Aidp Credentials

aidp-credentials — credential store (Preview)

Manage centrally-stored AIDP credentials/secrets.

CLI (preferred): aidp credentials <command> --instance-id <DATALAKE_OCID> --auth api_key --profile DEFAULT --region <r>

• aidp credentials list | get | create | update | delete

Fallback (no CLI): same credentialStore REST API via oci raw-request (identical endpoint + auth; see references/oci-raw-request.md).

Preview + verify-first (no-fabrication): credentialStore is Preview and the route exists, but its GET/response shape is TBD. Confirm the working path (default 20240831/dataLakes) with a live aidp credentials list (or GET …/credentials) before asserting success or doing writes; record it in references/rest-endpoint-map.md. Treat the path as UNVERIFIED until a live 2xx returns.

When to use

• "Store/rotate a secret in AIDP", "manage connection credentials", "stop embedding this secret in code".

Workflow

1. Verify first: aidp credentials list (CLI) — or a GET …/credentials (REST fallback) — returns 2xx; record the version/prefix.
2. Read/create/update as asked. Never print secret values; pass secret material in the request body only, never echo it back. Confirm before delete/rotate.
3. Handle async 202 + etag/if-match per the shared conventions.

Mutating ops (create, update/rotate, delete): persist the body to .aidp/payloads/ and confirm first (references/payloads.md).

Create body — CreateDataLakeCredentialDetails

CLI: aidp credentials create <DATALAKE_OCID> --body <JSON> (CLI README "credentials create"). Top-level envelope (SDK create_data_lake_credential_details.py:51-63):

credentialDetails shape per type (subclass models + CLI README "credentials create"):

Example (SECRET_TOKEN) — persist to .aidp/payloads/create-<name>-credential.json and confirm first; the secretValue is the only secret material — pass it in the body, never echo it back:

{  "displayName": "github_pat",  "credentialDescription": "GitHub PAT for workspace git",  "type": "SECRET_TOKEN",  "credentialDetails": {    "credentialType": "SECRET_TOKEN",    "secretTokenPair": [ { "secretKey": "token", "secretValue": "<PAT>" } ]  }}

Field names are confirmed (SDK attribute_map + CLI README). The full create round-trip is verify-first: …/credentials GET returned 400 here (Preview, list-shape TBD — references/rest-endpoint-map.md), so confirm a 2xx before relying on the POST.

Fallback (no CLI) — REST endpoints (lake-scoped, Preview)

Live-probed 2026-06-10: GET …/dataLakes/<ocid>/credentials → 400 (route exists, list-shape TBD — needs a param/body); …/workspaces/<ws>/credentials → 404 (so credentials are lake-scoped, not workspace-scoped).

• GET /dataLakes/<ocid>/credentials — list (400 until the required param/shape is supplied — verify live)
• POST /dataLakes/<ocid>/credentials — create
• GET|PUT|DELETE /dataLakes/<ocid>/credentials/{key} — get / update / delete

Base URL: https://aidp.<region>.oci.oraclecloud.com/20240831/dataLakes/<dataLakeOcid>/…

Guardrails

• Secrets never go into logs, the transcript, or committed files.
• Destructive ops (delete/rotate) require explicit confirmation.

References

• references/aidp-cli-map.md · references/payloads.md · references/oci-raw-request.md · references/rest-endpoint-map.md