Skip to main content

CreateCredential

Register a key for one remote origin.

Requires objects.create permission. No input or output blobs are used.

Parameters​

  • origin (string, required): an S3 bucket, Google Cloud Storage bucket, or HTTPS origin.

  • key (object, required): the provider fields described in key.

Behavior​

Origins contain only scheme and host or bucket; paths, trailing slashes, queries, and fragments are rejected. HTTPS hosts are lowercased and default port 443 is omitted. An existing origin is an error; use UpdateCredential to rotate it.

Registration checks the required fields without contacting the provider. This command may be combined with other commands and commits or rolls back with them. To read media with the new credential, wait for registration to succeed and submit the media query separately. See Remote credentials.

Response​

Success returns status: 0. Failures return a negative status and an info message; see Responses for error envelopes and retry guidance.

Examples​

[{
    "CreateCredential": {
        "origin": "s3://training-images",
        "key": {
            "access_key": "<aws-access-key-id>",
            "secret_access_key": "<aws-secret-access-key>",
            "region": "us-west-2"
        }
    }
}]

Response:

[{
    "CreateCredential": {
        "status": 0
    }
}]