> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vend credentials for a bucket

> Resolve the endpoint and credentials for a bucket.

A registered bucket returns its own endpoint and credentials; an unregistered bucket
transparently falls back to the tenant default. Intended for infrastructure consumers
(the S3A credential provider, Gravitino) authenticating with the platform PSK.



## OpenAPI

````yaml get /api/s3/credentials/{bucket_name}
openapi: 3.1.0
info:
  title: Nx1 AI API
  description: |

    AI API for Nx1 Data Platform Management and Automated Data Tasks.

    Authentication is required via PSK in Authorization header.

    Default PSK is | [ask a friend] |
  version: 0.10.2
servers: []
security: []
paths:
  /api/s3/credentials/{bucket_name}:
    get:
      tags:
        - S3
      summary: Vend credentials for a bucket
      description: >-
        Resolve the endpoint and credentials for a bucket.


        A registered bucket returns its own endpoint and credentials; an
        unregistered bucket

        transparently falls back to the tenant default. Intended for
        infrastructure consumers

        (the S3A credential provider, Gravitino) authenticating with the
        platform PSK.
      operationId: get_bucket_credentials_api_s3_credentials__bucket_name__get
      parameters:
        - name: bucket_name
          in: path
          required: true
          schema:
            type: string
            description: >-
              The bucket to vend credentials for; unregistered buckets fall back
              to the tenant default.
            title: Bucket Name
          description: >-
            The bucket to vend credentials for; unregistered buckets fall back
            to the tenant default.
      responses:
        '200':
          description: Resolved endpoint and credentials for the bucket.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3CredentialVendResponse'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Not Found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - OAuth2AuthorizationCodeBearer: []
        - APIKeyHeader: []
components:
  schemas:
    S3CredentialVendResponse:
      properties:
        bucket:
          type: string
          title: Bucket
          description: The bucket the credentials apply to.
        endpoint:
          type: string
          title: Endpoint
          description: S3 endpoint URL for this bucket.
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
          description: S3 region, if configured.
        path_style:
          type: boolean
          title: Path Style
          description: Whether path-style access is required for this endpoint.
        access_key:
          type: string
          title: Access Key
          description: S3 access key.
        secret_key:
          type: string
          title: Secret Key
          description: S3 secret key.
        session_token:
          anyOf:
            - type: string
            - type: 'null'
          title: Session Token
          description: S3 session token for temporary credentials; null for static keys.
        source:
          type: string
          title: Source
          description: >-
            Where the credentials were resolved from: 'bucket' (override) or
            'default'.
      type: object
      required:
        - bucket
        - endpoint
        - path_style
        - access_key
        - secret_key
        - source
      title: S3CredentialVendResponse
      description: >-
        Resolved S3 connection details for one bucket, for runtime credential
        vending.


        A registered bucket returns its own endpoint + credentials
        (``source="bucket"``); an

        unregistered bucket falls back to the tenant default
        (``source="default"``). Region and

        path-style are tenant-wide and come from the service S3 configuration in
        both cases.


        Distinct from ``S3CredentialResponse`` (the per-user access-key CRUD
        model) — this is the

        infra-facing endpoint+creds vend for the S3A credential provider /
        Gravitino.
    ErrorResponse:
      properties:
        error:
          type: string
          title: Error
          description: A brief description of the error that occurred.
        code:
          type: integer
          title: Code
          description: The HTTP status code associated with the error.
          default: 500
      type: object
      required:
        - error
      title: ErrorResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    OAuth2AuthorizationCodeBearer:
      type: oauth2
      flows:
        authorizationCode:
          scopes: {}
          authorizationUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth
          tokenUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token
    APIKeyHeader:
      type: apiKey
      in: header
      name: Authorization-PSK

````