> This page is for Self-Hosted, version v3.0 (default). > For other versions, use one of these documentation indexes: > - v3.0 (default): https://docs.nvidia.com/run-ai/self-hosted/v3.0/llms.txt > - v2.26: https://docs.nvidia.com/run-ai/self-hosted/v2.26/llms.txt > - v2.25: https://docs.nvidia.com/run-ai/self-hosted/v2.25/llms.txt > - v2.24: https://docs.nvidia.com/run-ai/self-hosted/v2.24/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server. # List credentials. GET http://localhost:8080/api/v1/asset/credentials Use to retrieve a list of all existing credentials. Reference: https://docs.nvidia.com/run-ai/self-hosted/reference/rest-api/endpoints/workload-assets/credentials/list-credentials-assets ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication ## Request ### Query parameters - `name` (string, optional) — Filter results by name. - `scope` (string, optional) — Filters results by scope. Returns only assets that belong to the specified scope. Mutually exclusive with includeDescendants. Valid values: tenant, cluster, department, project. - `projectId` (integer, optional) — Filter results by project id. If scope filter is project, only assets from the specific project will be included in the response. Otherwise, the response will include project, department, cluster, tenant and system assets. - `departmentId` (string, optional) — Filter results by department id. If scope filter is department, only assets from the specific department will be included in the response. Otherwise, the response will include department, cluster, tenant and system assets. - `clusterId` (string, optional) — Filter results by Universally Unique Identifier (UUID) of the cluster. If scope filter is cluster, only assets from the specific cluster will be included in the response. Otherwise, the response will include cluster, tenant and system assets. - `usageInfo` (boolean, optional) — Whether the query should include asset usage information as part of the response. - `statusInfo` (boolean, optional) — Whether the query should include asset status information as part of the response. - `includeDescendants` (boolean, optional) — Indicates whether to include assets from all descendant scopes under the specified scope. When set to true, and a specific scope identifier (for example, clusterId) is provided, the query also returns assets from all nested scopes within it (for example, departments and projects). Mutually exclusive with scope. ## Response ### 200 Request completed successfully. - `entries` (list of CredentialsListResponseEntry, required) ## Errors ### 401 Unauthorized Error Unauthorized - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 403 Forbidden Error Forbidden - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ### 503 Service Unavailable Error unexpected error - `code` (integer, required) - `message` (string, required) - `details` (string, optional) ## Types ### CredentialsListResponseEntry - `meta` (AssetMeta, required) - `spec` (CredentialsListResponseAssetSpec, required) - `usedBy` (AssetUsageInfo, optional) — Details about resources that use the asset. - `status` (AssetClusterStatusInfo, optional) - `clusterInfo` (ClusterInfo, optional) — Cluster related information of the asset. ### AssetMeta - `name` (string, required) — The name of the asset. - `scope` (enum, required) — The scope in which an asset can be used. The highest scope, system, is intended for internal purposes only. - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` - `id` (string, required) — Unique identifier of the asset. - `kind` (enum, required) — The kind of the asset. - Allowed values: `compute`, `environment`, `accessKey`, `dockerRegistry`, `password`, `genericSecret`, `registry`, `s3`, `git`, `nfs`, `pvc`, `hostPath`, `workload-template`, `model`, `config-map`, `secret-volume`, `data-volume`, `ngcApiKey` - `createdBy` (string, required) — The user who created the asset. - `createdAt` (datetime, required) — The time at which the asset were created - `updatedBy` (string, required) — The user who updated the asset. - `updatedAt` (datetime, required) — The time at which the asset has been updated - `description` (string, optional) — The description of the asset. - `clusterId` (string, optional) — The id of the cluster. - `departmentId` (string, optional, nullable) — The id of the department. Must be specified for department scoped assets. - `projectId` (integer, optional, nullable) — The id of the project. Must be specified for project scoped assets. - `autoDelete` (boolean, optional, nullable, default: false) — The asset will be deleted automatically. This is intended for internal use. - `workloadSupportedTypes` (WorkloadSupportedTypes, optional) - `private` (boolean, optional, nullable, default: false) — The asset will be private to the user who created it. supported only for docker registry and generic secrets - `tenantId` (integer, optional, nullable) — The id of the tenant. - `deletedAt` (datetime, optional) — Deletion time of the asset (relevant for assets that sync to the cluster) - `deletedBy` (string, optional) — The user who deleted the asset - `projectName` (string, optional, nullable) — The name of the project that the asset is associated with, for project scoped assets. - `updateCount` (long, optional) — the value of an update counter of a data in the system. ### CredentialsListResponseAssetSpec - `accessKey` (AccessKeySpec, optional, nullable) - `password` (PasswordSpec, optional, nullable) - `dockerRegistry` (DockerRegistrySpec, optional, nullable) - `genericSecret` (GenericSecretSpec, optional, nullable) - `ngcApiKey` (NgcApiKeySpec, optional, nullable) ### AssetUsageInfo Details about resources that use the asset. - `workspaces` (list of WorkloadRefAndStatus, optional) — workspaces that rely on this asset. - `trainings` (list of WorkloadRefAndStatus, optional) — trainings that rely on this asset. - `distributed` (list of WorkloadRefAndStatus, optional) — distributed trainings that rely on this asset. - `inferences` (list of WorkloadRefAndStatus, optional) — inferences that rely on this asset. - `templates` (list of AssetRef, optional) — templates that rely on this asset. - `assets` (AssetsUsageRef, optional) — list of other assets that use this asset. specifically, accessKeys used by s3, and passwords used by git. ### AssetClusterStatusInfo - `status` (enum, optional) - Allowed values: `Creating`, `Deleting`, `Failed`, `Deletion failed`, `Issues found`, `No issues found`, `No status`, `Updating` - `issues` (list of AssetClusterStatusIssue, optional) - `message` (string, optional) - `url` (string, optional) ### ClusterInfo Cluster related information of the asset. - `resources` (list of ClusterResourceInfo, optional) ### WorkloadSupportedTypes - `inference` (boolean, optional, nullable) — Is inference a supported workload type. - `workspace` (boolean, optional, nullable) — Is workspace a supported workload type. - `training` (boolean, optional, nullable) — Is training a supported workload type. - `distributed` (boolean, optional, nullable) — Is distributed a supported workload type. - `distFramework` (enum, optional, nullable) — The distributed training framework used in the workload. Note: The TF, XGBoost and JAX frameworks are deprecated and will be removed in a future release. - Allowed values: `MPI`, `PyTorch`, `TF`, `XGBoost`, `JAX` ### AccessKeySpec - `keyId` (integer, required) — id of the encryption key which has been used to encrypt an asset's data. - `existingSecretName` (string, optional, nullable) — optional name of existing secret in the cluster from which the access key id and secret should be taken. If omitted, you will have to provide those credentials in the accessKeyId and secretAccessKey fields. The provided credentials are encrypted into the control plane database and cloned to a kubernetes secret in the cluster. - `accessKeyId` (string, optional, nullable) — The access key id of the S3-compatible bucket, required only when not using existing secret. - `secretAccessKey` (string, optional, nullable) — The secret access key of the S3-compatible bucket, required only when not using existing secret. ### PasswordSpec - `keyId` (integer, required) — id of the encryption key which has been used to encrypt an asset's data. - `existingSecretName` (string, optional, nullable) — optional name of existing secret in the cluster from which the user name and password should be taken. If omitted, you will have to provide those credentials in the user and password fields. The provided credentials are encrypted into the control plane database and cloned to a kubernetes secret in the cluster. - `user` (string, optional, nullable) — The name of the user, required only when not using existing secret. - `password` (string, optional, nullable) — The password, required only when not using existing secret. ### DockerRegistrySpec - `keyId` (integer, required) — id of the encryption key which has been used to encrypt an asset's data. - `existingSecretName` (string, optional, nullable) — optional name of existing secret in the cluster from which the docker registry details should be taken. If omitted, you will have to provide those credentials and url in relevant fields. The provided credentials are encrypted into the control plane database and cloned to a kubernetes secret in the cluster, along with the url. - `user` (string, optional, nullable) — The name of the user, required only when not using existing secret. - `password` (string, optional, nullable) — The password, required only when not using existing secret. - `url` (string, optional, nullable) — The url, required only when not using existing secret. ### GenericSecretSpec - `keyId` (integer, required) — id of the encryption key which has been used to encrypt an asset's data. - `existingSecretName` (string, optional, nullable) — name of existing secret in the cluster from which the general key-value values should be taken. - `keyValuePairs` (list of KeyValuePair, optional) — Set of key-value pairs to store in the new credential. ### NgcApiKeySpec - `keyId` (integer, required) — id of the encryption key which has been used to encrypt an asset's data. - `ngc_api_key` (string, optional) — The NGC API key value. ### WorkloadRefAndStatus Id, name and status of a workspace or training - `id` (string, required) — A unique ID of the workload. - `name` (string, required) — The name of the workload. - `status` (string, optional) — The status of the workspace or training. ### AssetRef Reference information about an asset. - `id` (string, required) — Unique identifier of the asset. - `name` (string, required) — The name of the asset. ### AssetsUsageRef Reference information about usage of assets by other assets, for example datasources that uses credentials. - `environment` (EnvironmentAssetRef, optional, nullable) — environment asset. - `environments` (list of AssetRef, optional) - `compute` (AssetsUsageRefCompute, optional) - `computes` (list of AssetRef, optional) - `datasources` (list of AssetDatasourceRef, optional) ### AssetClusterStatusIssue - `scopeId` (string, required) — The id of the cluster, department or project, depending on the scope type. - `scopeType` (enum, required) - Allowed values: `system`, `tenant`, `cluster`, `department`, `project` - `issue` (enum, required) - Allowed values: `ReplicationError`, `LostPhase`, `NotCreated` ### ClusterResourceInfo - `name` (string, optional, nullable) — The name of the resource created for the asset in the cluster. ### KeyValuePair Details of key-value pair to be stored in the credential. - `key` (string, optional, nullable) — The key of the secret - `value` (string, optional, nullable) — The value of the secret. ### EnvironmentAssetRef Reference information about environment asset. - `id` (string, required) — Unique identifier of the asset. - `name` (string, required) — The name of the asset. - `toolTypes` (list of enum, optional, nullable) — the type of tools as defined in the connections of the environment asset. - Allowed values: `jupyter-notebook`, `pycharm`, `visual-studio-code`, `tensorboard`, `rstudio`, `mlflow`, `custom`, `wandb`, `matlab`, `comet`, `chatbot-ui` ### AssetsUsageRefCompute - `id` (string, required) — Unique identifier of the asset. - `name` (string, required) — The name of the asset. ### AssetDatasourceRef Reference information about a datasource asset. - `id` (string, required) — Unique identifier of the asset. - `name` (string, required) — The name of the asset. - `kind` (enum, required) — The kind of the asset. - Allowed values: `compute`, `environment`, `accessKey`, `dockerRegistry`, `password`, `genericSecret`, `registry`, `s3`, `git`, `nfs`, `pvc`, `hostPath`, `workload-template`, `model`, `config-map`, `secret-volume`, `data-volume`, `ngcApiKey` - `overrides` (DataSourceOverrides, optional) — specific fields to override in the data source. ### DataSourceOverrides specific fields to override in the data source. - `containerPath` (string, optional, nullable) ## Examples **Response** ```json { "entries": [ { "meta": { "name": "my-asset", "scope": "tenant", "id": "a418ed33-9399-48c0-a890-122cadd13bfd", "kind": "s3", "createdBy": "test@run.ai", "createdAt": "2023-02-23T14:25:36.707685Z", "updatedBy": "test@run.ai", "updatedAt": "2023-02-23T14:25:36.707685Z", "workloadSupportedTypes": { "workspace": false, "training": false, "distributed": true, "distFramework": "TF" } }, "spec": { "accessKey": { "keyId": 1, "existingSecretName": "string", "accessKeyId": "string", "secretAccessKey": "string" }, "password": { "keyId": 1, "existingSecretName": "string", "user": "string", "password": "string" }, "dockerRegistry": { "keyId": 1, "existingSecretName": "string", "user": "string", "password": "string", "url": "string" }, "genericSecret": { "keyId": 1, "existingSecretName": "string", "keyValuePairs": [ { "key": "secret-key", "value": "my-secret" } ] }, "ngcApiKey": { "keyId": 1, "ngc_api_key": "string" } }, "usedBy": { "workspaces": [ { "id": "string", "name": "my-workload-name", "status": "string" } ], "trainings": [ { "id": "string", "name": "my-workload-name", "status": "string" } ], "distributed": [ { "id": "string", "name": "my-workload-name", "status": "string" } ], "inferences": [ { "id": "string", "name": "my-workload-name", "status": "string" } ], "templates": [ { "id": "string", "name": "my-asset" } ], "assets": { "environment": { "id": "string", "name": "my-asset", "toolTypes": [ "jupyter-notebook" ] }, "environments": [ { "id": "string", "name": "my-asset" } ], "compute": { "id": "string", "name": "my-asset" }, "computes": [ { "id": "string", "name": "my-asset" } ], "datasources": [ { "id": "string", "name": "my-asset", "kind": "compute", "overrides": { "containerPath": "/container/directory" } } ] } }, "status": { "status": "Creating", "issues": [ { "scopeId": "string", "scopeType": "system", "issue": "ReplicationError" } ], "message": "string", "url": "string" }, "clusterInfo": { "resources": [ { "name": "password-credential-1" } ] } } ] } ``` **SDK Code** ```python import requests url = "http://localhost:8080/api/v1/asset/credentials" headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript const url = 'http://localhost:8080/api/v1/asset/credentials'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "http://localhost:8080/api/v1/asset/credentials" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("http://localhost:8080/api/v1/asset/credentials") http = Net::HTTP.new(url.host, url.port) request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("http://localhost:8080/api/v1/asset/credentials") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'http://localhost:8080/api/v1/asset/credentials', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("http://localhost:8080/api/v1/asset/credentials"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "http://localhost:8080/api/v1/asset/credentials")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```