@pulumi/databricks 1.102.0 → 1.103.0-alpha.1786420525

package/types/output.d.ts

@@ -1617,23 +1617,28 @@ export interface AiGatewayModelProviderServiceConfigAmazonBedrock {
 }
 export interface AiGatewayModelProviderServiceConfigAmazonBedrockDirect {
     /**
-     * AWS access key ID for Bedrock authentication. Required on Create when using
-     * access-key auth; must be paired with `awsSecretAccessKey` and is
-     * mutually exclusive with `serviceCredential`. Treated as
+     * AWS access-key-pair auth. Mutually exclusive with `serviceCredential`.
+     * Supersedes the flat `awsAccessKeyId` / `awsSecretAccessKey` fields
+     */
+    awsAccessKey?: outputs.AiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKey;
+    region?: string;
+    serviceCredential?: outputs.AiGatewayModelProviderServiceConfigAmazonBedrockDirectServiceCredential;
+}
+export interface AiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKey {
+    /**
+     * AWS access key ID. Required on Create when using access-key auth. Treated as
      * username-equivalent (not a secret value): round-trips on reads and is
      * scrubbed from audit logs
      */
-    awsAccessKeyId?: string;
+    accessKeyId?: string;
     /**
-     * AWS secret access key paired with `awsAccessKeyId`. Required on Create
-     * when using access-key auth; mutually exclusive with `serviceCredential`.
-     * Supplied as inline plaintext via `ProviderSecret.plaintext`
+     * AWS secret access key paired with `accessKeyId`. Required on Create when
+     * using access-key auth. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
      */
-    awsSecretAccessKey?: outputs.AiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsSecretAccessKey;
-    region?: string;
-    serviceCredential?: outputs.AiGatewayModelProviderServiceConfigAmazonBedrockDirectServiceCredential;
+    secretAccessKey?: outputs.AiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKeySecretAccessKey;
 }
-export interface AiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsSecretAccessKey {
+export interface AiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKeySecretAccessKey {
     /**
      * Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -1686,10 +1691,8 @@ export interface AiGatewayModelProviderServiceConfigAzureOpenai {
 export interface AiGatewayModelProviderServiceConfigAzureOpenaiDirect {
     apiKey?: outputs.AiGatewayModelProviderServiceConfigAzureOpenaiDirectApiKey;
     baseUrl?: string;
-    clientId?: string;
-    clientSecret?: outputs.AiGatewayModelProviderServiceConfigAzureOpenaiDirectClientSecret;
+    entraServicePrincipal?: outputs.AiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipal;
     serviceCredential?: outputs.AiGatewayModelProviderServiceConfigAzureOpenaiDirectServiceCredential;
-    tenantId?: string;
 }
 export interface AiGatewayModelProviderServiceConfigAzureOpenaiDirectApiKey {
     /**
@@ -1699,7 +1702,22 @@ export interface AiGatewayModelProviderServiceConfigAzureOpenaiDirectApiKey {
      */
     plaintext: string;
 }
-export interface AiGatewayModelProviderServiceConfigAzureOpenaiDirectClientSecret {
+export interface AiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipal {
+    /**
+     * Entra ID client (application) ID. Required on Create
+     */
+    clientId?: string;
+    /**
+     * Entra ID client secret. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    clientSecret?: outputs.AiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipalClientSecret;
+    /**
+     * Entra ID (Azure AD) tenant ID. Required on Create
+     */
+    tenantId?: string;
+}
+export interface AiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipalClientSecret {
     /**
      * Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -1795,10 +1813,8 @@ export interface AiGatewayModelProviderServiceConfigMicrosoftFoundry {
 export interface AiGatewayModelProviderServiceConfigMicrosoftFoundryDirect {
     apiKey?: outputs.AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectApiKey;
     baseUrl?: string;
-    clientId?: string;
-    clientSecret?: outputs.AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectClientSecret;
+    entraServicePrincipal?: outputs.AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipal;
     serviceCredential?: outputs.AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectServiceCredential;
-    tenantId?: string;
 }
 export interface AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectApiKey {
     /**
@@ -1808,7 +1824,22 @@ export interface AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectApiKey
      */
     plaintext: string;
 }
-export interface AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectClientSecret {
+export interface AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipal {
+    /**
+     * Entra ID client (application) ID. Required on Create
+     */
+    clientId?: string;
+    /**
+     * Entra ID client secret. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    clientSecret?: outputs.AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipalClientSecret;
+    /**
+     * Entra ID (Azure AD) tenant ID. Required on Create
+     */
+    tenantId?: string;
+}
+export interface AiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipalClientSecret {
     /**
      * Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -10304,19 +10335,10 @@ export interface GetAiGatewayModelProviderServiceConfigAmazonBedrock {
 }
 export interface GetAiGatewayModelProviderServiceConfigAmazonBedrockDirect {
     /**
-     * (string) - AWS access key ID for Bedrock authentication. Required on Create when using
-     * access-key auth; must be paired with `awsSecretAccessKey` and is
-     * mutually exclusive with `serviceCredential`. Treated as
-     * username-equivalent (not a secret value): round-trips on reads and is
-     * scrubbed from audit logs
-     */
-    awsAccessKeyId?: string;
-    /**
-     * (ModelProviderServiceConfigProviderSecret) - AWS secret access key paired with `awsAccessKeyId`. Required on Create
-     * when using access-key auth; mutually exclusive with `serviceCredential`.
-     * Supplied as inline plaintext via `ProviderSecret.plaintext`
+     * (ModelProviderServiceConfigAwsAccessKey) - AWS access-key-pair auth. Mutually exclusive with `serviceCredential`.
+     * Supersedes the flat `awsAccessKeyId` / `awsSecretAccessKey` fields
      */
-    awsSecretAccessKey?: outputs.GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsSecretAccessKey;
+    awsAccessKey?: outputs.GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKey;
     /**
      * (string) - GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).
      * Required on Create
@@ -10326,8 +10348,8 @@ export interface GetAiGatewayModelProviderServiceConfigAmazonBedrockDirect {
      * (ModelProviderServiceConfigServiceCredential) - Reference to a UC service credential authorizing Microsoft Foundry requests.
      * On Create the caller supplies `service_credential.name` in the AIP-122
      * resource-name form `credentials/{name}`. Required on Create when using
-     * UC-service-credential auth; mutually exclusive with `apiKey` and with the
-     * Entra triple (tenant_id + clientId + client_secret). The credential is
+     * UC-service-credential auth; mutually exclusive with `apiKey` and
+     * `entraServicePrincipal`. The credential is
      * referenced by name; its value is not carried here. On read the resolved `id`
      * and `isDeleted` are also populated. Only supported on Azure-hosted
      * workspaces; Create requests from other clouds are rejected with
@@ -10335,7 +10357,21 @@ export interface GetAiGatewayModelProviderServiceConfigAmazonBedrockDirect {
      */
     serviceCredential?: outputs.GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectServiceCredential;
 }
-export interface GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsSecretAccessKey {
+export interface GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKey {
+    /**
+     * (string) - AWS access key ID. Required on Create when using access-key auth. Treated as
+     * username-equivalent (not a secret value): round-trips on reads and is
+     * scrubbed from audit logs
+     */
+    accessKeyId?: string;
+    /**
+     * (ModelProviderServiceConfigProviderSecret) - AWS secret access key paired with `accessKeyId`. Required on Create when
+     * using access-key auth. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    secretAccessKey?: outputs.GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKeySecretAccessKey;
+}
+export interface GetAiGatewayModelProviderServiceConfigAmazonBedrockDirectAwsAccessKeySecretAccessKey {
     /**
      * (string) - Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -10407,36 +10443,23 @@ export interface GetAiGatewayModelProviderServiceConfigAzureOpenaiDirect {
      */
     baseUrl?: string;
     /**
-     * (string) - Entra ID client (application) ID for service-principal auth. Set together
-     * with `tenantId` and `clientSecret`; mutually exclusive with `apiKey`
-     * and `serviceCredential`
+     * (ModelProviderServiceConfigEntraServicePrincipal) - Entra ID (service principal) auth. Mutually exclusive with `apiKey` and
+     * `serviceCredential`. Supersedes the flat `tenantId` / `clientId` /
+     * `clientSecret` fields
      */
-    clientId?: string;
-    /**
-     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret for service-principal auth. Set together with
-     * `tenantId` and `clientId`; mutually exclusive with `apiKey` and
-     * `serviceCredential`. Supplied as
-     * inline plaintext via `ProviderSecret.plaintext`
-     */
-    clientSecret?: outputs.GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectClientSecret;
+    entraServicePrincipal?: outputs.GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipal;
     /**
      * (ModelProviderServiceConfigServiceCredential) - Reference to a UC service credential authorizing Microsoft Foundry requests.
      * On Create the caller supplies `service_credential.name` in the AIP-122
      * resource-name form `credentials/{name}`. Required on Create when using
-     * UC-service-credential auth; mutually exclusive with `apiKey` and with the
-     * Entra triple (tenant_id + clientId + client_secret). The credential is
+     * UC-service-credential auth; mutually exclusive with `apiKey` and
+     * `entraServicePrincipal`. The credential is
      * referenced by name; its value is not carried here. On read the resolved `id`
      * and `isDeleted` are also populated. Only supported on Azure-hosted
      * workspaces; Create requests from other clouds are rejected with
      * INVALID_PARAMETER_VALUE
      */
     serviceCredential?: outputs.GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectServiceCredential;
-    /**
-     * (string) - Entra ID (Azure AD) tenant ID for service-principal auth. Set together with
-     * `clientId` and `clientSecret`; mutually exclusive with `apiKey` and
-     * `serviceCredential`
-     */
-    tenantId?: string;
 }
 export interface GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectApiKey {
     /**
@@ -10446,7 +10469,22 @@ export interface GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectApiKey {
      */
     plaintext: string;
 }
-export interface GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectClientSecret {
+export interface GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipal {
+    /**
+     * (string) - Entra ID client (application) ID. Required on Create
+     */
+    clientId?: string;
+    /**
+     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    clientSecret?: outputs.GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipalClientSecret;
+    /**
+     * (string) - Entra ID (Azure AD) tenant ID. Required on Create
+     */
+    tenantId?: string;
+}
+export interface GetAiGatewayModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipalClientSecret {
     /**
      * (string) - Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -10576,36 +10614,23 @@ export interface GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirect {
      */
     baseUrl?: string;
     /**
-     * (string) - Entra ID client (application) ID for service-principal auth. Set together
-     * with `tenantId` and `clientSecret`; mutually exclusive with `apiKey`
-     * and `serviceCredential`
+     * (ModelProviderServiceConfigEntraServicePrincipal) - Entra ID (service principal) auth. Mutually exclusive with `apiKey` and
+     * `serviceCredential`. Supersedes the flat `tenantId` / `clientId` /
+     * `clientSecret` fields
      */
-    clientId?: string;
-    /**
-     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret for service-principal auth. Set together with
-     * `tenantId` and `clientId`; mutually exclusive with `apiKey` and
-     * `serviceCredential`. Supplied as
-     * inline plaintext via `ProviderSecret.plaintext`
-     */
-    clientSecret?: outputs.GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectClientSecret;
+    entraServicePrincipal?: outputs.GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipal;
     /**
      * (ModelProviderServiceConfigServiceCredential) - Reference to a UC service credential authorizing Microsoft Foundry requests.
      * On Create the caller supplies `service_credential.name` in the AIP-122
      * resource-name form `credentials/{name}`. Required on Create when using
-     * UC-service-credential auth; mutually exclusive with `apiKey` and with the
-     * Entra triple (tenant_id + clientId + client_secret). The credential is
+     * UC-service-credential auth; mutually exclusive with `apiKey` and
+     * `entraServicePrincipal`. The credential is
      * referenced by name; its value is not carried here. On read the resolved `id`
      * and `isDeleted` are also populated. Only supported on Azure-hosted
      * workspaces; Create requests from other clouds are rejected with
      * INVALID_PARAMETER_VALUE
      */
     serviceCredential?: outputs.GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectServiceCredential;
-    /**
-     * (string) - Entra ID (Azure AD) tenant ID for service-principal auth. Set together with
-     * `clientId` and `clientSecret`; mutually exclusive with `apiKey` and
-     * `serviceCredential`
-     */
-    tenantId?: string;
 }
 export interface GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectApiKey {
     /**
@@ -10615,7 +10640,22 @@ export interface GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectApi
      */
     plaintext: string;
 }
-export interface GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectClientSecret {
+export interface GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipal {
+    /**
+     * (string) - Entra ID client (application) ID. Required on Create
+     */
+    clientId?: string;
+    /**
+     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    clientSecret?: outputs.GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipalClientSecret;
+    /**
+     * (string) - Entra ID (Azure AD) tenant ID. Required on Create
+     */
+    tenantId?: string;
+}
+export interface GetAiGatewayModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipalClientSecret {
     /**
      * (string) - Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -10887,19 +10927,10 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmaz
 }
 export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirect {
     /**
-     * (string) - AWS access key ID for Bedrock authentication. Required on Create when using
-     * access-key auth; must be paired with `awsSecretAccessKey` and is
-     * mutually exclusive with `serviceCredential`. Treated as
-     * username-equivalent (not a secret value): round-trips on reads and is
-     * scrubbed from audit logs
-     */
-    awsAccessKeyId?: string;
-    /**
-     * (ModelProviderServiceConfigProviderSecret) - AWS secret access key paired with `awsAccessKeyId`. Required on Create
-     * when using access-key auth; mutually exclusive with `serviceCredential`.
-     * Supplied as inline plaintext via `ProviderSecret.plaintext`
+     * (ModelProviderServiceConfigAwsAccessKey) - AWS access-key-pair auth. Mutually exclusive with `serviceCredential`.
+     * Supersedes the flat `awsAccessKeyId` / `awsSecretAccessKey` fields
      */
-    awsSecretAccessKey?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectAwsSecretAccessKey;
+    awsAccessKey?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectAwsAccessKey;
     /**
      * (string) - GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).
      * Required on Create
@@ -10909,8 +10940,8 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmaz
      * (ModelProviderServiceConfigServiceCredential) - Reference to a UC service credential authorizing Microsoft Foundry requests.
      * On Create the caller supplies `service_credential.name` in the AIP-122
      * resource-name form `credentials/{name}`. Required on Create when using
-     * UC-service-credential auth; mutually exclusive with `apiKey` and with the
-     * Entra triple (tenant_id + clientId + client_secret). The credential is
+     * UC-service-credential auth; mutually exclusive with `apiKey` and
+     * `entraServicePrincipal`. The credential is
      * referenced by name; its value is not carried here. On read the resolved `id`
      * and `isDeleted` are also populated. Only supported on Azure-hosted
      * workspaces; Create requests from other clouds are rejected with
@@ -10918,7 +10949,21 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmaz
      */
     serviceCredential?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectServiceCredential;
 }
-export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectAwsSecretAccessKey {
+export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectAwsAccessKey {
+    /**
+     * (string) - AWS access key ID. Required on Create when using access-key auth. Treated as
+     * username-equivalent (not a secret value): round-trips on reads and is
+     * scrubbed from audit logs
+     */
+    accessKeyId?: string;
+    /**
+     * (ModelProviderServiceConfigProviderSecret) - AWS secret access key paired with `accessKeyId`. Required on Create when
+     * using access-key auth. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    secretAccessKey?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectAwsAccessKeySecretAccessKey;
+}
+export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAmazonBedrockDirectAwsAccessKeySecretAccessKey {
     /**
      * (string) - Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -10989,36 +11034,23 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAzur
      */
     baseUrl?: string;
     /**
-     * (string) - Entra ID client (application) ID for service-principal auth. Set together
-     * with `tenantId` and `clientSecret`; mutually exclusive with `apiKey`
-     * and `serviceCredential`
+     * (ModelProviderServiceConfigEntraServicePrincipal) - Entra ID (service principal) auth. Mutually exclusive with `apiKey` and
+     * `serviceCredential`. Supersedes the flat `tenantId` / `clientId` /
+     * `clientSecret` fields
      */
-    clientId?: string;
-    /**
-     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret for service-principal auth. Set together with
-     * `tenantId` and `clientId`; mutually exclusive with `apiKey` and
-     * `serviceCredential`. Supplied as
-     * inline plaintext via `ProviderSecret.plaintext`
-     */
-    clientSecret?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectClientSecret;
+    entraServicePrincipal?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipal;
     /**
      * (ModelProviderServiceConfigServiceCredential) - Reference to a UC service credential authorizing Microsoft Foundry requests.
      * On Create the caller supplies `service_credential.name` in the AIP-122
      * resource-name form `credentials/{name}`. Required on Create when using
-     * UC-service-credential auth; mutually exclusive with `apiKey` and with the
-     * Entra triple (tenant_id + clientId + client_secret). The credential is
+     * UC-service-credential auth; mutually exclusive with `apiKey` and
+     * `entraServicePrincipal`. The credential is
      * referenced by name; its value is not carried here. On read the resolved `id`
      * and `isDeleted` are also populated. Only supported on Azure-hosted
      * workspaces; Create requests from other clouds are rejected with
      * INVALID_PARAMETER_VALUE
      */
     serviceCredential?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectServiceCredential;
-    /**
-     * (string) - Entra ID (Azure AD) tenant ID for service-principal auth. Set together with
-     * `clientId` and `clientSecret`; mutually exclusive with `apiKey` and
-     * `serviceCredential`
-     */
-    tenantId?: string;
 }
 export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectApiKey {
     /**
@@ -11028,7 +11060,22 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAzur
      */
     plaintext: string;
 }
-export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectClientSecret {
+export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipal {
+    /**
+     * (string) - Entra ID client (application) ID. Required on Create
+     */
+    clientId?: string;
+    /**
+     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    clientSecret?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipalClientSecret;
+    /**
+     * (string) - Entra ID (Azure AD) tenant ID. Required on Create
+     */
+    tenantId?: string;
+}
+export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigAzureOpenaiDirectEntraServicePrincipalClientSecret {
     /**
      * (string) - Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -11157,36 +11204,23 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigMicr
      */
     baseUrl?: string;
     /**
-     * (string) - Entra ID client (application) ID for service-principal auth. Set together
-     * with `tenantId` and `clientSecret`; mutually exclusive with `apiKey`
-     * and `serviceCredential`
-     */
-    clientId?: string;
-    /**
-     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret for service-principal auth. Set together with
-     * `tenantId` and `clientId`; mutually exclusive with `apiKey` and
-     * `serviceCredential`. Supplied as
-     * inline plaintext via `ProviderSecret.plaintext`
+     * (ModelProviderServiceConfigEntraServicePrincipal) - Entra ID (service principal) auth. Mutually exclusive with `apiKey` and
+     * `serviceCredential`. Supersedes the flat `tenantId` / `clientId` /
+     * `clientSecret` fields
      */
-    clientSecret?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectClientSecret;
+    entraServicePrincipal?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipal;
     /**
      * (ModelProviderServiceConfigServiceCredential) - Reference to a UC service credential authorizing Microsoft Foundry requests.
      * On Create the caller supplies `service_credential.name` in the AIP-122
      * resource-name form `credentials/{name}`. Required on Create when using
-     * UC-service-credential auth; mutually exclusive with `apiKey` and with the
-     * Entra triple (tenant_id + clientId + client_secret). The credential is
+     * UC-service-credential auth; mutually exclusive with `apiKey` and
+     * `entraServicePrincipal`. The credential is
      * referenced by name; its value is not carried here. On read the resolved `id`
      * and `isDeleted` are also populated. Only supported on Azure-hosted
      * workspaces; Create requests from other clouds are rejected with
      * INVALID_PARAMETER_VALUE
      */
     serviceCredential?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectServiceCredential;
-    /**
-     * (string) - Entra ID (Azure AD) tenant ID for service-principal auth. Set together with
-     * `clientId` and `clientSecret`; mutually exclusive with `apiKey` and
-     * `serviceCredential`
-     */
-    tenantId?: string;
 }
 export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectApiKey {
     /**
@@ -11196,7 +11230,22 @@ export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigMicr
      */
     plaintext: string;
 }
-export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectClientSecret {
+export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipal {
+    /**
+     * (string) - Entra ID client (application) ID. Required on Create
+     */
+    clientId?: string;
+    /**
+     * (ModelProviderServiceConfigProviderSecret) - Entra ID client secret. Supplied as inline plaintext via
+     * `ProviderSecret.plaintext`
+     */
+    clientSecret?: outputs.GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipalClientSecret;
+    /**
+     * (string) - Entra ID (Azure AD) tenant ID. Required on Create
+     */
+    tenantId?: string;
+}
+export interface GetAiGatewayModelProviderServicesModelProviderServiceConfigMicrosoftFoundryDirectEntraServicePrincipalClientSecret {
     /**
      * (string) - Inline plaintext credential. INPUT_ONLY: the value never round-trips on
      * reads. Get and List responses omit `plaintext`; the field's presence in
@@ -31235,11 +31284,11 @@ export interface MwsNetworksGcpNetworkInfo {
      */
     networkProjectId: string;
     /**
-     * @deprecated gcp_network_info.pod_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.124.0/docs/guides/gcp-workspace#creating-a-vpc
+     * @deprecated gcp_network_info.pod_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.125.0/docs/guides/gcp-workspace#creating-a-vpc
      */
     podIpRangeName?: string;
     /**
-     * @deprecated gcp_network_info.service_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.124.0/docs/guides/gcp-workspace#creating-a-vpc
+     * @deprecated gcp_network_info.service_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.125.0/docs/guides/gcp-workspace#creating-a-vpc
      */
     serviceIpRangeName?: string;
     /**
@@ -31300,11 +31349,11 @@ export interface MwsWorkspacesExternalCustomerInfo {
 }
 export interface MwsWorkspacesGcpManagedNetworkConfig {
     /**
-     * @deprecated gcp_managed_network_config.gke_cluster_pod_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.124.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
+     * @deprecated gcp_managed_network_config.gke_cluster_pod_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.125.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
      */
     gkeClusterPodIpRange?: string;
     /**
-     * @deprecated gcp_managed_network_config.gke_cluster_service_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.124.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
+     * @deprecated gcp_managed_network_config.gke_cluster_service_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.125.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
      */
     gkeClusterServiceIpRange?: string;
     subnetCidr: string;