---
title: "Get a managed credential by ID"
method: GET
path: "/organizations/{id}/credentials/{cred_id}"
tags: ["Managed Credentials"]
---

# Get a managed credential by ID

`GET /organizations/{id}/credentials/{cred_id}`

Returns the credential record with state-machine fields. Frontend polls this during Azure federated onboarding to drive the multi-step UI.

## Path parameters

- `id` string, required
- `cred_id` string, required

## Response `200`

OK

- GithubComActiveloopaiDeeplakeApiInternalCredentialsCredentialDetail
  - `azure` GithubComActiveloopaiDeeplakeApiInternalCredentialsCredentialDetailAzure
    - `app_id` string
    - `container_name` string
    - `install_command` string
    - `resource_group` string
    - `sp_object_id` string — SPObjectID is the customer-tenant service-principal's object ID, captured by the SP-poll worker once the customer has run `az ad sp create --id <APP_ID>`. Populated from sp_verified onwards; nil while in draft / sp_pending. Surfaced so the wizard can render the role-assignment step inline — the role grant needs the SP object ID + storage scope, and we don't want the customer to copy it manually out of `az ad sp create` output.
    - `storage_account` string
    - `subscription_id` string
    - `tenant_id` string
  - `base_path` string
  - `created_at` string
  - `created_by` string
  - `id` string
  - `last_error_action` string
  - `last_error_provider_error` string — LastErrorProviderError is the raw cloud-provider error text (e.g., the Azure ErrorCode). Useful for support/debugging when the user-friendly message is too generic — e.g., a 404 surfaces here as "ContainerNotFound" vs "AccountNotFound", which disambiguates two scenarios that look identical in the friendly fields.
  - `last_error_reason` string
  - `last_error_user_message` string
  - `name` string
  - `org_id` string
  - `poll_deadline_at` string
  - `state` 'draft' | 'sp_pending' | 'sp_verified' | 'access_pending' | 'unverified_saved' | 'verified'
  - `state_updated_at` string
  - `storage_type` 's3' | 's3:role' | 'gcs' | 'gcs_federated' | 'azure' | 'azure_federated'
  - `updated_at` string

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/deeplake/apis/deeplake-api.md) · [All operations](https://skmtc.net/deeplake/apis/deeplake-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deeplake/deeplake-api/revisions/e16ed11d991c/schema)