection description: Retrieves whether a generic table is protected from deletion. operationId: get_generic_table_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: generic_table_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' post: tags: - warehouse summary: Set Generic Table Protection description: Configures whether a generic table should be protected from deletion. operationId: set_generic_table_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: generic_table_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SetProtectionRequest' required: true responses: '200': description: Generic table protection set successfully content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/managed-by: post: tags: - warehouse summary: Set Warehouse Managed-By description: 'Sets (or clears) the managed-by marker on a warehouse. When set, the warehouse spec becomes mutable only by the managing control plane (instance admins). Requires instance-admin privilege.' operationId: set_warehouse_managed_by parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SetWarehouseManagedByRequest' required: true responses: '200': description: Warehouse managed-by marker set successfully content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/actions: get: tags: - warehouse summary: Get allowed actions for a namespace operationId: get_namespace_actions parameters: - name: principalUser in: query description: 'The user to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string - name: principalRole in: query description: 'The role to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string format: uuid - name: warehouse_id in: path required: true schema: type: string format: uuid - name: namespace_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/GetLakekeeperNamespaceActionsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/namespace/{namespace_id}/protection: get: tags: - warehouse summary: Get Namespace Protection description: Retrieves whether a namespace is protected from deletion. operationId: get_namespace_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: namespace_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' post: tags: - warehouse summary: Set Namespace Protection description: Configures whether a namespace should be protected from deletion. operationId: set_namespace_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: namespace_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SetProtectionRequest' required: true responses: '200': description: Namespace protection set successfully content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/protection: post: tags: - warehouse summary: Set Warehouse Protection description: Configures whether a warehouse should be protected from deletion. operationId: set_warehouse_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SetProtectionRequest' required: true responses: '200': description: Warehouse protection set successfully content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/rename: post: tags: - warehouse summary: Rename Warehouse description: Updates the name of a specific warehouse. operationId: rename_warehouse parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/RenameWarehouseRequest' required: true responses: '200': description: Warehouse renamed successfully content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/search-tabular: post: tags: - warehouse summary: Search Tabulars description: 'Performs a fuzzy search for tabulars based on the provided criteria. If the search string can be parsed as uuid: - if there is tabular with that uuid, the tabular is in the response - if there is a namespace with that uuid, tables in that namespace are in the response' operationId: search_tabular parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SearchTabularRequest' required: true responses: '200': description: List of tabulars content: application/json: schema: $ref: '#/components/schemas/SearchTabularResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/statistics: get: tags: - warehouse summary: Get Warehouse Statistics description: "Retrieves statistical data about a warehouse's usage and resources over time.\nStatistics are aggregated hourly when changes occur.\n\nWe lazily create a new statistics entry every hour, in between hours, the existing entry is\nbeing updated. If there's a change at `created_at + 1 hour`, a new entry is created.\nIf there's been no change, no new entry is created, meaning there may be gaps.\n\nExample:\n- 00:16:32: warehouse created:\n - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: null, 0 tables, 0 views`\n- 00:30:00: table created:\n - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: 00:30:00, 1 table, 0 views`\n- 00:45:00: view created:\n - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: 00:45:00, 1 table, 1 view`\n- 01:00:36: table deleted:\n - `timestamp: 02:00:00, created_at: 01:00:36, updated_at: null, 0 tables, 1 view`\n - `timestamp: 01:00:00, created_at: 00:16:32, updated_at: 00:45:00, 1 table, 1 view`" operationId: get_warehouse_statistics parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: page_token in: query description: Next page token required: false schema: type: string - name: page_size in: query description: Signals an upper bound of the number of results that a client will receive. required: false schema: type: - integer - 'null' format: int64 responses: '200': description: Warehouse statistics content: application/json: schema: $ref: '#/components/schemas/WarehouseStatisticsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/storage: post: tags: - warehouse summary: Update Storage Profile description: Updates both the storage profile and credentials of a warehouse. operationId: update_storage_profile parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateWarehouseStorageRequest' required: true responses: '200': description: Storage profile updated successfully content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/storage-credential: post: tags: - warehouse summary: Update Storage Credential description: 'Updates only the storage credential of a warehouse without modifying the storage profile. Useful for refreshing expiring credentials.' operationId: update_storage_credential parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateWarehouseCredentialRequest' required: true responses: '200': description: Storage credential updated successfully content: application/json: schema: $ref: '#/components/schemas/GetWarehouseResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/table/{table_id}/actions: get: tags: - warehouse summary: Get allowed actions for a table operationId: get_table_actions parameters: - name: principalUser in: query description: 'The user to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string - name: principalRole in: query description: 'The role to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string format: uuid - name: warehouse_id in: path required: true schema: type: string format: uuid - name: table_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/GetLakekeeperTableActionsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/table/{table_id}/protection: get: tags: - warehouse summary: Get Table Protection description: Retrieves whether a table is protected from deletion. operationId: get_table_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: table_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' post: tags: - warehouse summary: Set Table Protection description: Configures whether a table should be protected from deletion. operationId: set_table_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: table_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SetProtectionRequest' required: true responses: '200': description: Table protection set successfully content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/view/{view_id}/actions: get: tags: - warehouse summary: Get allowed actions for a view operationId: get_view_actions parameters: - name: principalUser in: query description: 'The user to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string - name: principalRole in: query description: 'The role to show actions for. If neither user nor role is specified, shows actions for the current user.' required: false schema: type: string format: uuid - name: warehouse_id in: path required: true schema: type: string format: uuid - name: view_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/GetLakekeeperViewActionsResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https /management/v1/warehouse/{warehouse_id}/view/{view_id}/protection: get: tags: - warehouse summary: Get View Protection description: Retrieves whether a view is protected from deletion. operationId: get_view_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: view_id in: path required: true schema: type: string format: uuid responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' post: tags: - warehouse summary: Set View Protection description: Configures whether a view should be protected from deletion. operationId: set_view_protection parameters: - name: warehouse_id in: path required: true schema: type: string format: uuid - name: view_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/SetProtectionRequest' required: true responses: '200': description: View protection set successfully content: application/json: schema: $ref: '#/components/schemas/ProtectionResponse' 4XX: description: '' content: application/json: schema: $ref: '#/components/schemas/IcebergErrorResponse' servers: - url: '{scheme}://{host}{basePath}' description: Lakekeeper Management API variables: basePath: default: '' description: Optional path prefix (starting with '/') to be prepended to all routes host: default: localhost description: The host (and optional port) for the specified server scheme: default: https description: The scheme of the URI, either http or https components: schemas: UpdateWarehouseStorageRequest: type: object required: - storage-profile properties: storage-credential: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageCredential' description: 'Optional storage credential to use for the warehouse. The existing credential is not re-used. If no credential is provided, we assume that this storage does not require credentials.' storage-profile: $ref: '#/components/schemas/StorageProfile' description: 'Storage profile to use for the warehouse. The new profile must point to the same location as the existing profile to avoid data loss. For S3 this means that you may not change the bucket or key prefix. The region may only be changed if an `endpoint` is set on the new profile (so the endpoint, not the region, determines where S3 requests are routed).' LakekeeperGenericTableAction: oneOf: - type: object required: - action properties: action: type: string enum: - drop - type: object required: - action properties: action: type: string enum: - read_data - type: object required: - action properties: action: type: string enum: - write_data - type: object required: - action properties: action: type: string enum: - get_metadata - type: object required: - action properties: action: type: string enum: - rename - type: object required: - action properties: action: type: string enum: - include_in_list - type: object required: - action properties: action: type: string enum: - undrop - type: object required: - action properties: action: type: string enum: - get_tasks - type: object required: - action properties: action: type: string enum: - control_tasks - type: object required: - action properties: action: type: string enum: - set_protection StorageCredential: oneOf: - allOf: - $ref: '#/components/schemas/S3Credential' description: "Credentials for S3 storage\n\nExample payload in the code-snippet below:\n\n```\nuse lakekeeper::service::storage::StorageCredential;\nlet cred: StorageCredential = serde_json::from_str(r#\"{\n \"type\": \"s3\",\n \"credential-type\": \"access-key\",\n \"access-key-id\": \"minio-root-user\",\n \"secret-access-key\": \"minio-root-password\"\n }\"#).unwrap();\n```" - type: object required: - type properties: type: type: string enum: - s3 title: StorageCredentialS3 description: "Credentials for S3 storage\n\nExample payload in the code-snippet below:\n\n```\nuse lakekeeper::service::storage::StorageCredential;\nlet cred: StorageCredential = serde_json::from_str(r#\"{\n \"type\": \"s3\",\n \"credential-type\": \"access-key\",\n \"access-key-id\": \"minio-root-user\",\n \"secret-access-key\": \"minio-root-password\"\n }\"#).unwrap();\n```" - allOf: - $ref: '#/components/schemas/AzCredential' description: "Credentials for Az storage\n\nExample payload:\n\n```\nuse lakekeeper::service::storage::StorageCredential;\nlet cred: StorageCredential = serde_json::from_str(r#\"{\n \"type\": \"az\",\n \"credential-type\": \"client-credentials\",\n \"client-id\": \"...\",\n \"client-secret\": \"...\",\n \"tenant-id\": \"...\"\n }\"#).unwrap();\n```" - type: object required: - type properties: type: type: string enum: - az title: StorageCredentialAz description: "Credentials for Az storage\n\nExample payload:\n\n```\nuse lakekeeper::service::storage::StorageCredential;\nlet cred: StorageCredential = serde_json::from_str(r#\"{\n \"type\": \"az\",\n \"credential-type\": \"client-credentials\",\n \"client-id\": \"...\",\n \"client-secret\": \"...\",\n \"tenant-id\": \"...\"\n }\"#).unwrap();\n```" - allOf: - $ref: '#/components/schemas/GcsCredential' description: "Credentials for GCS storage\n\nExample payload in the code-snippet below:\n\n```\nuse lakekeeper::service::storage::StorageCredential;\nlet cred: StorageCredential = serde_json::from_str(r#\"{\n \"type\": \"gcs\",\n \"credential-type\": \"service-account-key\",\n \"key\": {\n \"type\": \"service_account\",\n \"project_id\": \"example-project-1234\",\n \"private_key_id\": \"....\",\n \"private_key\": \"REDACTED_PRIVATE_KEY_EXAMPLE\\n\",\n \"client_email\": \"abc@example-project-1234.iam.gserviceaccount.com\",\n \"client_id\": \"123456789012345678901\",\n \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n \"token_uri\": \"https://oauth2.googleapis.com/token\",\n \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/abc%example-project-1234.iam.gserviceaccount.com\",\n \"universe_domain\": \"googleapis.com\"\n }\n}\"#).unwrap();\n```\n" - type: object required: - type properties: type: type: string enum: - gcs title: StorageCredentialGcs description: "Credentials for GCS storage\n\nExample payload in the code-snippet below:\n\n```\nuse lakekeeper::service::storage::StorageCredential;\nlet cred: StorageCredential = serde_json::from_str(r#\"{\n \"type\": \"gcs\",\n \"credential-type\": \"service-account-key\",\n \"key\": {\n \"type\": \"service_account\",\n \"project_id\": \"example-project-1234\",\n \"private_key_id\": \"....\",\n \"private_key\": \"REDACTED_PRIVATE_KEY_EXAMPLE\\n\",\n \"client_email\": \"abc@example-project-1234.iam.gserviceaccount.com\",\n \"client_id\": \"123456789012345678901\",\n \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n \"token_uri\": \"https://oauth2.googleapis.com/token\",\n \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/abc%example-project-1234.iam.gserviceaccount.com\",\n \"universe_domain\": \"googleapis.com\"\n }\n}\"#).unwrap();\n```\n" description: Storage secret for a warehouse. SearchTabularRequest: type: object required: - search properties: search: type: string description: 'Search string for fuzzy search. Length is truncated to 64 characters.' maxLength: 64 AzCredentialType: type: string description: The type of Azure credential. enum: - client-credentials - shared-access-key - azure-system-identity StorageLayoutTabularTemplate: type: string description: 'Template string for tabular names. Placeholders {uuid} and {name} (with curly braces) will be replaced with the actual tabular UUID and name respectively. The {name} value is percent-encoded (URL percent-encoding) so spaces and special characters are escaped (e.g. "my tabular" becomes "my%20tabular"). The {uuid} value is inserted as-is without encoding. Example: "{name}-{uuid}" for a tabular named "my tabular" renders to "my%20tabular-550e8400-e29b-41d4-a716-446655440002".' example: '{uuid}' WarehouseStatus: type: string description: Status of a warehouse enum: - active - inactive S3Credential: oneOf: - allOf: - $ref: '#/components/schemas/S3AccessKeyCredential' description: Authenticate to AWS using access-key and secret-key. - type: object required: - credential-type properties: credential-type: type: string enum: - access-key description: Authenticate to AWS using access-key and secret-key. - allOf: - $ref: '#/components/schemas/S3AwsSystemIdentityCredential' description: "Authenticate to AWS using the identity configured on the system\n that runs lakekeeper. The AWS SDK is used to load the credentials." - type: object required: - credential-type properties: credential-type: type: string enum: - aws-system-identity description: "Authenticate to AWS using the identity configured on the system\n that runs lakekeeper. The AWS SDK is used to load the credentials." - allOf: - $ref: '#/components/schemas/S3CloudflareR2Credential' - type: object required: - credential-type properties: credential-type: type: string enum: - cloudflare-r2 WarehouseStatistics: type: object required: - timestamp - number-of-tables - number-of-views - updated-at properties: number-of-tables: type: integer format: int64 description: Number of tables in the warehouse. number-of-views: type: integer format: int64 description: Number of views in the warehouse. timestamp: type: string format: date-time description: 'Timestamp of when these statistics are valid until We lazily create a new statistics entry every hour, in between hours, the existing entry is being updated. If there''s a change at `created_at` + 1 hour, a new entry is created. If there''s no change, no new entry is created.' updated-at: type: string format: date-time description: Timestamp of when these statistics were last updated UndropTabularsRequest: type: object required: - targets properties: targets: type: array items: $ref: '#/components/schemas/TabularIdentUuid' description: Tabulars to undrop GcsCredentialType: type: string description: The type of GCS credential. enum: - service-account-key - gcp-system-identity IcebergErrorResponse: type: object description: JSON wrapper for all error responses (non-2xx) required: - error properties: error: $ref: '#/components/schemas/ErrorModel' DeletedTabularResponse: type: object required: - id - name - namespace - typ - warehouse-id - created-at - deleted-at - expiration-date properties: created-at: type: string format: date-time description: Date when the tabular was created deleted-at: type: string format: date-time description: Date when the tabular was deleted expiration-date: type: string format: date-time description: Date when the tabular will not be recoverable anymore id: type: string format: uuid description: Unique identifier of the tabular name: type: string description: Name of the tabular namespace: type: array items: type: string description: List of namespace parts the tabular belongs to typ: $ref: '#/components/schemas/TabularType' description: Type of the tabular warehouse-id: type: string format: uuid description: Warehouse ID where the tabular is stored ManagedBy: type: string description: 'Which control plane, if any, exclusively manages a warehouse''s spec. `self-managed` (the default) leaves the spec mutable by the warehouse''s own owners through the usual grants. When set to `instance-admin`, spec changes — storage profile, credentials, delete profile, rename, status, protection, format-version policy, and deletion — are accepted only from instance administrators; other callers are rejected even when their grants would otherwise allow it. Child resources (namespaces, tables, grants), task-queue configuration, and data access are unaffected.' enum: - self-managed - instance-admin StorageLayoutFullHierarchy: type: object description: 'One directory per namespace level, one per tabular. For a tabular `my_tabular` (uuid `…003`) in `grandparent_ns` / `parent_ns` the path is: `///`.' required: - namespace - tabular properties: namespace: $ref: '#/components/schemas/StorageLayoutNamespaceTemplate' tabular: $ref: '#/components/schemas/StorageLayoutTabularTemplate' example: namespace: '{name}-{uuid}' tabular: '{name}-{uuid}' StorageLayoutNamespaceTemplate: type: string description: 'Template string for namespace path segments. Placeholders {uuid} and {name} (with curly braces) will be replaced with the actual namespace UUID and name respectively. The {name} value is percent-encoded (URL percent-encoding) so spaces and special characters are escaped (e.g. "my name" becomes "my%20name"). The {uuid} value is inserted as-is without encoding. Example: "{name}-{uuid}" for a namespace named "my ns" renders to "my%20ns-550e8400-e29b-41d4-a716-446655440001".' example: '{uuid}' CreateWarehouseRequest: type: object required: - warehouse-name - storage-profile properties: allowed-format-versions: type: - array - 'null' items: type: integer format: int32 description: 'Iceberg table format versions that may be created in, or upgraded to, within this warehouse. Must be a non-empty subset of `[1, 2, 3]`. Defaults to all supported versions when omitted.' default-format-version: type: - integer - 'null' format: int32 description: 'Default Iceberg table format version applied when a create-table request does not specify one. Must be a member of `allowed-format-versions`. When omitted, resolves to v2 if allowed, otherwise the highest allowed version.' delete-profile: $ref: '#/components/schemas/TabularDeleteProfile' description: 'Profile to determine behavior upon dropping of tabulars. Default: hard deletion.' managed-by: $ref: '#/components/schemas/ManagedBy' description: 'Which control plane, if any, exclusively manages this warehouse''s spec. Defaults to `self-managed`. Creating a managed warehouse (e.g. `instance-admin`) requires instance-admin privilege.' project-id: type: - string - 'null' description: 'Project ID in which to create the warehouse. Deprecated: Please use the `x-project-id` header instead.' storage-credential: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageCredential' description: Optional storage credential to use for the warehouse. storage-profile: $ref: '#/components/schemas/StorageProfile' description: Storage profile to use for the warehouse. warehouse-name: type: string description: 'Name of the warehouse to create. Must be unique within a project and may not contain "/"' S3Profile: type: object required: - bucket - region - sts-enabled properties: allow-alternative-protocols: type: - boolean - 'null' description: 'Allow `s3a://` and `s3n://` in locations. This is disabled by default. We do not recommend to use this setting except for migration of old hadoop-based tables via the register endpoint. Tables with `s3a` paths are not accessible outside the Java ecosystem.' assume-role-arn: type: - string - 'null' description: Optional ARN to assume when accessing the bucket from Lakekeeper. aws-kms-key-arn: type: - string - 'null' description: ARN of the KMS key used to encrypt the S3 bucket, if any. bucket: type: string description: Name of the S3 bucket endpoint: type: - string - 'null' format: uri description: 'Optional endpoint to use for S3 requests, if not provided the region will be used to determine the endpoint. If both region and endpoint are provided, the endpoint will be used. Example: `http://s3-de.my-domain.com:9000`' flavor: $ref: '#/components/schemas/S3Flavor' description: 'S3 flavor to use. Defaults to AWS' key-prefix: type: - string - 'null' description: Subpath in the bucket to use. legacy-md5-behavior: type: - boolean - 'null' description: 'Legacy MD5 behavior for S3 operations requiring checksums. When enabled, Lakekeeper will use the legacy MD5 checksum for operations like `DeleteObjects`.' path-style-access: type: - boolean - 'null' description: 'Path style access for S3 requests. If the underlying S3 supports both, we recommend to not set `path_style_access`.' push-s3-delete-disabled: type: boolean description: 'Controls whether the `s3.delete-enabled=false` flag is sent to clients. In all Iceberg 1.x versions, when Spark executes `DROP TABLE xxx PURGE`, it directly deletes files from S3, bypassing the catalog''s soft-deletion mechanism. Other query engines properly delegate this operation to the catalog. This Spark behavior is expected to change in Iceberg 2.0. Setting this to `true` pushes the `s3.delete-enabled=false` flag to clients, which discourages Spark from directly deleting files during `DROP TABLE xxx PURGE` operations. Note that clients may override this setting, and it affects other Spark operations that require file deletion, such as removing snapshots. For more details, refer to Lakekeeper''s [Soft-Deletion documentation](https://docs.lakekeeper.io/docs/nightly/concepts/#soft-deletion). This flag has no effect if Soft-Deletion is disabled for the warehouse.' region: type: string description: Region to use for S3 requests. remote-signing-enabled: type: boolean description: 'Enable remote signing for S3 requests. When disabled, clients cannot use remote signing even if STS is disabled. Defaults to true.' remote-signing-url-style: $ref: '#/components/schemas/S3UrlStyleDetectionMode' description: "S3 URL style detection mode for remote signing.\nOne of `auto`, `path-style`, `virtual-host`.\nDefault: `auto`. When set to `auto`, Lakekeeper will first try to parse the URL as\n`virtual-host` and then attempt `path-style`.\n`path` assumes the bucket name is the first path segment in the URL. `virtual-host`\nassumes the bucket name is the first subdomain if it is preceding `.s3` or `.s3-`.\n\nExamples\n\nVirtual host:\n - \n - \n\nPath style:\n - \n - " storage-layout: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageLayout' description: Storage layout for namespace and tabular paths. sts-enabled: type: boolean sts-endpoint: type: - string - 'null' format: uri description: 'Optional endpoint to use for STS requests. Use this when the STS endpoint differs from the S3 endpoint, which is common with S3-compatible storage systems. If not provided, the S3 `endpoint` is used for STS requests as well.' sts-role-arn: type: - string - 'null' description: 'Optional role ARN to assume for sts vended-credentials. If not provided, `assume_role_arn` is used. Either `assume_role_arn` or `sts_role_arn` must be provided if `sts_enabled` is true.' sts-session-tags: type: object description: Optional session tags for STS assume role operations. additionalProperties: type: string propertyNames: type: string sts-token-validity-seconds: type: integer format: int64 description: The validity of the sts tokens in seconds. Default is 3600 minimum: 0 ListWarehousesResponse: type: object required: - warehouses properties: warehouses: type: array items: $ref: '#/components/schemas/GetWarehouseResponse' description: List of warehouses in the project. SearchTabular: type: object required: - namespace-name - tabular-name - tabular-id properties: distance: type: - number - 'null' format: float description: Better matches have a lower distance namespace-name: type: array items: type: string description: Namespace name tabular-id: $ref: '#/components/schemas/TabularIdentUuid' description: ID of the tabular tabular-name: type: string description: Tabular name StorageProfile: oneOf: - allOf: - $ref: '#/components/schemas/AdlsProfile' description: 'Generic Azure Data Lake Storage Gen2 profile. Speaks ADLS Gen2 against any storage account.' - type: object required: - type properties: type: type: string enum: - adls title: StorageProfileAdls description: 'Generic Azure Data Lake Storage Gen2 profile. Speaks ADLS Gen2 against any storage account.' - allOf: - $ref: '#/components/schemas/OneLakeProfile' description: '`OneLake` (Microsoft Fabric) profile. Knows how to construct `OneLake` URLs from workspace + lakehouse IDs and how to derive the workspace-private-link endpoint host.' - type: object required: - type properties: type: type: string enum: - onelake title: StorageProfileOneLake description: '`OneLake` (Microsoft Fabric) profile. Knows how to construct `OneLake` URLs from workspace + lakehouse IDs and how to derive the workspace-private-link endpoint host.' - allOf: - $ref: '#/components/schemas/S3Profile' description: S3 storage profile - type: object required: - type properties: type: type: string enum: - s3 title: StorageProfileS3 description: S3 storage profile - allOf: - $ref: '#/components/schemas/GcsProfile' - type: object required: - type properties: type: type: string enum: - gcs title: StorageProfileGcs description: Storage profile for a warehouse. GcsProfile: type: object required: - bucket properties: bucket: type: string description: Name of the GCS bucket key-prefix: type: - string - 'null' description: Subpath in the bucket to use. storage-layout: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageLayout' description: Storage layout for namespace and tabular paths. sts-enabled: type: boolean description: 'Enable STS (Security Token Service) downscoped token generation for GCS. When disabled, clients cannot use vended credentials for this storage profile. Defaults to true.' LakekeeperViewActionKind: oneOf: - type: object required: - action properties: action: type: string enum: - drop - type: object required: - action properties: action: type: string enum: - get_metadata - type: object required: - action properties: action: type: string enum: - select - type: object required: - action properties: action: type: string enum: - commit - type: object required: - action properties: action: type: string enum: - include_in_list - type: object required: - action properties: action: type: string enum: - rename - type: object required: - action properties: action: type: string enum: - undrop - type: object required: - action properties: action: type: string enum: - get_tasks - type: object required: - action properties: action: type: string enum: - control_tasks - type: object required: - action properties: action: type: string enum: - set_protection UpdateWarehouseCredentialRequest: type: object properties: new-storage-credential: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageCredential' description: 'New storage credential to use for the warehouse. If not specified, the existing credential is removed.' SearchTabularResponse: type: object description: Search result for tabulars required: - tabulars properties: tabulars: type: array items: $ref: '#/components/schemas/SearchTabular' description: List of tabulars matching the search criteria UpdateWarehouseDeleteProfileRequest: type: object required: - delete-profile properties: delete-profile: $ref: '#/components/schemas/TabularDeleteProfile' LakekeeperTableActionKind: oneOf: - type: object required: - action properties: action: type: string enum: - drop - type: object required: - action properties: action: type: string enum: - write_data - type: object required: - action properties: action: type: string enum: - read_data - type: object required: - action properties: action: type: string enum: - get_metadata - type: object required: - action properties: action: type: string enum: - commit - type: object required: - action properties: action: type: string enum: - rename - type: object required: - action properties: action: type: string enum: - include_in_list - type: object required: - action properties: action: type: string enum: - undrop - type: object required: - action properties: action: type: string enum: - get_tasks - type: object required: - action properties: action: type: string enum: - control_tasks - type: object required: - action properties: action: type: string enum: - set_protection SetProtectionRequest: type: object required: - protected properties: protected: type: boolean description: Setting this to `true` will prevent the entity from being deleted unless `force` is used. UpdateWarehouseFormatVersionPolicyRequest: type: object required: - allowed-format-versions properties: allowed-format-versions: type: array items: type: integer format: int32 description: 'Iceberg table format versions that may be created in, or upgraded to, within this warehouse. Must be a non-empty subset of `[1, 2, 3]`.' default-format-version: type: - integer - 'null' format: int32 description: 'Default Iceberg table format version applied when a create-table request does not specify one. Must be a member of `allowed-format-versions`. When omitted, resolves to v2 if allowed, otherwise the highest allowed version.' AzCredential: oneOf: - type: object title: AzCredentialClientCredentials required: - client-id - tenant-id - client-secret - credential-type properties: client-id: type: string client-secret: type: string credential-type: type: string enum: - client-credentials tenant-id: type: string - type: object title: AzCredentialSharedAccessKey required: - key - credential-type properties: credential-type: type: string enum: - shared-access-key key: type: string - type: object title: AzCredentialManagedIdentity required: - credential-type properties: credential-type: type: string enum: - azure-system-identity StorageLayoutFlat: type: object description: 'No namespace directories; all tabulars are placed directly under the base location. For a tabular `my_tabular` (uuid `…002`) the path is: `/`. The tabular template must contain `{uuid}` to avoid collisions between tabulars with the same name.' required: - tabular properties: tabular: $ref: '#/components/schemas/StorageLayoutTabularTemplate' example: tabular: '{name}-{uuid}' GcsCredential: oneOf: - type: object title: GcsCredentialServiceAccountKey description: 'Service Account Key The key is the JSON object obtained when creating a service account key in the GCP console.' required: - key - credential-type properties: credential-type: type: string enum: - service-account-key key: $ref: '#/components/schemas/GcsServiceKey' - type: object title: GcsCredentialSystemIdentity description: 'GCP System Identity Use the service account that the application is running as. This can be a Compute Engine default service account or a user-assigned service account.' required: - credential-type properties: credential-type: type: string enum: - gcp-system-identity description: "GCS Credentials\n\nCurrently only supports Service Account Key\nExample of a key:\n```json\n {\n \"type\": \"service_account\",\n \"project_id\": \"example-project-1234\",\n \"private_key_id\": \"....\",\n \"private_key\": \"REDACTED_PRIVATE_KEY_EXAMPLE\\n\",\n \"client_email\": \"abc@example-project-1234.iam.gserviceaccount.com\",\n \"client_id\": \"123456789012345678901\",\n \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n \"token_uri\": \"https://oauth2.googleapis.com/token\",\n \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/abc%example-project-1234.iam.gserviceaccount.com\",\n \"universe_domain\": \"googleapis.com\"\n }\n```" TopLevelFolder: type: string description: 'Top-level managed folder within a Fabric lakehouse. Fabric reserves `Files/` and `Tables/` as managed folders directly under each lakehouse item. `Files/` is the default for Lakekeeper-managed Iceberg tables; `Tables/` is supported for completeness but writing Iceberg metadata there conflicts with Fabric''s automatic Delta/Iceberg virtualization.' enum: - Files - Tables S3Flavor: type: string enum: - aws - s3-compat RenameWarehouseRequest: type: object required: - new-name properties: new-name: type: string description: New name for the warehouse. GetLakekeeperViewActionsResponse: type: object required: - allowed-actions properties: allowed-actions: type: array items: $ref: '#/components/schemas/LakekeeperViewActionKind' TabularDeleteProfile: oneOf: - type: object title: TabularDeleteProfileHard required: - type properties: type: type: string enum: - hard - type: object title: TabularDeleteProfileSoft required: - expiration-seconds - type properties: expiration-seconds: type: integer format: int64 type: type: string enum: - soft OneLakeProfile: type: object description: 'Storage profile for a Microsoft Fabric / `OneLake` lakehouse. Convenience wrapper around the ADLS Gen2 surface that derives the account name (`onelake`), container (workspace ID), key prefix (`/Files/`), and endpoint host from the supplied workspace and lakehouse UUIDs and endpoint mode.' required: - workspace-id - lakehouse-id properties: authority-host: type: - string - 'null' format: uri description: 'The authority host to use for authentication. Default: `https://login.microsoftonline.com`.' directory-rel-path: type: - string - 'null' description: 'Subpath beneath `/` inside the lakehouse — the root directory under which Lakekeeper writes all warehouse data.' endpoint-mode: $ref: '#/components/schemas/EndpointMode' description: Endpoint connection mode. Defaults to the global endpoint. lakehouse-id: type: string format: uuid description: UUID of the lakehouse within the workspace. sas-enabled: type: boolean description: Enable SAS-token generation. Defaults to true. sas-token-validity-seconds: type: - integer - 'null' format: int64 description: 'SAS-token validity in seconds. Default: 3600. Max: 3600 (`OneLake` cap).' minimum: 0 storage-layout: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageLayout' description: Storage layout for namespace and tabular paths. top-level-folder: $ref: '#/components/schemas/TopLevelFolder' description: Top-level managed folder. Defaults to `Files`. workspace-id: type: string format: uuid description: UUID of the Fabric workspace this warehouse lives in. GetWarehouseResponse: type: object required: - id - warehouse-id - name - project-id - storage-profile - delete-profile - status - protected - allowed-format-versions properties: allowed-format-versions: type: array items: type: integer format: int32 description: 'Iceberg table format versions that may be created in, or upgraded to, within this warehouse.' default-format-version: type: - integer - 'null' format: int32 description: 'Default Iceberg table format version applied when a create-table request does not specify one. When absent, resolves to v2 if allowed, otherwise the highest allowed version.' delete-profile: $ref: '#/components/schemas/TabularDeleteProfile' description: Delete profile used for the warehouse. id: type: string format: uuid description: ID of the warehouse. deprecated: true managed-by: $ref: '#/components/schemas/ManagedBy' description: 'Which control plane, if any, exclusively manages this warehouse''s spec. When not `self-managed`, spec mutations are restricted to that control plane.' name: type: string description: Name of the warehouse. project-id: type: string description: Project ID in which the warehouse was created. protected: type: boolean description: Whether the warehouse is protected from being deleted. status: $ref: '#/components/schemas/WarehouseStatus' description: Whether the warehouse is active. storage-credential-type: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageCredentialType' description: 'Best-effort indicator of the storage credential type. When present it reflects the detected credential kind; when absent the warehouse may either have no credential configured or the secret lookup may have failed. Does not contain secret values.' storage-profile: $ref: '#/components/schemas/StorageProfile' description: Storage profile used for the warehouse. updated-at: type: - string - 'null' format: date-time description: Last updated timestamp. warehouse-id: type: string format: uuid description: ID of the warehouse. TabularType: type: string description: Type of tabular enum: - table - view - generic-table WarehouseStatisticsResponse: type: object required: - warehouse-ident - stats properties: next-page-token: type: - string - 'null' description: Next page token stats: type: array items: $ref: '#/components/schemas/WarehouseStatistics' description: Ordered list of warehouse statistics. warehouse-ident: type: string format: uuid description: ID of the warehouse for which the stats were collected. ListDeletedTabularsResponse: type: object required: - tabulars properties: next-page-token: type: - string - 'null' description: Token to fetch the next page tabulars: type: array items: $ref: '#/components/schemas/DeletedTabularResponse' description: List of tabulars EndpointMode: oneOf: - type: object description: 'Use the global `OneLake` endpoint `onelake.dfs.fabric.microsoft.com`. Default. Also the correct choice for tenant-level private link — tenant PE only changes DNS resolution, not the URL Lakekeeper constructs.' required: - type properties: type: type: string enum: - default - type: object description: 'Use a region-pinned endpoint `-onelake.dfs.fabric.microsoft.com`. Use this when data residency requires the request to stay within a specific Azure region.' required: - region - type properties: region: type: string description: 'Azure region slug, e.g. `westus`, `centralus`, `northeurope`. Trimmed and lowercased at validation time, then pattern-checked to match the Azure region-slug shape (lowercase ASCII letter followed by lowercase letters or digits) so a stray `.` or `-` can''t smuggle an extra host segment into the resolved DFS host. An unknown but well-shaped slug still surfaces as a DNS-resolution failure at access time. See `normalize_endpoint_mode` for the exact rule.' type: type: string enum: - regional - type: object description: 'Use a workspace-scoped private-link endpoint `.z.dfs.fabric.microsoft.com`. The host is computed from the workspace ID at runtime; users only opt in via this variant. For *tenant*-level private link, stay on [`Default`] — the global onelake FQDN is what gets routed through a tenant PE.' required: - type properties: type: type: string enum: - workspace-private-link description: "How Lakekeeper connects to the `OneLake` DFS endpoint.\n\nFabric supports two kinds of Azure Private Link configurations, and only\none of them maps to a dedicated variant here:\n\n- **Tenant-level private link**: traffic to the global host\n `onelake.dfs.fabric.microsoft.com` is routed privately via DNS that\n points the global FQDN at a tenant-PE NIC. From Lakekeeper's\n perspective this is indistinguishable from public traffic — use\n `Default`. (Same shape as a private endpoint in front of a regular\n ADLS Gen2 storage account.)\n- **Workspace-level private link**: each workspace gets its own\n `.z.dfs.fabric.microsoft.com` FQDN routed via a\n workspace-scoped PE. Lakekeeper needs to build that FQDN — use\n [`WorkspacePrivateLink`]." CreateWarehouseResponse: $ref: '#/components/schemas/GetWarehouseResponse' GetLakekeeperNamespaceActionsResponse: type: object required: - allowed-actions properties: allowed-actions: type: array items: $ref: '#/components/schemas/LakekeeperNamespaceActionKind' GetLakekeeperTableActionsResponse: type: object required: - allowed-actions properties: allowed-actions: type: array items: $ref: '#/components/schemas/LakekeeperTableActionKind' ProtectionResponse: type: object required: - protected properties: protected: type: boolean description: Indicates whether the entity is protected updated_at: type: - string - 'null' format: date-time description: Updated at S3CloudflareR2Credential: type: object title: CloudflareR2Credential required: - access-key-id - secret-access-key - token - account-id properties: access-key-id: type: string description: Access key ID used for IO operations of Lakekeeper account-id: type: string description: Cloudflare account ID, used to determine the temporary credentials endpoint. secret-access-key: type: string description: Secret key associated with the access key ID. token: type: string description: 'Token associated with the access key ID. This is used to fetch downscoped temporary credentials for vended credentials.' S3AwsSystemIdentityCredential: type: object title: S3CredentialSystemIdentity properties: external-id: type: - string - 'null' ErrorModel: type: object description: JSON error payload returned in a response with further details on the error required: - message - type - code properties: code: type: integer format: int32 description: HTTP response code minimum: 0 message: type: string description: Human-readable error message stack: type: array items: type: string type: type: string description: Internal type definition of the error LakekeeperNamespaceActionKind: oneOf: - type: object required: - action properties: action: type: string enum: - create_table - type: object required: - action properties: action: type: string enum: - create_view - type: object required: - action properties: action: type: string enum: - create_namespace - type: object required: - action properties: action: type: string enum: - delete - type: object required: - action properties: action: type: string enum: - update_properties - type: object required: - action properties: action: type: string enum: - get_metadata - type: object required: - action properties: action: type: string enum: - list_tables - type: object required: - action properties: action: type: string enum: - list_views - type: object required: - action properties: action: type: string enum: - list_namespaces - type: object required: - action properties: action: type: string enum: - list_everything - type: object required: - action properties: action: type: string enum: - set_protection - type: object required: - action properties: action: type: string enum: - include_in_list - type: object required: - action properties: action: type: string enum: - create_generic_table - type: object required: - action properties: action: type: string enum: - list_generic_tables StorageLayout: oneOf: - type: object required: - type properties: type: type: string enum: - default - allOf: - $ref: '#/components/schemas/StorageLayoutFlat' - type: object required: - type properties: type: type: string enum: - tabular-only - allOf: - $ref: '#/components/schemas/StorageLayoutFullHierarchy' - type: object required: - type properties: type: type: string enum: - full-hierarchy description: "Controls how namespace and tabular paths are constructed under the warehouse base location.\n\n- `default` / omitted: flat — no namespace directories; all tabulars are placed directly under\n the base location with a fixed `\"{uuid}\"` segment. (Changed in 0.13; before 0.13 the default\n emitted a `\"{uuid}\"` directory for the direct-parent namespace. Existing namespaces created\n before 0.13 keep their persisted location, so only namespaces created on/after 0.13 use the\n flat default.)\n- `full-hierarchy`: one directory per namespace level, one per tabular.\n- `tabular-only`: no namespace directories; all tabulars are placed directly under the base\n location, with a configurable tabular template (which must contain `{uuid}`).\n\nSegment templates may use `{uuid}` and `{name}` as placeholders." example: type: full-hierarchy namespace: '{name}-{uuid}' tabular: '{name}-{uuid}' GetLakekeeperWarehouseActionsResponse: type: object required: - allowed-actions properties: allowed-actions: type: array items: $ref: '#/components/schemas/LakekeeperWarehouseActionKind' GcsServiceKey: type: object required: - type - project_id - private_key_id - private_key - client_email - client_id - auth_uri - token_uri - auth_provider_x509_cert_url - client_x509_cert_url - universe_domain properties: auth_provider_x509_cert_url: type: string auth_uri: type: string client_email: type: string client_id: type: string client_x509_cert_url: type: string private_key: type: string private_key_id: type: string project_id: type: string token_uri: type: string type: type: string universe_domain: type: string AdlsProfile: type: object description: 'Storage profile for a generic Azure Data Lake Storage Gen2 account. This profile speaks ADLS Gen2 against any storage account (including Microsoft Fabric / `OneLake`, if you configure `account_name = "onelake"`, `host = "dfs.fabric.microsoft.com"`, and a `key_prefix` like `/Files/`). Lakekeeper offers `OneLakeProfile` as a convenience layer that knows how to compute those values from workspace + lakehouse IDs and that supports `OneLake`''s private-link endpoint pattern.' required: - filesystem - account-name properties: account-name: type: string description: Name of the azure storage account. allow-alternative-protocols: type: boolean description: 'Allow alternative protocols such as `wasbs://` in locations. This is disabled by default. We do not recommend to use this setting except for migration of old tables via the register endpoint.' authority-host: type: - string - 'null' format: uri description: 'The authority host to use for authentication. Default: `https://login.microsoftonline.com`.' filesystem: type: string description: Name of the adls filesystem, in blobstorage also known as container. host: type: - string - 'null' description: 'The host to use for the storage account. Default: `dfs.core.windows.net`.' key-prefix: type: - string - 'null' description: Subpath in the filesystem to use. sas-enabled: type: boolean description: 'Enable SAS (Shared Access Signature) token generation for Azure Data Lake Storage. When disabled, clients cannot use vended credentials for this storage profile. Defaults to true.' sas-token-validity-seconds: type: - integer - 'null' format: int64 description: 'The validity of the sas token in seconds. Default: 3600. Max: 7 days.' minimum: 0 storage-layout: oneOf: - type: 'null' - $ref: '#/components/schemas/StorageLayout' description: Storage layout for namespace and tabular paths. S3CredentialType: type: string description: The type of S3 credential. enum: - access-key - aws-system-identity - cloudflare-r2 TabularIdentUuid: oneOf: - type: object required: - id - type properties: id: type: string format: uuid type: type: string enum: - table - type: object required: - id - type properties: id: type: string format: uuid type: type: string enum: - view - type: object required: - id - type properties: id: type: string format: uuid type: type: string enum: - generic-table StorageCredentialType: oneOf: - type: object description: S3 credential type required: - credential-type - type properties: credential-type: $ref: '#/components/schemas/S3CredentialType' description: S3 credential type type: type: string enum: - s3 - type: object description: Azure credential type required: - credential-type - type properties: credential-type: $ref: '#/components/schemas/AzCredentialType' description: Azure credential type type: type: string enum: - az - type: object description: GCS credential type required: - credential-type - type properties: credential-type: $ref: '#/components/schemas/GcsCredentialType' description: GCS credential type type: type: string enum: - gcs description: 'The type of storage credential configured for a warehouse, without secret values. This is returned in API responses so clients know which credential type was selected (e.g. to restore radio button state in the UI).' S3AccessKeyCredential: type: object title: S3CredentialAccessKey required: - access-key-id - secret-access-key properties: access-key-id: type: string external-id: type: - string - 'null' secret-access-key: type: string SetWarehouseManagedByRequest: type: object required: - managed-by properties: managed-by: $ref: '#/components/schemas/ManagedBy' description: 'New managed-by marker. Use `self-managed` to clear. Setting or clearing the marker requires instance-admin privilege.' LakekeeperWarehouseActionKind: oneOf: - type: object required: - action properties: action: type: string enum: - create_namespace - type: object required: - action properties: action: type: string enum: - delete - type: object required: - action properties: action: type: string enum: - update_storage - type: object required: - action properties: action: type: string enum: - update_storage_credential - type: object required: - action properties: action: type: string enum: - get_metadata - type: object required: - action properties: action: type: string enum: - get_config - type: object required: - action properties: action: type: string enum: - list_namespaces - type: object required: - action properties: action: type: string enum: - list_everything - type: object required: - action properties: action: type: string enum: - use - type: object required: - action properties: action: type: string enum: - include_in_list - type: object required: - action properties: action: type: string enum: - deactivate - type: object required: - action properties: action: type: string enum: - activate - type: object required: - action properties: action: type: string enum: - rename - type: object required: - action properties: action: type: string enum: - list_deleted_tabulars - type: object required: - action properties: action: type: string enum: - modify_soft_deletion - type: object required: - action properties: action: type: string enum: - get_task_queue_config - type: object required: - action properties: action: type: string enum: - modify_task_queue_config - type: object required: - action properties: action: type: string enum: - get_all_tasks - type: object required: - action properties: action: type: string enum: - control_all_tasks - type: object required: - action properties: action: type: string enum: - set_protection - type: object required: - action properties: action: type: string enum: - set_format_version_policy - type: object required: - action properties: action: type: string enum: - get_endpoint_statistics GetLakekeeperGenericTableActionsResponse: type: object required: - allowed-actions properties: allowed-actions: type: array items: $ref: '#/components/schemas/LakekeeperGenericTableAction' S3UrlStyleDetectionMode: type: string enum: - path - virtual_host - auto securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT x-refined-from: - lakekeeper-management-api-openapi.yml - lakekeeper-management-plus-api-openapi.yml