# Create Storage Credential

> Media API · Storage

```http
POST https://app.mk.io/api/v1/projects/{project_name}/media/storage/{storage_name}/credentials
```

Creates a Storage Credential. You can add as many Storage Credentials as you like to a Storage instance. 
We will choose the Storage Credential with the longest expiry time when we need to access the Storage instance.
Credentials are immutable once created - but you can create a new Storage Credential record, then delete the old one.

RBAC Capability Required: `infra.storagetoken.create`

## Authentication

- `Authorization` header — Bearer authentication of the form `Bearer <token>`.

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `project_name` | string | Yes | — |
| `storage_name` | string | Yes | — |

## Request body

Content type: `application/json`

- `spec` · object · **Required** — The specification of the credential.
  - One of the following variants, selected by `type`:
    - **Microsoft.Storage** (object)
      - `credential` · object · **Required** — The credential for the Azure Storage Account
        - `sasToken` · string · **Required** · _pattern: ^\?([a-z]+=[^&]+)(&[a-z]+=[^&]+)+$_ — SAS Token for Azure Storage Account, including leading ?
      - `type` · enum or null · **Required** — The type of the credential.
        - Allowed values: `Microsoft.Storage`, `AWS.S3`, `Google.Storage`
    - **AWS.S3** (object)
      - `credential` · object · **Required** — The credential for the AWS S3 bucket.
        - `accessKeyId` · string · **Required** · _pattern: ^A[KS]IA[0-9A-Z]{16}$_ — The access key ID for the bucket.
        - `secretAccessKey` · string · **Required** · _pattern: ^[A-Za-z0-9+/=]{40}$_ — The secret access key for the bucket.
      - `type` · enum or null · **Required** — The type of the credential.
        - Allowed values: `Microsoft.Storage`, `AWS.S3`, `Google.Storage`
    - **Google.Storage** (object)
      - `credential` · object · **Required** — The credential for the Google Storage bucket.
        - `gac` · map from strings to string · **Required** — Google Application Credentials in JSON format. You can generate this from the command line with `gcloud iam service-accounts keys create key.json --iam-account=<service_account>@<project>.iam.gserviceaccount.com` Or download it from the GCP console.
          - `[any key]` · string — map of additional properties
      - `type` · enum or null · **Required** — The type of the credential.
        - Allowed values: `Microsoft.Storage`, `AWS.S3`, `Google.Storage`

## Example request

```bash
curl -X POST "https://app.mk.io/api/v1/projects/{project_name}/media/storage/{storage_name}/credentials" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
  "spec": {
    "credential": {
      "accessKeyId": "AKIAEXAMPLE123456789",
      "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    },
    "type": "AWS.S3"
  }
}'
```

## Responses

### 201 — Create a Storage instance Credential.

- `metadata` · object · **Required** — Metadata about the credential.
  - `created` · string · Optional · _format: date-time_ — The time when the resource was created
  - `createdBy` · string · Optional · _format: uuid_ — ID of the user who created the resource
  - `createdByEmail` · string · Optional — Email of the user who created the resource
  - `id` · string · **Required** · _format: uuid_ — The ID of the resource
  - `updated` · string · Optional · _format: date-time_ — The time when the resource was last updated
  - `updatedBy` · string · Optional · _format: uuid_ — ID of the user who last updated the resource
  - `updatedByEmail` · string · Optional — Email of the user who last updated the resource
- `spec` · object · **Required** — The specification of the credential.
  - One of the following variants, selected by `type`:
    - **Microsoft.Storage** (object)
      - `credential` · object · **Required** — The credential for the Azure Storage Account
        - `sasToken` · string · **Required** · _pattern: ^\?([a-z]+=[^&]+)(&[a-z]+=[^&]+)+$_ — SAS Token for Azure Storage Account, including leading ?
        - `signedExpiry` · string · **Required** · _format: date-time_ — The expiry time of the token.
        - `signedStart` · string or null · **Required** · _format: date-time_ — The start time of the token.
      - `type` · enum or null · **Required** — The type of the credential.
        - Allowed values: `Microsoft.Storage`, `AWS.S3`, `Google.Storage`
    - **AWS.S3** (object)
      - `credential` · object · **Required** — The credential for the AWS S3 bucket.
        - `accessKeyId` · string · **Required** · _pattern: ^A[KS]IA[0-9A-Z]{16}$_ — The access key ID for the bucket.
        - `secretAccessKey` · string · **Required** · _pattern: ^[A-Za-z0-9+/=]{40}$_ — The secret access key for the bucket.
      - `type` · enum or null · **Required** — The type of the credential.
        - Allowed values: `Microsoft.Storage`, `AWS.S3`, `Google.Storage`
    - **Google.Storage** (object)
      - `credential` · object · **Required** — The credential for the Google Storage bucket.
        - `gac` · map from strings to string · **Required** — Google Application Credentials in JSON format. You can generate this from the command line with `gcloud iam service-accounts keys create key.json --iam-account=<service_account>@<project>.iam.gserviceaccount.com` Or download it from the GCP console.
          - `[any key]` · string — map of additional properties
      - `type` · enum or null · **Required** — The type of the credential.
        - Allowed values: `Microsoft.Storage`, `AWS.S3`, `Google.Storage`

Example:

```json
{
  "metadata": {
    "created": "2024-01-01T00:00:00Z",
    "createdBy": "00000000-0000-0000-0000-000000000000",
    "createdByEmail": "string",
    "id": "00000000-0000-0000-0000-000000000000",
    "updated": "2024-01-01T00:00:00Z",
    "updatedBy": "00000000-0000-0000-0000-000000000000",
    "updatedByEmail": "string"
  },
  "spec": {
    "type": "Microsoft.Storage",
    "credential": {
      "sasToken": "?sv=2022-11-02&ss=bfqt&srt=co&sp=rwdlacupiyx&se=2024-11-12T00:05:04Z&st=2024-11-11T16:05:04Z&spr=https&sig=<redacted>",
      "signedExpiry": "2024-11-12T00:05:04Z",
      "signedStart": "2024-11-11T16:05:04Z"
    }
  }
}
```

### 400 — Bad Request

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 401 — Unauthorized

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 403 — Forbidden

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 404 — Not Found

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 429 — Too Many Requests

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 500 — Internal Server Error

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

---

Source spec: `media-api` · operationId: `[post]_/api/v1/projects/{project_name}/media/storage/{storage_name}/credentials`