Create a model import credential
Saves a credential your model imports read a private source with: a Hugging Face token, an S3 role or key pair, or a Google Cloud credential. A Google Cloud credential is a workload identity pool provider or a service account key. A secret is sealed with a key only the organization's import sessions can use, and is never returned. An s3_role answers with the external id issued for it and the role its trust policy must admit; a gcs_federation with the subject its pool must admit. A field the type does not take, or a malformed secret, answers 400. An organization holds at most 50, and a role or pool provider another organization registered answers 409 CREDENTIAL_CLAIMED.
Required permission
Requires the importcredential.write permission. See Permissions for the roles and API key permissions that include it.
Command line
The orl CLI wraps this endpoint:
orl imports credential create --name <name> --type <type>apiKeyAuthorizationBearer <token>OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).
application/json- body
A credential a model import reads its source with.
type*ImportCredentialTypehf_token: a Hugging Face access token, for private and gated hf:// models. s3_role: a role in the customer's account that imports assume, with the external id issued for the org, to read s3:// objects. s3_keys: an access key pair of the customer's that reads s3:// objects. gcs_federation: a workload identity pool provider in the customer's Google Cloud project that admits the org's import sessions, to read gs:// objects. gcs_key: a service account key of the customer's that reads gs:// objects.
"hf_token""s3_role""s3_keys""gcs_federation""gcs_key"name*stringWhat the credential is, for the people who pick it; at most 100 characters.
secret?stringThe secret, never returned: an hf_token's Hugging Face access token (hf_...), an s3_keys pair's secret access key, or a gcs_key's service account key, the JSON Google Cloud issued. Not set for s3_role or gcs_federation.
accessKeyId?stringAn s3_keys pair's access key id (AKIA...).
roleArn?stringAn s3_role credential's role, in the customer's account (arn:aws:iam:::role/).
audience?stringA gcs_federation credential's workload identity pool provider, in the customer's project (//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/).
serviceAccount?stringThe service account a gcs_federation credential acts as (@.iam.gserviceaccount.com), which must let the pool's principal for the org impersonate it. Unset to read as that principal.
Created
application/json- response
id*stringorgId*stringtype*ImportCredentialTypehf_token: a Hugging Face access token, for private and gated hf:// models. s3_role: a role in the customer's account that imports assume, with the external id issued for the org, to read s3:// objects. s3_keys: an access key pair of the customer's that reads s3:// objects. gcs_federation: a workload identity pool provider in the customer's Google Cloud project that admits the org's import sessions, to read gs:// objects. gcs_key: a service account key of the customer's that reads gs:// objects.
"hf_token""s3_role""s3_keys""gcs_federation""gcs_key"name*stringhint*stringEnough of the credential to tell two apart: a secret's first and last characters, an s3_role's role name, a gcs_federation's provider or a gcs_key's service account.
s3Role?What the customer's role must trust: imports assume roleArn as trustPrincipal, with externalId as the sts:ExternalId, which its trust policy must require.
gcsFederation?What the customer's pool must admit: an AWS provider for awsAccount whose attribute condition admits subject (assertion.arn) and no other session of that account, and the reader role on the bucket granted to that subject's principal, or to serviceAccount with the principal allowed to impersonate it.
createdAt*stringdate-timecurl -X POST 'https://api.openrelay.inc/v1/inference/credentials' \ -H 'Content-Type: application/json' \ -d '{ "type": "hf_token", "name": "string"}'{ "id": "string", "orgId": "string", "type": "hf_token", "name": "string", "hint": "string", "s3Role": { "roleArn": "string", "externalId": "string", "trustPrincipal": "string" }, "gcsFederation": { "audience": "string", "serviceAccount": "string", "awsAccount": "string", "subject": "string", "attributeCondition": "string" }, "createdAt": "2019-08-24T14:15:22Z"}List an organization's model import credentials GET
The credentials the organization's model imports read their sources with: name, type and a hint to tell two apart, never a secret. An s3_role also shows what the customer's role must trust, and a gcs_federation what the customer's pool must admit.
Delete a model import credential DELETE
Removes a model import credential and its sealed secret. A credential that a running import reads its source with cannot be deleted yet. It answers 204. One a running import reads answers 409 CREDENTIAL_IN_USE; delete it once that import has finished.