ethyca-fides 2.71.1b1__py2.py3-none-any.whl → 2.74.0rc1__py2.py3-none-any.whl

fides/api/alembic/migrations/versions/xx_2025_11_05_0200_f1a2b3c4d5e6_create_staged_resource_error_table.py

@@ -0,0 +1,82 @@
+"""Create staged resource error table
+
+Revision ID: f1a2b3c4d5e6
+Revises: 80d28dea3b6b
+Create Date: 2025-11-05 02:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "f1a2b3c4d5e6"
+down_revision = "80d28dea3b6b"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Create the stagedresourceerror table
+    op.create_table(
+        "stagedresourceerror",
+        sa.Column("id", sa.String(), nullable=False),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=True,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=True,
+        ),
+        sa.Column(
+            "staged_resource_urn",
+            sa.String(),
+            nullable=False,
+        ),
+        sa.Column("message", sa.String(), nullable=False),
+        sa.Column("timestamp", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("error_type", sa.String(), nullable=False),
+        sa.Column("diff_status", sa.String(), nullable=False),
+        sa.Column("task_id", sa.String(), nullable=True),
+        sa.ForeignKeyConstraint(
+            ["staged_resource_urn"],
+            ["stagedresource.urn"],
+            name="stagedresourceerror_staged_resource_urn_fkey",
+            ondelete="CASCADE",
+        ),
+        sa.PrimaryKeyConstraint("id"),
+    )
+
+    op.create_index(
+        "ix_stagedresourceerror_staged_resource_urn",
+        "stagedresourceerror",
+        ["staged_resource_urn"],
+        unique=False,
+    )
+
+    op.create_index(
+        "ix_stagedresourceerror_task_id",
+        "stagedresourceerror",
+        ["task_id"],
+        unique=False,
+    )
+
+
+def downgrade():
+    # Drop the indices
+    op.drop_index(
+        "ix_stagedresourceerror_task_id",
+        table_name="stagedresourceerror",
+    )
+    op.drop_index(
+        "ix_stagedresourceerror_staged_resource_urn",
+        table_name="stagedresourceerror",
+    )
+
+    # Drop the stagedresourceerror table
+    op.drop_table("stagedresourceerror")

fides/api/api/v1/endpoints/connection_endpoints.py

@@ -24,6 +24,7 @@ from starlette.status import (
 from fides.api.api import deps
 from fides.api.models.connection_oauth_credentials import OAuthConfig
 from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
+from fides.api.models.event_audit import EventAuditType
 from fides.api.oauth.utils import verify_oauth_client
 from fides.api.schemas.connection_configuration import connection_secrets_schemas
 from fides.api.schemas.connection_configuration.connection_config import (
@@ -40,13 +41,14 @@ from fides.api.schemas.connection_configuration.connection_secrets import (
 )
 from fides.api.schemas.connection_configuration.enums.system_type import SystemType
 from fides.api.schemas.connection_configuration.enums.test_status import TestStatus
+from fides.api.service.deps import get_connection_service
 from fides.api.util.api_router import APIRouter
 from fides.api.util.connection_util import (
     connection_status,
     delete_connection_config,
     get_connection_config_or_error,
     patch_connection_configs,
-    validate_secrets,
+    update_connection_secrets,
 )
 from fides.common.api.scope_registry import (
     CONNECTION_CREATE_OR_UPDATE,
@@ -61,6 +63,8 @@ from fides.common.api.v1.urn_registry import (
     CONNECTIONS,
     V1_URL_PREFIX,
 )
+from fides.service.connection.connection_service import ConnectionService
+from fides.service.event_audit_service import EventAuditService
 
 router = APIRouter(tags=["Connections"], prefix=V1_URL_PREFIX)
 
@@ -220,28 +224,6 @@ def delete_connection(
     delete_connection_config(db, connection_key)
 
 
-def validate_and_update_secrets(
-    connection_key: FidesKey,
-    connection_config: ConnectionConfig,
-    db: Session,
-    unvalidated_secrets: connection_secrets_schemas,
-    verify: Optional[bool],
-) -> TestStatusMessage:
-    connection_config.secrets = validate_secrets(
-        db, unvalidated_secrets, connection_config
-    ).model_dump(mode="json")
-    # Save validated secrets, regardless of whether they've been verified.
-    logger.info("Updating connection config secrets for '{}'", connection_key)
-    connection_config.save(db=db)
-
-    msg = f"Secrets updated for ConnectionConfig with key: {connection_key}."
-
-    if verify:
-        return connection_status(connection_config, msg, db)
-
-    return TestStatusMessage(msg=msg, test_status=None)
-
-
 @router.put(
     CONNECTION_SECRETS,
     status_code=HTTP_200_OK,
@@ -251,7 +233,7 @@ def validate_and_update_secrets(
 def put_connection_config_secrets(
     connection_key: FidesKey,
     *,
-    db: Session = Depends(deps.get_db),
+    connection_service: ConnectionService = Depends(get_connection_service),
     unvalidated_secrets: connection_secrets_schemas,
     verify: Optional[bool] = True,
 ) -> TestStatusMessage:
@@ -261,10 +243,8 @@ def put_connection_config_secrets(
     The specific secrets will be connection-dependent. For example, the components needed to connect to a Postgres DB
     will differ from Dynamo DB.
     """
-    connection_config = get_connection_config_or_error(db, connection_key)
-
-    return validate_and_update_secrets(
-        connection_key, connection_config, db, unvalidated_secrets, verify
+    return update_connection_secrets(
+        connection_service, connection_key, unvalidated_secrets, verify
     )
 
 
@@ -277,7 +257,7 @@ def put_connection_config_secrets(
 def patch_connection_config_secrets(
     connection_key: FidesKey,
     *,
-    db: Session = Depends(deps.get_db),
+    connection_service: ConnectionService = Depends(get_connection_service),
     unvalidated_secrets: connection_secrets_schemas,
     verify: Optional[bool] = True,
 ) -> TestStatusMessage:
@@ -287,22 +267,12 @@ def patch_connection_config_secrets(
     The specific secrets will be connection-dependent. For example, the components needed to connect to a Postgres DB
     will differ from Dynamo DB.
     """
-    connection_config = get_connection_config_or_error(db, connection_key)
-
-    existing_secrets: Optional[Dict[str, Any]] = connection_config.secrets
-
-    # We create the new secrets object by combining the existing secrets with the new secrets.
-    patched_secrets = {}
-    if existing_secrets:
-        patched_secrets = {**existing_secrets}
-
-    patched_secrets = {
-        **patched_secrets,
-        **unvalidated_secrets,  # type: ignore[dict-item]
-    }
-
-    return validate_and_update_secrets(
-        connection_key, connection_config, db, patched_secrets, verify  # type: ignore[arg-type]
+    return update_connection_secrets(
+        connection_service,
+        connection_key,
+        unvalidated_secrets,
+        verify,
+        merge_with_existing=True,
     )
 
 
@@ -354,6 +324,16 @@ def put_connection_oauth_config(
     )
     connection_config.save(db=db)
 
+    event_audit_service = EventAuditService(db)
+    connection_service = ConnectionService(db, event_audit_service)
+
+    # Create secrets audit event for OAuth credential changes
+    connection_service.create_secrets_audit_event(
+        EventAuditType.connection_secrets_updated,
+        connection_config,
+        oauth_config.model_dump(exclude_unset=True),  # The OAuth secrets being updated
+    )
+
     msg = (
         f"OAuth2 configuration updated for ConnectionConfig with key: {connection_key}."
     )
@@ -455,6 +435,19 @@ def patch_connection_oauth_config(
             detail="Invalid OAuth2 configuration.",
         ) from exc
 
+    # Create audit event for OAuth config update (OAuth credentials are secrets)
+    event_audit_service = EventAuditService(db)
+    connection_service = ConnectionService(db, event_audit_service)
+
+    # Create secrets audit event for OAuth credential changes
+    connection_service.create_secrets_audit_event(
+        EventAuditType.connection_secrets_updated,
+        connection_config,
+        validated_config.model_dump(
+            exclude_unset=True
+        ),  # The OAuth secrets being updated
+    )
+
     msg = (
         f"OAuth2 configuration updated for ConnectionConfig with key: {connection_key}."
     )

fides/api/api/v1/endpoints/generic_overrides.py

@@ -1,7 +1,7 @@
 from functools import partial
 from typing import Dict, List, Optional, Union
 
-from fastapi import Depends, HTTPException, Query, Response, Security
+from fastapi import Body, Depends, HTTPException, Query, Response, Security
 from fastapi.concurrency import run_in_threadpool
 from fastapi.encoders import jsonable_encoder
 from fastapi.responses import JSONResponse
@@ -368,7 +368,7 @@ async def create_data_use(
     """
     try:
         return taxonomy_service.create_or_update_element(
-            "data_uses", data_use.model_dump()
+            "data_use", data_use.model_dump()
         )
     except KeyOrNameAlreadyExists:
         raise HTTPException(
@@ -399,7 +399,7 @@ async def create_data_category(
 
     try:
         return taxonomy_service.create_or_update_element(
-            "data_categories", data_category.model_dump()
+            "data_category", data_category.model_dump()
         )
     except KeyOrNameAlreadyExists:
         raise HTTPException(
@@ -430,7 +430,7 @@ async def create_data_subject(
 
     try:
         return taxonomy_service.create_or_update_element(
-            "data_subjects", data_subject.model_dump()
+            "data_subject", data_subject.model_dump()
         )
     except KeyOrNameAlreadyExists:
         raise HTTPException(
@@ -465,7 +465,7 @@ async def update_data_use(
         )
     try:
         result = taxonomy_service.update_element(
-            "data_uses", data_use.fides_key, data_use.model_dump()
+            "data_use", data_use.fides_key, data_use.model_dump()
         )
         if not result:
             raise HTTPException(
@@ -501,7 +501,7 @@ async def update_data_category(
         )
     try:
         result = taxonomy_service.update_element(
-            "data_categories", data_category.fides_key, data_category.model_dump()
+            "data_category", data_category.fides_key, data_category.model_dump()
         )
         if not result:
             raise HTTPException(
@@ -516,6 +516,75 @@ async def update_data_category(
         )
 
 
+@data_category_router.patch(
+    "/data_category/{fides_key}/tagging_instructions",
+    dependencies=[Security(verify_oauth_client, scopes=[DATA_CATEGORY_UPDATE])],
+    response_model=DataCategory,
+    status_code=status.HTTP_200_OK,
+    name="Update tagging instructions",
+)
+async def update_data_category_tagging_instructions(
+    fides_key: str,
+    tagging_instructions: str = Body(..., embed=True),
+    taxonomy_service: TaxonomyService = Depends(get_taxonomy_service),
+) -> Dict:
+    """
+    Update or add tagging_instructions for a data category.
+    This is used by LLM-based classification to provide custom instructions for tagging.
+    """
+    try:
+        result = taxonomy_service.update_element(
+            "data_category",
+            fides_key,
+            {"tagging_instructions": tagging_instructions},
+        )
+        if not result:
+            raise HTTPException(
+                status_code=HTTP_404_NOT_FOUND,
+                detail=f"Data category not found with key: {fides_key}",
+            )
+        return result
+    except (ValidationError, PydanticValidationError) as e:
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=str(e),
+        )
+
+
+@data_category_router.delete(
+    "/data_category/{fides_key}/tagging_instructions",
+    dependencies=[Security(verify_oauth_client, scopes=[DATA_CATEGORY_UPDATE])],
+    response_model=DataCategory,
+    status_code=status.HTTP_200_OK,
+    name="Delete tagging instructions",
+)
+async def delete_data_category_tagging_instructions(
+    fides_key: str,
+    taxonomy_service: TaxonomyService = Depends(get_taxonomy_service),
+) -> Dict:
+    """
+    Remove tagging_instructions from a data category.
+    Sets the tagging_instructions field to None.
+    """
+    try:
+        result = taxonomy_service.update_element(
+            "data_category",
+            fides_key,
+            {"tagging_instructions": None},
+        )
+        if not result:
+            raise HTTPException(
+                status_code=HTTP_404_NOT_FOUND,
+                detail=f"Data category not found with key: {fides_key}",
+            )
+        return result
+    except (ValidationError, PydanticValidationError) as e:
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=str(e),
+        )
+
+
 GENERIC_OVERRIDES_ROUTER = APIRouter()
 GENERIC_OVERRIDES_ROUTER.include_router(dataset_router)
 GENERIC_OVERRIDES_ROUTER.include_router(data_use_router)

fides/api/api/v1/endpoints/privacy_request_endpoints.py

@@ -91,6 +91,7 @@ from fides.api.schemas.privacy_request import (
     BulkPostPrivacyRequests,
     BulkReviewResponse,
     BulkSoftDeletePrivacyRequests,
+    CancelPrivacyRequests,
     CheckpointActionRequired,
     DenyPrivacyRequests,
     ExecutionLogDetailResponse,
@@ -144,8 +145,10 @@ from fides.common.api.v1.urn_registry import (
     PRIVACY_REQUEST_APPROVE,
     PRIVACY_REQUEST_AUTHENTICATED,
     PRIVACY_REQUEST_BATCH_EMAIL_SEND,
+    PRIVACY_REQUEST_BULK_FINALIZE,
     PRIVACY_REQUEST_BULK_RETRY,
     PRIVACY_REQUEST_BULK_SOFT_DELETE,
+    PRIVACY_REQUEST_CANCEL,
     PRIVACY_REQUEST_DENY,
     PRIVACY_REQUEST_FILTERED_RESULTS,
     PRIVACY_REQUEST_FINALIZE,
@@ -485,7 +488,7 @@ def _filter_privacy_request_queryset(
     errored_gt: Optional[datetime] = None,
     external_id: Optional[str] = None,
     location: Optional[str] = None,
-    action_type: Optional[ActionType] = None,
+    action_type: Optional[Union[ActionType, List[ActionType]]] = None,
     include_consent_webhook_requests: Optional[bool] = False,
     include_deleted_requests: Optional[bool] = False,
 ) -> Query:
@@ -675,9 +678,11 @@ def _filter_privacy_request_queryset(
             PrivacyRequest.finished_processing_at > errored_gt,
         )
     if action_type:
+        if isinstance(action_type, ActionType):
+            action_type = [action_type]
         policy_ids_for_action_type = (
             db.query(Rule)
-            .filter(Rule.action_type == action_type)
+            .filter(Rule.action_type.in_(action_type))
             .with_entities(Rule.policy_id)
             .distinct()
         )
@@ -791,7 +796,7 @@ def _shared_privacy_request_search(
     errored_gt: Optional[datetime] = None,
     external_id: Optional[str] = None,
     location: Optional[str] = None,
-    action_type: Optional[ActionType] = None,
+    action_type: Optional[Union[ActionType, List[ActionType]]] = None,
     verbose: Optional[bool] = False,
     include_identities: Optional[bool] = False,
     include_custom_privacy_request_fields: Optional[bool] = False,
@@ -1356,10 +1361,10 @@ def restart_privacy_request_from_failure(
     )
 
     # Automatically resubmit the request if the cache has expired
+
     if (
-        not privacy_request.get_cached_identity_data()
-        and privacy_request.status
-        not in [PrivacyRequestStatus.complete, PrivacyRequestStatus.pending]
+        not privacy_request.verify_cache_for_identity_data()
+        and privacy_request.status != PrivacyRequestStatus.complete
     ):
         logger.info(
             f"Cached data for privacy request {privacy_request.id} has expired, automatically resubmitting request"
@@ -1476,6 +1481,29 @@ def deny_privacy_request(
     )
 
 
+@router.patch(
+    PRIVACY_REQUEST_CANCEL,
+    status_code=HTTP_200_OK,
+    response_model=BulkReviewResponse,
+)
+def cancel_privacy_request(
+    *,
+    client: ClientDetail = Security(
+        verify_oauth_client,
+        scopes=[PRIVACY_REQUEST_REVIEW],
+    ),
+    privacy_request_service: PrivacyRequestService = Depends(
+        get_privacy_request_service
+    ),
+    privacy_requests: CancelPrivacyRequests,
+) -> BulkReviewResponse:
+    """Cancel a list of privacy requests and/or report failure"""
+
+    return privacy_request_service.cancel_privacy_requests(
+        privacy_requests.request_ids, privacy_requests.reason, user_id=client.user_id
+    )
+
+
 def _validate_privacy_request_pending_or_error(
     db: Session, privacy_request_id: str
 ) -> None:
@@ -1971,6 +1999,32 @@ def resume_privacy_request_from_requires_input(
     return privacy_request  # type: ignore[return-value]
 
 
+@router.post(
+    PRIVACY_REQUEST_BULK_FINALIZE,
+    status_code=HTTP_200_OK,
+    response_model=BulkReviewResponse,
+)
+def bulk_finalize_privacy_requests(
+    *,
+    client: ClientDetail = Security(
+        verify_oauth_client,
+        scopes=[PRIVACY_REQUEST_REVIEW],
+    ),
+    privacy_request_service: PrivacyRequestService = Depends(
+        get_privacy_request_service
+    ),
+    privacy_requests: ReviewPrivacyRequestIds,
+) -> BulkReviewResponse:
+    """
+    Bulk finalize privacy requests that are in requires_manual_finalization status.
+    Each request will be moved from the 'requires_finalization' state to 'complete'.
+    Returns an object with the list of successfully finalized privacy requests and the list of failed finalizations.
+    """
+    return privacy_request_service.finalize_privacy_requests(
+        privacy_requests.request_ids, user_id=client.user_id
+    )
+
+
 @router.post(
     PRIVACY_REQUEST_FINALIZE,
     status_code=HTTP_200_OK,

fides/api/api/v1/endpoints/saas_config_endpoints.py

@@ -3,10 +3,12 @@ from typing import Optional
 from zipfile import BadZipFile, ZipFile
 
 from fastapi import Body, Depends, HTTPException, Request
+from fastapi.encoders import jsonable_encoder
 from fastapi.params import Security
 from fastapi.responses import JSONResponse
 from fideslang.validation import FidesKey
 from loguru import logger
+from pydantic import ValidationError
 from sqlalchemy.orm import Session
 from starlette.status import (
     HTTP_200_OK,
@@ -18,9 +20,15 @@ from starlette.status import (
 )
 
 from fides.api.api import deps
-from fides.api.common_exceptions import FidesopsException, KeyOrNameAlreadyExists
+from fides.api.common_exceptions import (
+    FidesopsException,
+    KeyOrNameAlreadyExists,
+    SaaSConfigNotFoundException,
+)
+from fides.api.common_exceptions import ValidationError as FidesValidationError
 from fides.api.models.connectionconfig import ConnectionConfig, ConnectionType
 from fides.api.models.datasetconfig import DatasetConfig
+from fides.api.models.event_audit import EventAuditStatus, EventAuditType
 from fides.api.models.sql_models import System  # type: ignore
 from fides.api.oauth.utils import verify_oauth_client
 from fides.api.schemas.connection_configuration.connection_config import (
@@ -29,7 +37,6 @@ from fides.api.schemas.connection_configuration.connection_config import (
 from fides.api.schemas.connection_configuration.saas_config_template_values import (
     SaasConnectionTemplateValues,
 )
-from fides.api.schemas.saas.connector_template import ConnectorTemplate
 from fides.api.schemas.saas.saas_config import (
     SaaSConfig,
     SaaSConfigValidationDetails,
@@ -42,13 +49,11 @@ from fides.api.service.authentication.authentication_strategy_oauth2_authorizati
     OAuth2AuthorizationCodeAuthenticationStrategy,
 )
 from fides.api.service.connectors.saas.connector_registry_service import (
-    ConnectorRegistry,
     CustomConnectorTemplateLoader,
-    create_connection_config_from_template_no_save,
-    upsert_dataset_config_from_template,
 )
 from fides.api.util.api_router import APIRouter
-from fides.api.util.connection_util import validate_secrets
+from fides.api.util.connection_util import validate_secrets_error_message
+from fides.api.util.event_audit_util import generate_connection_audit_event_details
 from fides.common.api.scope_registry import (
     CONNECTION_AUTHORIZE,
     CONNECTOR_TEMPLATE_REGISTER,
@@ -59,13 +64,17 @@ from fides.common.api.scope_registry import (
 )
 from fides.common.api.v1.urn_registry import (
     AUTHORIZE,
-    CONNECTION_TYPES,
     REGISTER_CONNECTOR_TEMPLATE,
     SAAS_CONFIG,
     SAAS_CONFIG_VALIDATE,
     SAAS_CONNECTOR_FROM_TEMPLATE,
     V1_URL_PREFIX,
 )
+from fides.service.connection.connection_service import (
+    ConnectionService,
+    ConnectorTemplateNotFound,
+)
+from fides.service.event_audit_service import EventAuditService
 
 router = APIRouter(tags=["SaaS Configs"], prefix=V1_URL_PREFIX)
 
@@ -168,12 +177,29 @@ def patch_saas_config(
     Given a SaaS config element, update the corresponding ConnectionConfig object
     or report failure
     """
+
     logger.info(
         "Updating SaaS config '{}' on connection config '{}'",
         saas_config.fides_key,
         connection_config.key,
     )
     connection_config.update_saas_config(db, saas_config=saas_config)
+
+    # Create audit event for SaaS config update
+    event_audit_service = EventAuditService(db)
+    event_details, description = generate_connection_audit_event_details(
+        EventAuditType.connection_updated,
+        connection_config=connection_config,
+    )
+    event_audit_service.create_event_audit(
+        event_type=EventAuditType.connection_updated,
+        status=EventAuditStatus.succeeded,
+        resource_type="connection_config",
+        resource_identifier=connection_config.key,
+        description=description,
+        event_details=event_details,
+    )
+
     return connection_config.saas_config  # type: ignore
 
 
@@ -305,59 +331,45 @@ def instantiate_connection(
     Looks up the connector type in the SaaS connector registry and, if all required
     fields are provided, persists the associated connection config and dataset to the database.
     """
-    connector_template: Optional[ConnectorTemplate] = (
-        ConnectorRegistry.get_connector_template(saas_connector_type)
-    )
-    if not connector_template:
-        raise HTTPException(
-            status_code=HTTP_404_NOT_FOUND,
-            detail=f"SaaS connector type '{saas_connector_type}' is not yet available in Fidesops. For a list of available SaaS connectors, refer to {CONNECTION_TYPES}.",
+    event_audit_service = EventAuditService(db)
+    connection_service = ConnectionService(db, event_audit_service)
+    try:
+        connection_config, dataset_config = connection_service.instantiate_connection(
+            saas_connector_type, template_values, system
         )
-
-    if DatasetConfig.filter(
-        db=db,
-        conditions=(DatasetConfig.fides_key == template_values.instance_key),  # type: ignore[arg-type]
-    ).count():
+    except ConnectorTemplateNotFound as exc:
         raise HTTPException(
-            status_code=HTTP_400_BAD_REQUEST,
-            detail=f"SaaS connector instance key '{template_values.instance_key}' already exists.",
-        )
-
-    try:
-        connection_config: ConnectionConfig = (
-            create_connection_config_from_template_no_save(
-                db, connector_template, template_values
-            )
+            status_code=HTTP_404_NOT_FOUND,
+            detail=f"{exc.args[0]}",
         )
     except KeyOrNameAlreadyExists as exc:
         raise HTTPException(
             status_code=HTTP_400_BAD_REQUEST,
             detail=exc.args[0],
         )
-
-    connection_config.secrets = validate_secrets(
-        db, template_values.secrets, connection_config
-    ).model_dump(mode="json")
-    if system:
-        connection_config.system_id = system.id
-    connection_config.save(db=db)  # Not persisted to db until secrets are validated
-
-    try:
-        dataset_config: DatasetConfig = upsert_dataset_config_from_template(
-            db, connection_config, connector_template, template_values
+    except SaaSConfigNotFoundException:
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=validate_secrets_error_message(),
         )
-    except Exception:
-        connection_config.delete(db)
+    except FidesValidationError as e:
+        # Check if the exception has the original pydantic errors attached
+        raise HTTPException(status_code=HTTP_422_UNPROCESSABLE_ENTITY, detail=e.message)
+    except ValidationError as e:
+        errors = e.errors(include_url=False, include_input=False)
+        for err in errors:
+            # Additionally, manually remove the context from the error message -
+            # this may contain sensitive information
+            err.pop("ctx", None)
+        raise HTTPException(
+            status_code=HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=jsonable_encoder(errors),
+        )
+    except Exception as exc:
         raise HTTPException(
             status_code=HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"SaaS Connector could not be created from the '{saas_connector_type}' template at this time.",
+            detail=f"{exc.args[0]}",
         )
-    logger.info(
-        "SaaS Connector and Dataset {} successfully created from '{}' template.",
-        template_values.instance_key,
-        saas_connector_type,
-    )
-
     return SaasConnectionTemplateResponse(
         connection=connection_config, dataset=dataset_config.ctl_dataset
     )