Create Storage Credential

Media API · Storage

POST https://app.mk.io/api/v1/projects/{project_name}/media/storage/{storage_name}/credentials

Creates a Storage Credential. You can add as many Storage Credentials as you like to a Storage instance. We will choose the Storage Credential with the longest expiry time when we need to access the Storage instance. Credentials are immutable once created - but you can create a new Storage Credential record, then delete the old one.

RBAC Capability Required: infra.storagetoken.create

Authentication

• Authorization header — Bearer authentication of the form Bearer <token>.

Path parameters

Request body

Content type: application/json

• spec · object · Required — The specification of the credential.
  • One of the following variants, selected by type:
    • Microsoft.Storage (object)
      • credential · object · Required — The credential for the Azure Storage Account
        • sasToken · string · Required · pattern: ^\?([a-z]+=[^&]+)(&[a-z]+=[^&]+)+$ — SAS Token for Azure Storage Account, including leading ?
      • type · enum or null · Required — The type of the credential.
        • Allowed values: Microsoft.Storage, AWS.S3, Google.Storage
    • AWS.S3 (object)
      • credential · object · Required — The credential for the AWS S3 bucket.
        • accessKeyId · string · Required · pattern: ^A[KS]IA[0-9A-Z]{16}$ — The access key ID for the bucket.
        • secretAccessKey · string · Required · pattern: ^[A-Za-z0-9+/=]{40}$ — The secret access key for the bucket.
      • type · enum or null · Required — The type of the credential.
        • Allowed values: Microsoft.Storage, AWS.S3, Google.Storage
    • Google.Storage (object)
      • credential · object · Required — The credential for the Google Storage bucket.
        • gac · map from strings to string · Required — Google Application Credentials in JSON format. You can generate this from the command line with gcloud iam service-accounts keys create key.json --iam-account=<service_account>@<project>.iam.gserviceaccount.com Or download it from the GCP console.
          • [any key] · string — map of additional properties
      • type · enum or null · Required — The type of the credential.
        • Allowed values: Microsoft.Storage, AWS.S3, Google.Storage

Example request

curl -X POST "https://app.mk.io/api/v1/projects/{project_name}/media/storage/{storage_name}/credentials" \ 
  -H "Authorization: Bearer <token>" \ 
  -H "Content-Type: application/json" \ 
  -d '{
  "spec": {
    "credential": {
      "accessKeyId": "AKIAEXAMPLE123456789",
      "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    },
    "type": "AWS.S3"
  }
}'

Responses

201 — Create a Storage instance Credential.

• metadata · object · Required — Metadata about the credential.
  • created · string · Optional · format: date-time — The time when the resource was created
  • createdBy · string · Optional · format: uuid — ID of the user who created the resource
  • createdByEmail · string · Optional — Email of the user who created the resource
  • id · string · Required · format: uuid — The ID of the resource
  • updated · string · Optional · format: date-time — The time when the resource was last updated
  • updatedBy · string · Optional · format: uuid — ID of the user who last updated the resource
  • updatedByEmail · string · Optional — Email of the user who last updated the resource
• spec · object · Required — The specification of the credential.
  • One of the following variants, selected by type:
    • Microsoft.Storage (object)
      • credential · object · Required — The credential for the Azure Storage Account
        • sasToken · string · Required · pattern: ^\?([a-z]+=[^&]+)(&[a-z]+=[^&]+)+$ — SAS Token for Azure Storage Account, including leading ?
        • signedExpiry · string · Required · format: date-time — The expiry time of the token.
        • signedStart · string or null · Required · format: date-time — The start time of the token.
      • type · enum or null · Required — The type of the credential.
        • Allowed values: Microsoft.Storage, AWS.S3, Google.Storage
    • AWS.S3 (object)
      • credential · object · Required — The credential for the AWS S3 bucket.
        • accessKeyId · string · Required · pattern: ^A[KS]IA[0-9A-Z]{16}$ — The access key ID for the bucket.
        • secretAccessKey · string · Required · pattern: ^[A-Za-z0-9+/=]{40}$ — The secret access key for the bucket.
      • type · enum or null · Required — The type of the credential.
        • Allowed values: Microsoft.Storage, AWS.S3, Google.Storage
    • Google.Storage (object)
      • credential · object · Required — The credential for the Google Storage bucket.
        • gac · map from strings to string · Required — Google Application Credentials in JSON format. You can generate this from the command line with gcloud iam service-accounts keys create key.json --iam-account=<service_account>@<project>.iam.gserviceaccount.com Or download it from the GCP console.
          • [any key] · string — map of additional properties
      • type · enum or null · Required — The type of the credential.
        • Allowed values: Microsoft.Storage, AWS.S3, Google.Storage

400 — Bad Request

• error · object · Required — Pertinent information about the error
  • code · string · Required — The error code.
  • detail · string · Required — The error message.
  • extraDetail · map from strings to any · Optional — Extra information regarding this error.
    • [any key] · any — map of additional properties
• ref · string · Required — A reference to the request that caused the error.
• status · integer · Required — The HTTP status code

401 — Unauthorized

403 — Forbidden

404 — Not Found

429 — Too Many Requests

500 — Internal Server Error

Source spec: media-api · operationId: [post]_/api/v1/projects/{project_name}/media/storage/{storage_name}/credentials