@databricks/sdk-uc-credentials 0.0.0-dev → 0.1.0-dev.2

package/dist/v1/model.d.ts

@@ -0,0 +1,1274 @@
+import { z } from 'zod';
+export declare enum IsolationMode {
+    ISOLATION_MODE_UNSPECIFIED = "ISOLATION_MODE_UNSPECIFIED",
+    ISOLATION_MODE_OPEN = "ISOLATION_MODE_OPEN",
+    ISOLATION_MODE_ISOLATED = "ISOLATION_MODE_ISOLATED"
+}
+export declare enum PathOperation {
+    PATH_READ = "PATH_READ",
+    PATH_READ_WRITE = "PATH_READ_WRITE",
+    PATH_CREATE_TABLE = "PATH_CREATE_TABLE"
+}
+export declare enum TableOperation {
+    READ = "READ",
+    READ_WRITE = "READ_WRITE"
+}
+export declare enum VolumeOperation {
+    READ_VOLUME = "READ_VOLUME",
+    WRITE_VOLUME = "WRITE_VOLUME"
+}
+/** A enum represents the result of the file operation */
+export declare enum ValidateCredentialRequest_Result {
+    PASS = "PASS",
+    FAIL = "FAIL",
+    SKIP = "SKIP"
+}
+/**
+ * A enum represents the file operation performed on the external location
+ * with the storage credential
+ */
+export declare enum ValidateStorageCredentialRequest_FileOperation {
+    LIST = "LIST",
+    READ = "READ",
+    WRITE = "WRITE",
+    DELETE = "DELETE",
+    PATH_EXISTS = "PATH_EXISTS"
+}
+/** A enum represents the result of the file operation */
+export declare enum ValidateStorageCredentialRequest_Result {
+    PASS = "PASS",
+    FAIL = "FAIL",
+    SKIP = "SKIP"
+}
+export interface AccountsCreateStorageCredentialRequest {
+    /** <Databricks> account ID of any type. For non-E2 account types, get your account ID from the [Accounts Console](https://docs.databricks.com/administration-guide/account-settings/usage.html) */
+    accountId?: string | undefined;
+    /** Unity Catalog metastore ID */
+    metastoreId?: string | undefined;
+    credentialInfo?: CreateAccountsStorageCredential | undefined;
+    /**
+     * Optional, default false.
+     * Supplying true to this argument skips validation of the created set of credentials.
+     */
+    skipValidation?: boolean | undefined;
+}
+export interface AccountsCreateStorageCredentialRequest_Response {
+    credentialInfo?: StorageCredentialInfo | undefined;
+}
+/** Deletes a storage credential for an account */
+export interface AccountsDeleteStorageCredentialRequest {
+    /** <Databricks> account ID of any type. For non-E2 account types, get your account ID from the [Accounts Console](https://docs.databricks.com/administration-guide/account-settings/usage.html) */
+    accountId?: string | undefined;
+    /** Unity Catalog metastore ID */
+    metastoreId?: string | undefined;
+    /** Name of the storage credential. */
+    nameArg?: string | undefined;
+    /** Force deletion even if the Storage Credential is not empty. Default is false. */
+    force?: boolean | undefined;
+}
+/** The storage credential was successfully deleted. */
+export interface AccountsDeleteStorageCredentialRequest_Response {
+}
+/** Retrieves a single storage credential */
+export interface AccountsGetStorageCredentialRequest {
+    /** <Databricks> account ID of any type. For non-E2 account types, get your account ID from the [Accounts Console](https://docs.databricks.com/administration-guide/account-settings/usage.html) */
+    accountId?: string | undefined;
+    /** Unity Catalog metastore ID */
+    metastoreId?: string | undefined;
+    /** Required. Name of the storage credential. */
+    nameArg?: string | undefined;
+}
+/** The storage credential was successfully retrieved. */
+export interface AccountsGetStorageCredentialRequest_Response {
+    credentialInfo?: StorageCredentialInfo | undefined;
+}
+/** Lists all storage credentials for the given account and metastore */
+export interface AccountsListStorageCredentialsRequest {
+    /** <Databricks> account ID of any type. For non-E2 account types, get your account ID from the [Accounts Console](https://docs.databricks.com/administration-guide/account-settings/usage.html) */
+    accountId?: string | undefined;
+    /** Unity Catalog metastore ID */
+    metastoreId?: string | undefined;
+}
+/** The metastore storage credentials were successfully returned. */
+export interface AccountsListStorageCredentialsRequest_Response {
+    /** An array of metastore storage credentials. */
+    storageCredentials?: StorageCredentialInfo[] | undefined;
+}
+/** The storage credential to update. */
+export interface AccountsUpdateStorageCredentialRequest {
+    /** <Databricks> account ID of any type. For non-E2 account types, get your account ID from the [Accounts Console](https://docs.databricks.com/administration-guide/account-settings/usage.html) */
+    accountId?: string | undefined;
+    /** Unity Catalog metastore ID */
+    metastoreId?: string | undefined;
+    /** Name of the storage credential. */
+    nameArg?: string | undefined;
+    credentialInfo?: UpdateAccountsStorageCredential | undefined;
+    /** Optional. Supplying true to this argument skips validation of the updated set of credentials. */
+    skipValidation?: boolean | undefined;
+}
+/** The storage credential was successfully updated. */
+export interface AccountsUpdateStorageCredentialRequest_Response {
+    credentialInfo?: StorageCredentialInfo | undefined;
+}
+export interface AwsCredentials {
+    creds?: {
+        $case: 'stsRole';
+        stsRole: AwsCredentials_StsRole;
+    } | undefined;
+}
+export interface AwsCredentials_StsRole {
+    /** The Amazon Resource Name (ARN) of the cross account IAM role. */
+    roleArn?: string | undefined;
+}
+/** The AWS IAM role configuration */
+export interface AwsIamRole {
+    /** The Amazon Resource Name (ARN) of the AWS IAM role used to vend temporary credentials. */
+    roleArn?: string | undefined;
+    /**
+     * The Amazon Resource Name (ARN) of the AWS IAM user managed by <Databricks>.
+     * This is the identity that is going to assume the AWS IAM role.
+     */
+    unityCatalogIamArn?: string | undefined;
+    /** The external ID used in role assumption to prevent the confused deputy problem. */
+    externalId?: string | undefined;
+}
+/**
+ * Azure Active Directory token, essentially the Oauth token for Azure Service Principal or Managed
+ * Identity.
+ * Read more at https://learn.microsoft.com/en-us/azure/databricks/dev-tools/api/latest/aad/service-prin-aad-token
+ */
+export interface AzureActiveDirectoryToken {
+    /** Opaque token that contains claims that you can use in Azure Active Directory to access cloud services. */
+    aadToken?: string | undefined;
+}
+/** The Azure managed identity configuration. */
+export interface AzureManagedIdentity {
+    /**
+     * The Azure resource ID of the Azure Databricks Access Connector. Use the format
+     * `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.Databricks/accessConnectors/{connector-name}`.
+     */
+    accessConnectorId?: string | undefined;
+    /**
+     * The Azure resource ID of the managed identity. Use the format,
+     * `/subscriptions/{guid}/resourceGroups/{rg-name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity-name}`
+     * This is only available for user-assgined identities. For system-assigned identities, the access_connector_id is used to identify the identity.
+     * If this field is not provided, then we assume the AzureManagedIdentity is using the system-assigned identity.
+     */
+    managedIdentityId?: string | undefined;
+    /** The <Databricks> internal ID that represents this managed identity. */
+    credentialId?: string | undefined;
+}
+/** The Azure service principal configuration. Only applicable when purpose is **STORAGE**. */
+export interface AzureServicePrincipal {
+    /** The directory ID corresponding to the Azure Active Directory (AAD) tenant of the application. */
+    directoryId?: string | undefined;
+    /** The application ID of the application registration within the referenced AAD tenant. */
+    applicationId?: string | undefined;
+    /** The client secret generated for the above app ID in AAD. */
+    clientSecret?: string | undefined;
+}
+/**
+ * Azure temporary credentials for API authentication.
+ * Read more at https://docs.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas
+ */
+export interface AzureUserDelegationSas {
+    /** The signed URI (SAS Token) used to access blob services for a given path */
+    sasToken?: string | undefined;
+}
+/**
+ * The Cloudflare API token configuration.
+ * Read more at https://developers.cloudflare.com/r2/api/s3/tokens/
+ */
+export interface CloudflareApiToken {
+    /** The access key ID associated with the API token. */
+    accessKeyId?: string | undefined;
+    /** The secret access token generated for the above access key ID. */
+    secretAccessKey?: string | undefined;
+    /** The ID of the account associated with the API token. */
+    accountId?: string | undefined;
+}
+export interface CreateAccountsStorageCredential {
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+export interface CreateCredentialAwsCredentials {
+    creds?: {
+        $case: 'stsRole';
+        stsRole: AwsCredentials_StsRole;
+    } | undefined;
+}
+export interface CreateCredentialRequest {
+    /**
+     * Optional. Supplying true to this argument skips validation of the created
+     * set of credentials.
+     */
+    skipValidation?: boolean | undefined;
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+export interface CreateCredentialsRequest {
+    accountId?: string | undefined;
+    /** The human-readable name of the credential configuration object. */
+    credentialsName?: string | undefined;
+    /** (-- NOTE(austin) This oneof is a future-looking definition when we add other clouds --) */
+    cloudCredentials?: {
+        $case: 'awsCredentials';
+        awsCredentials: CreateCredentialAwsCredentials;
+    } | undefined;
+}
+export interface CreateStorageCredentialRequest {
+    /** Supplying true to this argument skips validation of the created credential. */
+    skipValidation?: boolean | undefined;
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+export interface CredentialInfo {
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+export interface Credentials {
+    /** <Databricks> credential configuration ID. */
+    credentialsId?: string | undefined;
+    /** The <Databricks> account ID that hosts the credential. */
+    accountId?: string | undefined;
+    /** (-- NOTE(austin) This oneof is a future-looking definition when we add other clouds --) */
+    cloudCredentials?: {
+        $case: 'awsCredentials';
+        awsCredentials: AwsCredentials;
+    } | undefined;
+    /** The human-readable name of the credential configuration object. */
+    credentialsName?: string | undefined;
+    /** Time in epoch milliseconds when the credential was created. */
+    creationTime?: bigint | undefined;
+}
+/**
+ * GCP long-lived credential.
+ * <Databricks>-created Google Cloud Storage service account.
+ */
+export interface DatabricksGcpServiceAccount {
+    /** The email of the service account. */
+    email?: string | undefined;
+    /** The ID that represents the private key for this Service Account */
+    privateKeyId?: string | undefined;
+    /** The <Databricks> internal ID that represents this managed identity. */
+    credentialId?: string | undefined;
+}
+export interface DeleteCredentialRequest {
+    /** Name of the credential. */
+    nameArg?: string | undefined;
+    /**
+     * Force an update even if there are dependent services (when purpose is
+     * **SERVICE**) or dependent external locations and external tables (when
+     * purpose is **STORAGE**).
+     */
+    force?: boolean | undefined;
+}
+export interface DeleteCredentialRequest_Response {
+}
+export interface DeleteCredentialsRequest {
+    /** Databricks Account API credential configuration ID */
+    credentialsId?: string | undefined;
+    accountId?: string | undefined;
+}
+export interface DeleteStorageCredentialRequest {
+    /** Name of the storage credential. */
+    nameArg?: string | undefined;
+    /**
+     * Force an update even if there are dependent external locations or external
+     * tables (when purpose is **STORAGE**) or dependent services (when purpose is
+     * **SERVICE**).
+     */
+    force?: boolean | undefined;
+}
+export interface DeleteStorageCredentialRequest_Response {
+}
+/**
+ * GCP temporary credentials for API authentication.
+ * Read more at https://developers.google.com/identity/protocols/oauth2/service-account
+ */
+export interface GcpOauthToken {
+    oauthToken?: string | undefined;
+}
+/**
+ * GCP long-lived credential.
+ * GCP Service Account.
+ */
+export interface GcpServiceAccountKey {
+    /** The email of the service account. */
+    email?: string | undefined;
+    /** The ID of the service account's private key. */
+    privateKeyId?: string | undefined;
+    /** The service account's RSA private key. */
+    privateKey?: string | undefined;
+}
+export interface GenerateTemporaryPathCredentialRequest {
+    /** URL for path-based access. */
+    url?: string | undefined;
+    /** The operation being performed on the path. */
+    operation?: PathOperation | undefined;
+    /**
+     * Optional. When set to true, the service will not validate that the generated
+     * credentials can perform write operations, therefore no new paths will be created
+     * and the response will not contain valid credentials. Defaults to false.
+     */
+    dryRun?: boolean | undefined;
+}
+export interface GenerateTemporaryPathCredentialRequest_Response {
+    /** The temporary credential. */
+    credentials?: {
+        $case: 'awsTempCredentials';
+        awsTempCredentials: TemporaryAwsCredentials;
+    } | {
+        $case: 'azureUserDelegationSas';
+        azureUserDelegationSas: AzureUserDelegationSas;
+    } | {
+        $case: 'gcpOauthToken';
+        gcpOauthToken: GcpOauthToken;
+    } | {
+        $case: 'azureAad';
+        azureAad: AzureActiveDirectoryToken;
+    } | {
+        $case: 'r2TempCredentials';
+        r2TempCredentials: R2Credentials;
+    } | undefined;
+    /**
+     * Server time when the credential will expire, in epoch milliseconds.
+     * The API client is advised to cache the credential given this expiration time.
+     */
+    expirationTime?: bigint | undefined;
+    /** The URL of the storage path accessible by the temporary credential. */
+    url?: string | undefined;
+}
+export interface GenerateTemporaryServiceCredentialRequest {
+    /** The name of the service credential used to generate a temporary credential */
+    credentialName?: string | undefined;
+    options?: {
+        $case: 'azureOptions';
+        azureOptions: GenerateTemporaryServiceCredentialRequest_AzureOptions;
+    } | {
+        $case: 'gcpOptions';
+        gcpOptions: GenerateTemporaryServiceCredentialRequest_GcpOptions;
+    } | undefined;
+}
+/** The Azure cloud options to customize the requested temporary credential */
+export interface GenerateTemporaryServiceCredentialRequest_AzureOptions {
+    /**
+     * The resources to which the temporary Azure credential should apply. These resources
+     * are the scopes that are passed to the token provider (see https://learn.microsoft.com/python/api/azure-core/azure.core.credentials.tokencredential?view=azure-python)
+     */
+    resources?: string[] | undefined;
+}
+/** The GCP cloud options to customize the requested temporary credential */
+export interface GenerateTemporaryServiceCredentialRequest_GcpOptions {
+    /**
+     * The scopes to which the temporary GCP credential should apply. These resources
+     * are the scopes that are passed to the token provider (see
+     * https://google-auth.readthedocs.io/en/latest/reference/google.auth.html#google.auth.credentials.Credentials)
+     */
+    scopes?: string[] | undefined;
+}
+export interface GenerateTemporaryTableCredentialRequest {
+    /** UUID of the table to read or write. */
+    tableId?: string | undefined;
+    /**
+     * The operation performed against the table data, either READ or READ_WRITE. If READ_WRITE is specified,
+     * the credentials returned will have write permissions, otherwise, it will be read only.
+     */
+    operation?: TableOperation | undefined;
+}
+export interface GenerateTemporaryTableCredentialRequest_Response {
+    /** The temporary credential. */
+    credentials?: {
+        $case: 'awsTempCredentials';
+        awsTempCredentials: TemporaryAwsCredentials;
+    } | {
+        $case: 'azureUserDelegationSas';
+        azureUserDelegationSas: AzureUserDelegationSas;
+    } | {
+        $case: 'gcpOauthToken';
+        gcpOauthToken: GcpOauthToken;
+    } | {
+        $case: 'azureAad';
+        azureAad: AzureActiveDirectoryToken;
+    } | {
+        $case: 'r2TempCredentials';
+        r2TempCredentials: R2Credentials;
+    } | undefined;
+    /**
+     * Server time when the credential will expire, in epoch milliseconds.
+     * The API client is advised to cache the credential given this expiration time.
+     */
+    expirationTime?: bigint | undefined;
+    /** The URL of the storage path accessible by the temporary credential. */
+    url?: string | undefined;
+}
+/** Generate volume credentials RPC */
+export interface GenerateTemporaryVolumeCredentialRequest {
+    /** Id of the volume to read or write. */
+    volumeId?: string | undefined;
+    /**
+     * The operation performed against the volume data, either READ_VOLUME or WRITE_VOLUME. If WRITE_VOLUME is specified,
+     * the credentials returned will have write permissions, otherwise, it will be read only.
+     */
+    operation?: VolumeOperation | undefined;
+}
+export interface GenerateTemporaryVolumeCredentialRequest_Response {
+    /** The temporary credential. */
+    credentials?: {
+        $case: 'awsTempCredentials';
+        awsTempCredentials: TemporaryAwsCredentials;
+    } | {
+        $case: 'azureUserDelegationSas';
+        azureUserDelegationSas: AzureUserDelegationSas;
+    } | {
+        $case: 'gcpOauthToken';
+        gcpOauthToken: GcpOauthToken;
+    } | {
+        $case: 'azureAad';
+        azureAad: AzureActiveDirectoryToken;
+    } | {
+        $case: 'r2TempCredentials';
+        r2TempCredentials: R2Credentials;
+    } | undefined;
+    /**
+     * Server time when the credential will expire, in epoch milliseconds.
+     * The API client is advised to cache the credential given this expiration time.
+     */
+    expirationTime?: bigint | undefined;
+    /** The URL of the storage path accessible by the temporary credential. */
+    url?: string | undefined;
+}
+export interface GetCredentialRequest {
+    /** Name of the credential. */
+    nameArg?: string | undefined;
+}
+export interface GetCredentialsRequest {
+    /** Credential configuration ID */
+    credentialsId?: string | undefined;
+    accountId?: string | undefined;
+}
+/**
+ * TODO(UC-1710): The legacy /storage-credentials API is being deprecated.
+ * Please use the new consolidated /credentials API instead.
+ * See https://github.com/databricks-eng/universe/pull/857047#discussion_r1924779791 for an example of a case when that wasn't possible.
+ */
+export interface GetStorageCredentialRequest {
+    /** Name of the storage credential. */
+    nameArg?: string | undefined;
+}
+export interface ListCredentialsPublicRequest {
+    accountId?: string | undefined;
+}
+/**
+ * ListCredentialsRequest is used to list credentials in the metastore.
+ * Returns an array of credentials (as CredentialInfo objects). The array is
+ * limited to the credentials that the caller has permission to access. If the
+ * caller is a metastore admin, retrieval of credentials is unrestricted.
+ *
+ * There is no guarantee of a specific ordering of the elements in the array.
+ */
+export interface ListCredentialsRequest {
+    /**
+     * Whether to include credentials not bound to the workspace.
+     * Effective only if the user has permission to update the credential–workspace binding.
+     */
+    includeUnbound?: boolean | undefined;
+    /**
+     * Maximum number of credentials to return.
+     * - If not set, the default max page size is used.
+     * - When set to a value greater than 0, the page length is the minimum of
+     * this value and a server-configured value.
+     * - When set to 0, the page length is set to a server-configured value
+     * (recommended).
+     * - When set to a value less than 0, an invalid parameter error is
+     * returned.
+     */
+    maxResults?: number | undefined;
+    /** Opaque token to retrieve the next page of results. */
+    pageToken?: string | undefined;
+}
+export interface ListCredentialsRequest_Response {
+    credentials?: CredentialInfo[] | undefined;
+    /**
+     * Opaque token to retrieve the next page of results. Absent if there are no
+     * more pages.
+     * __page_token__ should be set to this value for the next request (for the
+     * next page of results).
+     */
+    nextPageToken?: string | undefined;
+}
+export interface ListCredentialsResponse {
+    credentials?: Credentials[] | undefined;
+}
+export interface ListStorageCredentialsRequest {
+    /**
+     * Whether to include credentials not bound to the workspace.
+     * Effective only if the user has permission to update the credential–workspace binding.
+     */
+    includeUnbound?: boolean | undefined;
+    /**
+     * Maximum number of storage credentials to return.
+     * If not set, all the storage credentials are returned (not recommended).
+     * - when set to a value greater than 0, the page length is the minimum of
+     * this value and a server configured value;
+     * - when set to 0, the page length is set to a server configured value
+     * (recommended);
+     * - when set to a value less than 0, an invalid parameter error is returned;
+     */
+    maxResults?: number | undefined;
+    /** Opaque pagination token to go to next page based on previous query. */
+    pageToken?: string | undefined;
+}
+export interface ListStorageCredentialsRequest_Response {
+    storageCredentials?: StorageCredentialInfo[] | undefined;
+    /**
+     * Opaque token to retrieve the next page of results. Absent if there are no
+     * more pages.
+     * __page_token__ should be set to this value for the next request (for the
+     * next page of results).
+     */
+    nextPageToken?: string | undefined;
+}
+/**
+ * R2 temporary credentials for API authentication.
+ * Read more at https://developers.cloudflare.com/r2/api/s3/tokens/.
+ */
+export interface R2Credentials {
+    /** The access key ID that identifies the temporary credentials. */
+    accessKeyId?: string | undefined;
+    /** The secret access key associated with the access key. */
+    secretAccessKey?: string | undefined;
+    /** The generated JWT that users must pass to use the temporary credentials. */
+    sessionToken?: string | undefined;
+}
+export interface StorageCredentialInfo {
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+/**
+ * AWS temporary credentials for API authentication.
+ * Read more at https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html.
+ */
+export interface TemporaryAwsCredentials {
+    /** The access key ID that identifies the temporary credentials. */
+    accessKeyId?: string | undefined;
+    /** The secret access key that can be used to sign AWS API requests. */
+    secretAccessKey?: string | undefined;
+    /** The token that users must pass to AWS API to use the temporary credentials. */
+    sessionToken?: string | undefined;
+    /**
+     * The Amazon Resource Name (ARN) of the S3 access point for
+     * temporary credentials related the external location.
+     */
+    accessPoint?: string | undefined;
+}
+export interface TemporaryCredentials {
+    /** The temporary credential. */
+    credentials?: {
+        $case: 'awsTempCredentials';
+        awsTempCredentials: TemporaryAwsCredentials;
+    } | {
+        $case: 'azureUserDelegationSas';
+        azureUserDelegationSas: AzureUserDelegationSas;
+    } | {
+        $case: 'gcpOauthToken';
+        gcpOauthToken: GcpOauthToken;
+    } | {
+        $case: 'azureAad';
+        azureAad: AzureActiveDirectoryToken;
+    } | {
+        $case: 'r2TempCredentials';
+        r2TempCredentials: R2Credentials;
+    } | undefined;
+    /**
+     * Server time when the credential will expire, in epoch milliseconds.
+     * The API client is advised to cache the credential given this expiration time.
+     */
+    expirationTime?: bigint | undefined;
+    /** The URL of the storage path accessible by the temporary credential. */
+    url?: string | undefined;
+}
+export interface UpdateAccountsStorageCredential {
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+export interface UpdateCredentialRequest {
+    /** Name of the credential. */
+    nameArg?: string | undefined;
+    /** New name of credential. */
+    newName?: string | undefined;
+    /** Supply true to this argument to skip validation of the updated credential. */
+    skipValidation?: boolean | undefined;
+    /**
+     * Force an update even if there are dependent services (when purpose is
+     * **SERVICE**) or dependent external locations and external tables (when
+     * purpose is **STORAGE**).
+     */
+    force?: boolean | undefined;
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+export interface UpdateStorageCredentialRequest {
+    /** Name of the storage credential. */
+    nameArg?: string | undefined;
+    /** New name for the storage credential. */
+    newName?: string | undefined;
+    /** Supplying true to this argument skips validation of the updated credential. */
+    skipValidation?: boolean | undefined;
+    /**
+     * Force update even if there are dependent external locations or external
+     * tables.
+     */
+    force?: boolean | undefined;
+    /**
+     * The credential name. The name must be unique among storage and service
+     * credentials within the metastore.
+     */
+    name?: string | undefined;
+    /** (--[Create:REQ, Update:OPT] The long-lived cloud credential.--) */
+    credential?: {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'gcpServiceAccountKey';
+        gcpServiceAccountKey: GcpServiceAccountKey;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> managed GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** Comment associated with the credential. */
+    comment?: string | undefined;
+    /**
+     * Whether the credential is usable only for read operations. Only applicable
+     * when purpose is **STORAGE**.
+     */
+    readOnly?: boolean | undefined;
+    /** Username of current owner of credential. */
+    owner?: string | undefined;
+    /** The unique identifier of the credential. */
+    id?: string | undefined;
+    /** Unique identifier of the parent metastore. */
+    metastoreId?: string | undefined;
+    /** Time at which this credential was created, in epoch milliseconds. */
+    createdAt?: bigint | undefined;
+    /** Username of credential creator. */
+    createdBy?: string | undefined;
+    /** Time at which this credential was last modified, in epoch milliseconds. */
+    updatedAt?: bigint | undefined;
+    /** Username of user who last modified the credential. */
+    updatedBy?: string | undefined;
+    /**
+     * Whether this credential is the current metastore's root storage credential.
+     * Only applicable when purpose is **STORAGE**.
+     */
+    usedForManagedStorage?: boolean | undefined;
+    /** The full name of the credential. */
+    fullName?: string | undefined;
+    /**
+     * Whether the current securable is accessible from all workspaces or a
+     * specific set of workspaces.
+     */
+    isolationMode?: IsolationMode | undefined;
+}
+/** Next ID: 18 */
+export interface ValidateCredentialRequest {
+    credential?: {
+        $case: 'credentialName';
+        /**
+         * Required. The name of an existing credential or long-lived cloud
+         * credential to validate.
+         */
+        credentialName: string;
+    } | {
+        $case: 'awsIamRole';
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureManagedIdentity';
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | undefined;
+    /**
+     * The name of an existing external location to validate. Only applicable for
+     * storage credentials (purpose is
+     * **STORAGE**.)
+     */
+    externalLocationName?: string | undefined;
+    /**
+     * The external location url to validate. Only applicable when purpose is
+     * **STORAGE**.
+     */
+    url?: string | undefined;
+    /**
+     * Whether the credential is only usable for read operations. Only applicable
+     * for storage credentials (purpose is
+     * **STORAGE**.)
+     */
+    readOnly?: boolean | undefined;
+}
+export interface ValidateCredentialRequest_Response {
+    /** The results of the validation check. */
+    results?: ValidateCredentialRequest_ValidationResult[] | undefined;
+    /**
+     * Whether the tested location is a directory in cloud storage. Only
+     * applicable for when purpose is **STORAGE**.
+     */
+    isDir?: boolean | undefined;
+}
+export interface ValidateCredentialRequest_ValidationResult {
+    /** The results of the tested operation. */
+    result?: ValidateCredentialRequest_Result | undefined;
+    /** Error message would exist when the result does not equal to **PASS**. */
+    message?: string | undefined;
+}
+export interface ValidateStorageCredentialRequest {
+    credential?: {
+        $case: 'storageCredentialName';
+        /**
+         * Required. The name of an existing credential or long-lived cloud
+         * credential to validate.
+         */
+        storageCredentialName: string;
+    } | {
+        $case: 'awsIamRole';
+        /** The AWS IAM role configuration. */
+        awsIamRole: AwsIamRole;
+    } | {
+        $case: 'azureServicePrincipal';
+        /** The Azure service principal configuration. */
+        azureServicePrincipal: AzureServicePrincipal;
+    } | {
+        $case: 'azureManagedIdentity';
+        /** The Azure managed identity configuration. */
+        azureManagedIdentity: AzureManagedIdentity;
+    } | {
+        $case: 'databricksGcpServiceAccount';
+        /** The <Databricks> created GCP service account configuration. */
+        databricksGcpServiceAccount: DatabricksGcpServiceAccount;
+    } | {
+        $case: 'cloudflareApiToken';
+        /** The Cloudflare API token configuration. */
+        cloudflareApiToken: CloudflareApiToken;
+    } | undefined;
+    /** The name of an existing external location to validate. */
+    externalLocationName?: string | undefined;
+    /** The external location url to validate. */
+    url?: string | undefined;
+    /** Whether the storage credential is only usable for read operations. */
+    readOnly?: boolean | undefined;
+}
+export interface ValidateStorageCredentialRequest_Response {
+    /** Whether the tested location is a directory in cloud storage. */
+    isDir?: boolean | undefined;
+    /** The results of the validation check. */
+    results?: ValidateStorageCredentialRequest_ValidationResult[] | undefined;
+}
+export interface ValidateStorageCredentialRequest_ValidationResult {
+    /** The operation tested. */
+    operation?: ValidateStorageCredentialRequest_FileOperation | undefined;
+    /** The results of the tested operation. */
+    result?: ValidateStorageCredentialRequest_Result | undefined;
+    /** Error message would exist when the result does not equal to **PASS**. */
+    message?: string | undefined;
+}
+export declare const unmarshalAccountsCreateStorageCredentialRequest_ResponseSchema: z.ZodType<AccountsCreateStorageCredentialRequest_Response>;
+export declare const unmarshalAccountsDeleteStorageCredentialRequest_ResponseSchema: z.ZodType<AccountsDeleteStorageCredentialRequest_Response>;
+export declare const unmarshalAccountsGetStorageCredentialRequest_ResponseSchema: z.ZodType<AccountsGetStorageCredentialRequest_Response>;
+export declare const unmarshalAccountsListStorageCredentialsRequest_ResponseSchema: z.ZodType<AccountsListStorageCredentialsRequest_Response>;
+export declare const unmarshalAccountsUpdateStorageCredentialRequest_ResponseSchema: z.ZodType<AccountsUpdateStorageCredentialRequest_Response>;
+export declare const unmarshalAwsCredentialsSchema: z.ZodType<AwsCredentials>;
+export declare const unmarshalAwsCredentials_StsRoleSchema: z.ZodType<AwsCredentials_StsRole>;
+export declare const unmarshalAwsIamRoleSchema: z.ZodType<AwsIamRole>;
+export declare const unmarshalAzureActiveDirectoryTokenSchema: z.ZodType<AzureActiveDirectoryToken>;
+export declare const unmarshalAzureManagedIdentitySchema: z.ZodType<AzureManagedIdentity>;
+export declare const unmarshalAzureServicePrincipalSchema: z.ZodType<AzureServicePrincipal>;
+export declare const unmarshalAzureUserDelegationSasSchema: z.ZodType<AzureUserDelegationSas>;
+export declare const unmarshalCloudflareApiTokenSchema: z.ZodType<CloudflareApiToken>;
+export declare const unmarshalCredentialInfoSchema: z.ZodType<CredentialInfo>;
+export declare const unmarshalCredentialsSchema: z.ZodType<Credentials>;
+export declare const unmarshalDatabricksGcpServiceAccountSchema: z.ZodType<DatabricksGcpServiceAccount>;
+export declare const unmarshalDeleteCredentialRequest_ResponseSchema: z.ZodType<DeleteCredentialRequest_Response>;
+export declare const unmarshalDeleteStorageCredentialRequest_ResponseSchema: z.ZodType<DeleteStorageCredentialRequest_Response>;
+export declare const unmarshalGcpOauthTokenSchema: z.ZodType<GcpOauthToken>;
+export declare const unmarshalGcpServiceAccountKeySchema: z.ZodType<GcpServiceAccountKey>;
+export declare const unmarshalGenerateTemporaryPathCredentialRequest_ResponseSchema: z.ZodType<GenerateTemporaryPathCredentialRequest_Response>;
+export declare const unmarshalGenerateTemporaryTableCredentialRequest_ResponseSchema: z.ZodType<GenerateTemporaryTableCredentialRequest_Response>;
+export declare const unmarshalGenerateTemporaryVolumeCredentialRequest_ResponseSchema: z.ZodType<GenerateTemporaryVolumeCredentialRequest_Response>;
+export declare const unmarshalListCredentialsRequest_ResponseSchema: z.ZodType<ListCredentialsRequest_Response>;
+export declare const unmarshalListStorageCredentialsRequest_ResponseSchema: z.ZodType<ListStorageCredentialsRequest_Response>;
+export declare const unmarshalR2CredentialsSchema: z.ZodType<R2Credentials>;
+export declare const unmarshalStorageCredentialInfoSchema: z.ZodType<StorageCredentialInfo>;
+export declare const unmarshalTemporaryAwsCredentialsSchema: z.ZodType<TemporaryAwsCredentials>;
+export declare const unmarshalTemporaryCredentialsSchema: z.ZodType<TemporaryCredentials>;
+export declare const unmarshalValidateCredentialRequest_ResponseSchema: z.ZodType<ValidateCredentialRequest_Response>;
+export declare const unmarshalValidateCredentialRequest_ValidationResultSchema: z.ZodType<ValidateCredentialRequest_ValidationResult>;
+export declare const unmarshalValidateStorageCredentialRequest_ResponseSchema: z.ZodType<ValidateStorageCredentialRequest_Response>;
+export declare const unmarshalValidateStorageCredentialRequest_ValidationResultSchema: z.ZodType<ValidateStorageCredentialRequest_ValidationResult>;
+export declare const marshalAccountsCreateStorageCredentialRequestSchema: z.ZodType;
+export declare const marshalAccountsUpdateStorageCredentialRequestSchema: z.ZodType;
+export declare const marshalAwsCredentials_StsRoleSchema: z.ZodType;
+export declare const marshalAwsIamRoleSchema: z.ZodType;
+export declare const marshalAzureManagedIdentitySchema: z.ZodType;
+export declare const marshalAzureServicePrincipalSchema: z.ZodType;
+export declare const marshalCloudflareApiTokenSchema: z.ZodType;
+export declare const marshalCreateAccountsStorageCredentialSchema: z.ZodType;
+export declare const marshalCreateCredentialAwsCredentialsSchema: z.ZodType;
+export declare const marshalCreateCredentialRequestSchema: z.ZodType;
+export declare const marshalCreateCredentialsRequestSchema: z.ZodType;
+export declare const marshalCreateStorageCredentialRequestSchema: z.ZodType;
+export declare const marshalDatabricksGcpServiceAccountSchema: z.ZodType;
+export declare const marshalGcpServiceAccountKeySchema: z.ZodType;
+export declare const marshalGenerateTemporaryPathCredentialRequestSchema: z.ZodType;
+export declare const marshalGenerateTemporaryServiceCredentialRequestSchema: z.ZodType;
+export declare const marshalGenerateTemporaryServiceCredentialRequest_AzureOptionsSchema: z.ZodType;
+export declare const marshalGenerateTemporaryServiceCredentialRequest_GcpOptionsSchema: z.ZodType;
+export declare const marshalGenerateTemporaryTableCredentialRequestSchema: z.ZodType;
+export declare const marshalGenerateTemporaryVolumeCredentialRequestSchema: z.ZodType;
+export declare const marshalUpdateAccountsStorageCredentialSchema: z.ZodType;
+export declare const marshalUpdateCredentialRequestSchema: z.ZodType;
+export declare const marshalUpdateStorageCredentialRequestSchema: z.ZodType;
+export declare const marshalValidateCredentialRequestSchema: z.ZodType;
+export declare const marshalValidateStorageCredentialRequestSchema: z.ZodType;
+//# sourceMappingURL=model.d.ts.map