---
title: "Describe credentials"
method: GET
path: "/credentials/{credentialsId}"
tags: ["credentials"]
---

# Describe credentials

`GET /credentials/{credentialsId}`

Retrieves the details of the credentials identified by the given `credentialsId`.

## Path parameters

- `credentialsId` string, required

## Query parameters

- `workspaceId` integer

## Response `200`

OK

- DescribeCredentialsResponse
  - `credentials` Credentials
    - `baseUrl` string
    - `category` string
    - `dateCreated` string, date-time
    - `deleted` boolean
    - `description` string
    - `id` string
    - `keys` union
      - object
        - `discriminator` string
        - `accessKey` string
        - `assumeRoleArn` string
        - `externalId` string
        - `mode` 'keys' | 'role'
        - `secretKey` string
      - object
        - `discriminator` string
        - `data` string
        - `serviceAccountEmail` string
        - `tokenAudience` string
        - `workloadIdentityProvider` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `appId` string
        - `clientId` string
        - `clientSecret` string
        - `privateKey` string
        - `slug` string
        - `webhookSecret` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `passphrase` string
        - `privateKey` string
      - object
        - `discriminator` string
        - `certificate` string
        - `privateKey` string
        - `token` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `storageKey` string
        - `storageName` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `clientId` string
        - `clientSecret` string
        - `storageKey` string
        - `storageName` string
        - `subscriptionId` string
        - `tenantId` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `password` string
        - `registry` string
        - `userName` string
      - object
        - `discriminator` string
        - `connectionId` string
        - `shared` boolean
        - `workDir` string
      - object
        - `discriminator` string
        - `password` string
        - `token` string
        - `username` string
      - object
        - `discriminator` string
        - `batchKey` string
        - `batchName` string
        - `clientId` string
        - `clientSecret` string
        - `storageKey` string
        - `storageName` string
        - `tenantId` string
      - object
        - `discriminator` string
        - `accessKey` string
        - `assumeRoleArn` string
        - `externalId` string
        - `mode` 'keys' | 'role'
        - `secretKey` string
      - object
        - `discriminator` string
        - `accessKey` string
        - `pathStyleAccessEnabled` boolean
        - `secretKey` string
      - object
        - `discriminator` string
        - `password` string
    - `lastUpdated` string, date-time
    - `lastUsed` string, date-time
    - `lastValidated` string, date-time — Timestamp of the most recent completed validation probe (success or authoritative fail). Null until first probe. NOT advanced on transient probe outcomes.
    - `message` string — Provider-supplied error detail captured when status transitions to INVALID. Cleared (null) whenever status returns to AVAILABLE. Truncated to 4096 characters with a trailing " (truncated)" suffix when the underlying provider message exceeds that limit.
    - `name` string, required
    - `provider` 'aws' | 'azure' | 'azure_entra' | 'google' | 'github' | 'github_app' | 'gitlab' | 'bitbucket' | 'ssh' | 'k8s' | 'container-reg' | 'tw-agent' | 'codecommit' | 'gitea' | 'azurerepos' | 'seqeracompute' | 'azure-cloud' | 's3', required
    - `status` 'AVAILABLE' | 'INVALID'
  - `setupSnippet` string, nullable — Server-rendered, read-only provider-side setup snippet (e.g. AWS IAM role trust policy) to paste at the cloud provider. Populated when a renderer is available for the credential type and the installation is configured for it; otherwise omitted.

## Other responses

- `400` — Bad request
- `403` — Operation not allowed

---

[API](https://skmtc.net/seqeralabs/apis/seqera-api.md) · [All operations](https://skmtc.net/seqeralabs/apis/seqera-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/seqeralabs/seqera-api/versions/13316c9fe5ff/schema)