openapi: 3.2.0 info: title: Sigma Computing Public REST API Credentials API version: 2.0.0 summary: The Sigma REST API provides developers access to resources programmatically, using HTTP. description: "The Sigma REST API provides developers access to resources programmatically,\n using HTTP. The API allows secure access to all the commonly used resources\n like connections, datasets, teams, workbooks and more. It is designed to have\n predictable, resource-oriented URLs and to use HTTP response codes to\n indicate API errors. It uses built-in HTTP features, like HTTP\n authentication and HTTP verbs, which are understood by off-the-shelf HTTP\n clients. It supports cross-origin resource sharing, allowing you to interact\n securely with the API from a client-side web application (though you should\n never expose your client credentials or API token in any public website's client-side code).\n JSON is returned by all API responses, including errors.\n Some useful links:\n - [API Reference Help](https://help.sigmacomputing.com/reference)\n - [API QuickStart with Postman](https://quickstarts.sigmacomputing.com/guide/sigma_api_with_postman/index.html?index=..%2F..index#0)" termsOfService: Contact Sigma contact: email: support@sigmacomputing.com servers: - url: https://api.sigmacomputing.com description: Server for GCP (US) hosted organizations - url: https://api.sa.gcp.sigmacomputing.com description: Server for GCP (KSA) hosted organizations - url: https://aws-api.sigmacomputing.com description: Server for AWS US (West) hosted organizations - url: https://api.us-a.aws.sigmacomputing.com description: Server for AWS US (East) hosted organizations - url: https://api.ca.aws.sigmacomputing.com description: Server for AWS Canada hosted organizations - url: https://api.eu.aws.sigmacomputing.com description: Server for AWS Europe hosted organizations - url: https://api.au.aws.sigmacomputing.com description: Server for AWS Australia and APAC hosted organizations - url: https://api.uk.aws.sigmacomputing.com description: Server for AWS UK hosted organizations - url: https://api.us.azure.sigmacomputing.com description: Server for Azure US hosted organizations - url: https://api.eu.azure.sigmacomputing.com description: Server for Azure Europe hosted organizations - url: https://api.ca.azure.sigmacomputing.com description: Server for Azure Canada hosted organizations - url: https://api.uk.azure.sigmacomputing.com description: Server for Azure United Kingdom hosted organizations - url: https://api.au.azure.sigmacomputing.com description: Server for Azure Australia hosted organizations security: - oauth2: [] tags: - name: api-credentials paths: /v2/api-credentials: get: summary: List API credentials description: 'This endpoint returns a paginated list of API credentials. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma). ### Usage notes - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled. - Only returns [API credentials](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma#add-a-new-api-credential-to-sigma) that the user making this request has at least **Can view** access to. - Secret fields such as passwords, tokens, and client secrets are never included in the response. - Use the `name` query parameter to filter by credential name. - Use the `orderBy` query parameter to set sort order. ### Usage scenarios - **Credential management:** View and audit the credentials used by API connectors in your Sigma organization. - **API connector creation:** Retrieve available credentials to present as options when creating an API connector.' parameters: - name: pageToken schema: type: string description: Use to specify the next set of results with the string returned in the `nextPageToken` field of the previous response. title: Page token in: query - name: pageSize schema: type: integer description: Number of results to return per page, with a maximum of 1000. Defaults to 50. title: Page size in: query - name: orderBy schema: type: string description: 'Sort order. Supported fields: `name`, `description`. Append ` desc` for descending (e.g. `name desc`). Defaults to `name` ascending.' title: Order by in: query - name: name schema: type: string description: Filter results to credentials whose name contains this substring. in: query operationId: listApiCredentials responses: '200': description: The response body. content: application/json: schema: allOf: - type: object required: - entries properties: entries: type: array items: allOf: - type: object required: - apiCredentialId - name - authMethod - allowlist properties: apiCredentialId: type: string description: Unique identifier of the API credential. name: type: string description: Display name of the credential. authMethod: type: string enum: - basic - bearer - apiKey - oAuthClientCredentials - oAuthAuthorizationCode - oAuthPasswordCredentials - awsSigV4 description: Authentication method the credential uses. allowlist: type: array items: type: string description: Hostname glob patterns the credential is authorized to be used against. - type: object properties: description: type: string description: Human-readable description. description: Array of results returned by the endpoint title: Result entries - type: object properties: nextPageToken: type: string description: 'A string that can be passed to the `pageToken` parameter in the next request to fetch the next page of results. Not present in the last page of results. **Must be treated as an opaque string.**' title: Next page token default: $ref: '#/components/responses/ApiError' externalDocs: url: '' description: 'Sigma API documentation:' tags: - api-credentials post: summary: Create an API credential description: 'This endpoint creates a new API credential for use with API connectors and the **Call API** action in Sigma. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma). ### Usage notes - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled. - The `allowlist` parameter is required and must contain at least one hostname glob pattern. Use `["*"]` to allow the credential to be used against any host. - The following authentication methods are supported: `basic`, `bearer`, `apiKey`, `oAuthClientCredentials`, `oAuthAuthorizationCode`, `oAuthPasswordCredentials`, `awsSigV4`. - Secret fields are encrypted at rest and are never returned in subsequent read responses. ### Usage scenarios - **Credential provisioning:** Automate credential creation as part of environment setup or onboarding. - **Multi-service authentication:** Create separate credentials for each external service, with allowlists scoped to only that service''s domains.' parameters: [] operationId: createApiCredential requestBody: description: The request body. content: application/json: schema: allOf: - type: object required: - name - allowlist - credential properties: name: type: string description: Display name of the credential. allowlist: type: array items: type: string description: Hostname glob patterns the credential may be used against (e.g. `["*.example.com"]`). Required and must not be empty; use `["*"]` to allow every host. credential: oneOf: - type: object required: - authMethod - basic properties: authMethod: type: string enum: - basic basic: type: object required: - username - password properties: username: type: string description: Username for Basic authentication. password: type: string description: Password for Basic authentication. Encrypted at rest; never returned in responses. description: '' title: Basic - type: object required: - authMethod - bearer properties: authMethod: type: string enum: - bearer bearer: type: object required: - token properties: token: type: string description: Bearer token. Encrypted at rest; never returned in responses. description: '' title: Bearer - type: object required: - authMethod - apiKey properties: authMethod: type: string enum: - apiKey apiKey: type: object required: - key - value - isQueryParam properties: key: type: string description: Header or query parameter name carrying the API key. value: type: string description: API key value. Encrypted at rest; never returned in responses. isQueryParam: type: boolean description: Whether the key is sent as a query parameter; if false, it is sent as a header. description: '' title: API key - type: object required: - authMethod - oAuthClientCredentials properties: authMethod: type: string enum: - oAuthClientCredentials oAuthClientCredentials: type: object required: - clientId - clientSecret - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. clientSecret: type: string description: OAuth client secret. Encrypted at rest; never returned in responses. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes requested at token exchange. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth client credentials - type: object required: - authMethod - awsSigV4 properties: authMethod: type: string enum: - awsSigV4 awsSigV4: allOf: - type: object required: - accessKeyId - secretAccessKey properties: accessKeyId: type: string description: AWS access key ID. secretAccessKey: type: string description: AWS secret access key. Encrypted at rest; never returned in responses. - type: object properties: region: type: string description: AWS region for SigV4 signing. service: type: string description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`). sessionToken: type: string description: AWS STS session token for temporary credentials. temporaryCredentialsUrl: type: string description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint). temporaryCredentialsResponseMapping: type: object properties: accessKeyField: type: string secretKeyField: type: string sessionTokenField: type: string expirationField: type: string temporaryCredentialsRequestParams: type: array items: type: object required: - key - value - sendIn properties: key: type: string value: type: string sendIn: type: string enum: - queryParam - body - header description: 'Additional key/value parameters attached to the temporary-credentials swap request. Each entry specifies whether it is sent as a request header, body field, or query parameter (`sendIn`: `header` | `body` | `queryParam`). Use this when the swap endpoint requires its own authentication (for example, an `x-api-key` header).' description: '' title: AWS SigV4 - type: object properties: description: type: string description: Human-readable description. responses: '200': description: The response body. content: application/json: schema: allOf: - type: object required: - apiCredentialId - name - authMethod - allowlist - credential properties: apiCredentialId: type: string description: Unique identifier of the API credential. name: type: string description: Display name of the credential. authMethod: type: string enum: - basic - bearer - apiKey - oAuthClientCredentials - oAuthAuthorizationCode - oAuthPasswordCredentials - awsSigV4 description: Authentication method the credential uses. allowlist: type: array items: type: string description: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against. credential: oneOf: - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - basic - type: object properties: basic: type: object required: - username properties: username: type: string description: Username for Basic authentication. description: '' title: Basic - type: object required: - authMethod properties: authMethod: type: string enum: - bearer description: '' title: Bearer - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - apiKey - type: object properties: apiKey: type: object required: - key - isQueryParam properties: key: type: string description: Header or query parameter name carrying the API key. isQueryParam: type: boolean description: Whether the key is sent as a query parameter; if false, it is sent as a header. description: '' title: API key - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthClientCredentials - type: object properties: oAuthClientCredentials: type: object required: - clientId - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes requested at token exchange. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth client credentials - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthAuthorizationCode - type: object properties: oAuthAuthorizationCode: type: object required: - clientId - authorizationUrl - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. authorizationUrl: type: string description: OAuth authorization endpoint URL. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth authorization code - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthPasswordCredentials - type: object properties: oAuthPasswordCredentials: allOf: - type: object required: - username - accessTokenUrl - scopes - accessTokenAuthMethod properties: username: type: string description: OAuth resource-owner username. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. - type: object properties: clientId: type: string description: OAuth client ID. description: '' title: OAuth password credentials - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - awsSigV4 - type: object properties: awsSigV4: allOf: - type: object required: - accessKeyId properties: accessKeyId: type: string description: AWS access key ID. - type: object properties: region: type: string description: AWS region for SigV4 signing. service: type: string description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`). temporaryCredentialsUrl: type: string description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint). temporaryCredentialsResponseMapping: type: object properties: accessKeyField: type: string secretKeyField: type: string sessionTokenField: type: string expirationField: type: string temporaryCredentialsRequestParams: type: array items: type: object required: - key - value - sendIn properties: key: type: string value: type: string sendIn: type: string enum: - queryParam - body - header description: Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`). description: '' title: AWS SigV4 description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned. - type: object required: - createdBy - updatedBy - createdAt - updatedAt properties: createdBy: type: string description: The identifier of the user who created this object. updatedBy: type: string description: The identifier of the user or process that last updated this object. createdAt: type: string format: date-time description: When the object was created. updatedAt: type: string format: date-time description: When the object was last updated. - type: object properties: description: type: string description: Human-readable description. default: $ref: '#/components/responses/ApiError' externalDocs: url: '' description: 'Sigma API documentation:' tags: - api-credentials /v2/api-credentials/{apiCredentialId}: get: summary: Get an API credential description: 'This endpoint returns nonsensitive details for a single API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma). ### Usage notes - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have at least **Can view** access on the credential. - Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint. - Secret fields (passwords, tokens, client secrets, secret access keys) are never returned. ### Usage scenarios - **Credential inspection:** Retrieve the configuration of a credential to verify its settings before using it with a connector.' parameters: - name: apiCredentialId schema: type: string in: path required: true operationId: getApiCredential responses: '200': description: The response body. content: application/json: schema: allOf: - type: object required: - apiCredentialId - name - authMethod - allowlist - credential properties: apiCredentialId: type: string description: Unique identifier of the API credential. name: type: string description: Display name of the credential. authMethod: type: string enum: - basic - bearer - apiKey - oAuthClientCredentials - oAuthAuthorizationCode - oAuthPasswordCredentials - awsSigV4 description: Authentication method the credential uses. allowlist: type: array items: type: string description: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against. credential: oneOf: - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - basic - type: object properties: basic: type: object required: - username properties: username: type: string description: Username for Basic authentication. description: '' title: Basic - type: object required: - authMethod properties: authMethod: type: string enum: - bearer description: '' title: Bearer - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - apiKey - type: object properties: apiKey: type: object required: - key - isQueryParam properties: key: type: string description: Header or query parameter name carrying the API key. isQueryParam: type: boolean description: Whether the key is sent as a query parameter; if false, it is sent as a header. description: '' title: API key - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthClientCredentials - type: object properties: oAuthClientCredentials: type: object required: - clientId - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes requested at token exchange. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth client credentials - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthAuthorizationCode - type: object properties: oAuthAuthorizationCode: type: object required: - clientId - authorizationUrl - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. authorizationUrl: type: string description: OAuth authorization endpoint URL. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth authorization code - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthPasswordCredentials - type: object properties: oAuthPasswordCredentials: allOf: - type: object required: - username - accessTokenUrl - scopes - accessTokenAuthMethod properties: username: type: string description: OAuth resource-owner username. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. - type: object properties: clientId: type: string description: OAuth client ID. description: '' title: OAuth password credentials - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - awsSigV4 - type: object properties: awsSigV4: allOf: - type: object required: - accessKeyId properties: accessKeyId: type: string description: AWS access key ID. - type: object properties: region: type: string description: AWS region for SigV4 signing. service: type: string description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`). temporaryCredentialsUrl: type: string description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint). temporaryCredentialsResponseMapping: type: object properties: accessKeyField: type: string secretKeyField: type: string sessionTokenField: type: string expirationField: type: string temporaryCredentialsRequestParams: type: array items: type: object required: - key - value - sendIn properties: key: type: string value: type: string sendIn: type: string enum: - queryParam - body - header description: Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`). description: '' title: AWS SigV4 description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned. - type: object required: - createdBy - updatedBy - createdAt - updatedAt properties: createdBy: type: string description: The identifier of the user who created this object. updatedBy: type: string description: The identifier of the user or process that last updated this object. createdAt: type: string format: date-time description: When the object was created. updatedAt: type: string format: date-time description: When the object was last updated. - type: object properties: description: type: string description: Human-readable description. default: $ref: '#/components/responses/ApiError' externalDocs: url: '' description: 'Sigma API documentation:' tags: - api-credentials patch: summary: Update an API credential description: 'This endpoint updates one or more fields on an existing API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma). ### Usage notes - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have **Can edit** access to the API credential. - Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint. - Omitted fields are left unchanged. - If a `credential` is provided, the provided authentication details (ID, secret, etc.) replace the previous values. To leave secrets unchanged, omit the `credential` parameter. ### Usage scenarios - **Secret rotation:** Update the secret fields for a credential automatically for an external service. - **Allowlist updates:** Expand or restrict the set of hostnames the credential can be used against.' parameters: - name: apiCredentialId schema: type: string in: path required: true operationId: updateApiCredential requestBody: description: The request body. content: application/json: schema: type: object properties: name: type: string description: New display name. description: type: - string - 'null' description: New description. Pass `null` to clear. allowlist: type: array items: type: string description: Replacement list of hostname glob patterns. Must not be empty; use `["*"]` to allow every host. credential: oneOf: - type: object required: - authMethod - basic properties: authMethod: type: string enum: - basic basic: type: object required: - username - password properties: username: type: string description: Username for Basic authentication. password: type: string description: Password for Basic authentication. Encrypted at rest; never returned in responses. description: '' title: Basic - type: object required: - authMethod - bearer properties: authMethod: type: string enum: - bearer bearer: type: object required: - token properties: token: type: string description: Bearer token. Encrypted at rest; never returned in responses. description: '' title: Bearer - type: object required: - authMethod - apiKey properties: authMethod: type: string enum: - apiKey apiKey: type: object required: - key - value - isQueryParam properties: key: type: string description: Header or query parameter name carrying the API key. value: type: string description: API key value. Encrypted at rest; never returned in responses. isQueryParam: type: boolean description: Whether the key is sent as a query parameter; if false, it is sent as a header. description: '' title: API key - type: object required: - authMethod - oAuthClientCredentials properties: authMethod: type: string enum: - oAuthClientCredentials oAuthClientCredentials: type: object required: - clientId - clientSecret - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. clientSecret: type: string description: OAuth client secret. Encrypted at rest; never returned in responses. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes requested at token exchange. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth client credentials - type: object required: - authMethod - awsSigV4 properties: authMethod: type: string enum: - awsSigV4 awsSigV4: allOf: - type: object required: - accessKeyId - secretAccessKey properties: accessKeyId: type: string description: AWS access key ID. secretAccessKey: type: string description: AWS secret access key. Encrypted at rest; never returned in responses. - type: object properties: region: type: string description: AWS region for SigV4 signing. service: type: string description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`). sessionToken: type: string description: AWS STS session token for temporary credentials. temporaryCredentialsUrl: type: string description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint). temporaryCredentialsResponseMapping: type: object properties: accessKeyField: type: string secretKeyField: type: string sessionTokenField: type: string expirationField: type: string temporaryCredentialsRequestParams: type: array items: type: object required: - key - value - sendIn properties: key: type: string value: type: string sendIn: type: string enum: - queryParam - body - header description: 'Additional key/value parameters attached to the temporary-credentials swap request. Each entry specifies whether it is sent as a request header, body field, or query parameter (`sendIn`: `header` | `body` | `queryParam`). Use this when the swap endpoint requires its own authentication (for example, an `x-api-key` header).' description: '' title: AWS SigV4 responses: '200': description: The response body. content: application/json: schema: allOf: - type: object required: - apiCredentialId - name - authMethod - allowlist - credential properties: apiCredentialId: type: string description: Unique identifier of the API credential. name: type: string description: Display name of the credential. authMethod: type: string enum: - basic - bearer - apiKey - oAuthClientCredentials - oAuthAuthorizationCode - oAuthPasswordCredentials - awsSigV4 description: Authentication method the credential uses. allowlist: type: array items: type: string description: Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against. credential: oneOf: - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - basic - type: object properties: basic: type: object required: - username properties: username: type: string description: Username for Basic authentication. description: '' title: Basic - type: object required: - authMethod properties: authMethod: type: string enum: - bearer description: '' title: Bearer - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - apiKey - type: object properties: apiKey: type: object required: - key - isQueryParam properties: key: type: string description: Header or query parameter name carrying the API key. isQueryParam: type: boolean description: Whether the key is sent as a query parameter; if false, it is sent as a header. description: '' title: API key - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthClientCredentials - type: object properties: oAuthClientCredentials: type: object required: - clientId - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes requested at token exchange. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth client credentials - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthAuthorizationCode - type: object properties: oAuthAuthorizationCode: type: object required: - clientId - authorizationUrl - accessTokenUrl - scopes - accessTokenAuthMethod properties: clientId: type: string description: OAuth client ID. authorizationUrl: type: string description: OAuth authorization endpoint URL. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. description: '' title: OAuth authorization code - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - oAuthPasswordCredentials - type: object properties: oAuthPasswordCredentials: allOf: - type: object required: - username - accessTokenUrl - scopes - accessTokenAuthMethod properties: username: type: string description: OAuth resource-owner username. accessTokenUrl: type: string description: OAuth token endpoint URL. scopes: type: array items: type: string description: OAuth scopes. accessTokenAuthMethod: type: string enum: - httpBasic - requestBody description: How client credentials are presented to the token endpoint. - type: object properties: clientId: type: string description: OAuth client ID. description: '' title: OAuth password credentials - allOf: - type: object required: - authMethod properties: authMethod: type: string enum: - awsSigV4 - type: object properties: awsSigV4: allOf: - type: object required: - accessKeyId properties: accessKeyId: type: string description: AWS access key ID. - type: object properties: region: type: string description: AWS region for SigV4 signing. service: type: string description: AWS service name for SigV4 signing (e.g. `s3`, `execute-api`). temporaryCredentialsUrl: type: string description: URL that vends temporary credentials (e.g. STS AssumeRole endpoint). temporaryCredentialsResponseMapping: type: object properties: accessKeyField: type: string secretKeyField: type: string sessionTokenField: type: string expirationField: type: string temporaryCredentialsRequestParams: type: array items: type: object required: - key - value - sendIn properties: key: type: string value: type: string sendIn: type: string enum: - queryParam - body - header description: Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`). description: '' title: AWS SigV4 description: Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned. - type: object required: - createdBy - updatedBy - createdAt - updatedAt properties: createdBy: type: string description: The identifier of the user who created this object. updatedBy: type: string description: The identifier of the user or process that last updated this object. createdAt: type: string format: date-time description: When the object was created. updatedAt: type: string format: date-time description: When the object was last updated. - type: object properties: description: type: string description: Human-readable description. default: $ref: '#/components/responses/ApiError' externalDocs: url: '' description: 'Sigma API documentation:' tags: - api-credentials delete: summary: Delete an API credential description: 'This endpoint archives an API credential so it can no longer be associated with new API connectors. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma). ### Usage notes - The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have **Can edit** access to the API credential. - Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint. - Archiving a credential does not automatically unbind any API connectors that reference it. ### Usage scenarios - **Credential decommissioning:** Remove credentials for decommissioned services or expired tokens. - **Security cleanup:** Archive compromised or rotated credentials to prevent accidental reuse.' parameters: - name: apiCredentialId schema: type: string in: path required: true operationId: deleteApiCredential responses: '200': description: The response body. content: application/json: schema: type: object properties: {} default: $ref: '#/components/responses/ApiError' externalDocs: url: '' description: 'Sigma API documentation:' tags: - api-credentials components: responses: ApiError: description: Sigma API Error content: application/json: schema: type: object properties: message: type: string code: type: string requestId: type: string securitySchemes: basicAuth: type: http scheme: basic bearerAuth: type: http scheme: bearer oauth2: type: oauth2 flows: clientCredentials: tokenUrl: /v2/auth/token refreshUrl: /v2/auth/token scopes: {}