From 1f93c6d92c878ed64621c426fa58aedd818f322c Mon Sep 17 00:00:00 2001 From: "mc-ci-cd-app[bot]" <127546454+mc-ci-cd-app[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 14:55:13 +0000 Subject: [PATCH] Regenerate from api-codegen beeea5e66f --- .api-codegen-source.json | 12 +- .../reference/api/connection-types.md | 4 +- .../onboarding/reference/api/connections.md | 16 +- .../onboarding/reference/api/credentials.md | 904 +++++++++++++++++- skills/onboarding/reference/api/hosting.md | 105 ++ .../onboarding/reference/api/validations.md | 2 +- 6 files changed, 1002 insertions(+), 41 deletions(-) create mode 100644 skills/onboarding/reference/api/hosting.md diff --git a/.api-codegen-source.json b/.api-codegen-source.json index 665e47b..c3d6529 100644 --- a/.api-codegen-source.json +++ b/.api-codegen-source.json @@ -1,8 +1,8 @@ { - "api_codegen_commit": "a4f447591940caf7c208ba57d38ae146c25517a7", - "api_codegen_run_id": 38429688498, - "generated_at": "2026-10-13T16:21:05Z", - "monolith_commit": "ff18165841dd209e70c97f1615aa1a8d43d92953", - "monolith_run_id": 38426880481, - "exported_at": "2026-10-13T16:03:40Z" + "api_codegen_commit": "beeea5e66fa535ccbc24bb0773851071ea66a01c", + "api_codegen_run_id": 39799856591, + "generated_at": "2026-10-22T14:55:13Z", + "monolith_commit": "b04630df6d4755d1a29fd60078defe6be7c7a7f9", + "monolith_run_id": 39797442584, + "exported_at": "2026-10-22T14:41:23Z" } diff --git a/skills/onboarding/reference/api/connection-types.md b/skills/onboarding/reference/api/connection-types.md index 994ad0f..31e4b61 100644 --- a/skills/onboarding/reference/api/connection-types.md +++ b/skills/onboarding/reference/api/connection-types.md @@ -7,7 +7,7 @@ them. Each section is one tool; its name is the tool to call. ## `list_connection_types`: List connection types -List the connection types this account can connect with these tools, and what each one takes. Call it before asking about deployments or credentials, to decide whether an integration can be connected here at all. A type that is not listed cannot be: hand the user off to the Monte Carlo app for it. Match what the user names against `name` and `connection_type`. Each entry gives the parent to reuse or create before create_connection: a warehouse of `warehouse_type` (create_warehouse), a BI container of `bi_container_type` (create_bi_container) or an ETL container of `etl_container_type` (create_etl_container). It says where the credentials can live. `self_hosted_credentials_storages` lists the stores the customer runs that can hold them, each referenced with create__credentials, such as create_aws_secrets_manager_credentials. `mc_managed_credentials_operation` names the operation that stores them with Monte Carlo. When `mc_managed_credentials_secret` is true, that operation takes a secret and is not a tool here: the user runs it with the CLI or Terraform. A type with `credentials_required` false takes none. `requires_deployment` false means the parent takes no deployment, so there is no deployment to choose. `requires_one_of_connection_types` lists the connection the warehouse needs first. A custom type (`is_custom`) runs through the deployment of the agent that registered it: list_custom_connector_types gives that agent and deployment. Nothing here checks a particular deployment. create_connection still refuses one below the version a type needs. +List the connection types this account can connect with these tools, and what each one takes. Call it before asking about deployments or credentials, to decide whether an integration can be connected here at all. A type that is not listed cannot be: hand the user off to the Monte Carlo app for it. Match what the user names against `name` and `connection_type`. Each entry gives the parent to reuse or create before create_connection: a warehouse of `warehouse_type` (create_warehouse), a BI container of `bi_container_type` (create_bi_container) or an ETL container of `etl_container_type` (create_etl_container). It says where the credentials can live. `self_hosted_credentials_storages` lists the stores the customer runs that can hold them, each referenced with create__credentials, such as create_aws_secrets_manager_credentials. `mc_managed_credentials_operation` names the operation that stores them with Monte Carlo. When `mc_managed_credentials_secret` is true, that operation takes a secret and is not a tool here: the user runs it with the CLI or Terraform. A type with `credentials_required` false takes none. `requires_deployment` false means the parent takes no deployment, so there is no deployment to choose. `requires_one_of_connection_types` lists the connection the warehouse needs first. A custom type (`is_custom`) runs through the deployment of the agent that registered it: list_custom_connector_types gives that agent and deployment. Nothing here checks a particular deployment. create_connection refuses a deployment below the version a type needs, and a collection agent below the build it needs. Self-hosted Fivetran credentials and custom types need a recent agent. - **Effect:** read-only. @@ -24,7 +24,7 @@ Returns `items`. Response fields per item: connection_type, name, parent, wareho | `connection_type` | The connection type. Credentials for it name this type, and the connection takes its type from them. | | `name` | Display name of the connection type. | | `parent` | What a connection of this type is added to. Create or reuse one first. | -| `warehouse_type` | The type of warehouse the connection goes on. Null unless `parent` is `warehouse`. | +| `warehouse_type` | The type of warehouse the connection goes on. Null unless `parent` is `warehouse`. Null too for a type any existing warehouse takes, such as `dbt-cloud-webhook`. | | `bi_container_type` | The type of BI container the connection goes on. Null unless `parent` is `bi_container`. | | `etl_container_type` | The type of ETL container the connection goes on. Null unless `parent` is `etl_container`. | | `credentials_required` | Whether the connection needs credentials. False for a push-only type: its data is sent to Monte Carlo, and Monte Carlo reaches no system for it. | diff --git a/skills/onboarding/reference/api/connections.md b/skills/onboarding/reference/api/connections.md index 3405d6e..d612bf2 100644 --- a/skills/onboarding/reference/api/connections.md +++ b/skills/onboarding/reference/api/connections.md @@ -35,7 +35,7 @@ jobs through it, such as a Snowflake Tasks or Power BI dataflows connection. ### Response -Returns `items` (response fields per item: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time), `next_cursor` (pass it as `cursor` for the next page; null on the last page), `has_more`, and `count` (the total across pages, only when `with_count` is true). +Returns `items` (response fields per item: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time, dbt_cloud), `next_cursor` (pass it as `cursor` for the next page; null on the last page), `has_more`, and `count` (the total across pages, only when `with_count` is true). | Field | Description | |---|---| @@ -54,6 +54,7 @@ Returns `items` (response fields per item: id, connection_type, name, warehouse_ | `credentials_storage_type` | Where that secret lives. Null when there are no credentials to describe. | | `job_types` | The jobs Monte Carlo runs on this connection, such as `metadata`. | | `created_time` | When the connection was created. | +| `dbt_cloud` | Which dbt Cloud runs a dbt Cloud webhook connection processes. A dbt Cloud webhook reports runs from every environment in the dbt account. These settings decide which of them Monte Carlo processes for the connection's warehouse. Null for every other connection type. | ### What can fail @@ -64,7 +65,7 @@ Returns `items` (response fields per item: id, connection_type, name, warehouse_ ## `create_connection`: Create a connection -Add a connection to a warehouse, a BI container or an ETL container from credentials that already exist. Takes the name, the credentials id, and exactly one parent: the warehouse id, the BI container id from create_bi_container for Tableau, Looker or Power BI credentials, or the ETL container id from create_etl_container for ETL tool credentials such as Fivetran or Airflow. An ETL container takes one connection, of its own type. A custom ETL or BI connector's credentials, of type custom-etl-connector- or custom-bi-connector-, go on a custom-etl-connector or custom-bi-connector container on the deployment of the agent that registered the connector. Such a container with no deployment is push-only: send no credentials id, and the connection takes the container's type. A custom warehouse connector's credentials, of type custom-connector-, go on a warehouse on that agent's deployment, usually a custom-integration one. Every other parent needs the credentials id. The connection type comes from the credentials. The connection runs through its parent's deployment, so call list_deployments and list_warehouses, list_bi_containers or list_etl_containers first and reuse a parent on the right deployment: the cloud deployment hosted by Monte Carlo, or one with a collection agent or data store registered. Create a deployment only for an agent or a data store, never one with nothing behind it. Some types need another connection on the warehouse first. A databricks-sql-warehouse connection goes on a data-lake warehouse that already has a databricks-metastore-sql-warehouse connection, so add the metastore first. Credentials that reference a store you run are created from here with create_aws_secrets_manager_credentials, create_gcp_secret_manager_credentials, create_azure_key_vault_credentials, create_env_var_credentials or create_file_credentials. Credentials whose secret has to be sent in the request, such as a Snowflake key pair, a BigQuery service account key, a database password, a Databricks token or a BI tool's password or client secret, are created with the CLI or Terraform, not from here. +Add a connection to a warehouse, a BI container or an ETL container from credentials that already exist. Takes the name, the credentials id, and exactly one parent: the warehouse id, the BI container id from create_bi_container for Tableau, Looker or Power BI credentials, or the ETL container id from create_etl_container for ETL tool credentials such as Fivetran or Airflow. An ETL container takes one connection, of its own type. A custom ETL or BI connector's credentials, of type custom-etl-connector- or custom-bi-connector-, go on a custom-etl-connector or custom-bi-connector container on the deployment of the agent that registered the connector. Such a container with no deployment is push-only: send no credentials id, and the connection takes the container's type. A custom warehouse connector's credentials, of type custom-connector-, go on a warehouse on that agent's deployment, usually a custom-integration one. dbt Cloud webhook credentials go on the existing warehouse the dbt project builds into. A webhook takes one connection. Every other parent needs the credentials id. The connection type comes from the credentials. The connection runs through its parent's deployment, so call list_deployments and list_warehouses, list_bi_containers or list_etl_containers first and reuse a parent on the right deployment: the cloud deployment hosted by Monte Carlo, or one with a collection agent or data store registered. Create a deployment only for an agent or a data store, never one with nothing behind it. Some types need another connection on the warehouse first. A databricks-sql-warehouse connection goes on a data-lake warehouse that already has a databricks-metastore-sql-warehouse connection, so add the metastore first. A glue connection is a data-lake warehouse's one main connection, so it goes on a data-lake warehouse with no main connection yet. An athena connection can go on the same warehouse. Glue and Athena credentials hold no secret and are created from here with create_glue_credentials and create_athena_credentials. Credentials that reference a store you run are created from here with create_aws_secrets_manager_credentials, create_gcp_secret_manager_credentials, create_azure_key_vault_credentials, create_env_var_credentials or create_file_credentials. Credentials whose secret has to be sent in the request, such as a Snowflake key pair, a BigQuery service account key, a database password, a Databricks token, a BI tool's password or client secret, or a dbt Cloud service token, are created with the CLI or Terraform, not from here. - **Effect:** creates; repeating it creates again. - **Pairs with:** `list_connections`, `get_connection`, `update_connection`, `delete_connection`, `list_warehouses`, `list_bi_containers`, `list_etl_containers`, `list_credentials`. @@ -82,7 +83,7 @@ Add a connection to a warehouse, a BI container or an ETL container from credent ### Response -Returns the new connection. Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time. +Returns the new connection. Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time, dbt_cloud. | Field | Description | |---|---| @@ -101,6 +102,7 @@ Returns the new connection. Response fields: id, connection_type, name, warehous | `credentials_storage_type` | Where that secret lives. Null when there are no credentials to describe. | | `job_types` | The jobs Monte Carlo runs on this connection, such as `metadata`. | | `created_time` | When the connection was created. | +| `dbt_cloud` | Which dbt Cloud runs a dbt Cloud webhook connection processes. A dbt Cloud webhook reports runs from every environment in the dbt account. These settings decide which of them Monte Carlo processes for the connection's warehouse. Null for every other connection type. | ### What can fail @@ -130,7 +132,7 @@ restrictions hide from you returns 404. ### Response -Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time. +Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time, dbt_cloud. | Field | Description | |---|---| @@ -149,6 +151,7 @@ Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_con | `credentials_storage_type` | Where that secret lives. Null when there are no credentials to describe. | | `job_types` | The jobs Monte Carlo runs on this connection, such as `metadata`. | | `created_time` | When the connection was created. | +| `dbt_cloud` | Which dbt Cloud runs a dbt Cloud webhook connection processes. A dbt Cloud webhook reports runs from every environment in the dbt account. These settings decide which of them Monte Carlo processes for the connection's warehouse. Null for every other connection type. | ### What can fail @@ -174,7 +177,7 @@ Rename a connection, or turn ETL on or off for a Snowflake, Power BI or Salesfor ### Response -Returns the connection after the change. Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time. +Returns the connection after the change. Response fields: id, connection_type, name, warehouse_id, warehouse_name, bi_container_id, bi_container_name, etl_container_id, etl_container_name, deployment_id, deployment_name, credentials_id, credentials_storage_type, job_types, created_time, dbt_cloud. | Field | Description | |---|---| @@ -193,6 +196,7 @@ Returns the connection after the change. Response fields: id, connection_type, n | `credentials_storage_type` | Where that secret lives. Null when there are no credentials to describe. | | `job_types` | The jobs Monte Carlo runs on this connection, such as `metadata`. | | `created_time` | When the connection was created. | +| `dbt_cloud` | Which dbt Cloud runs a dbt Cloud webhook connection processes. A dbt Cloud webhook reports runs from every environment in the dbt account. These settings decide which of them Monte Carlo processes for the connection's warehouse. Null for every other connection type. | ### What can fail @@ -254,7 +258,7 @@ Returns the accepted request as-is. Response fields: id, status, revision, targe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. | diff --git a/skills/onboarding/reference/api/credentials.md b/skills/onboarding/reference/api/credentials.md index 759748e..025394c 100644 --- a/skills/onboarding/reference/api/credentials.md +++ b/skills/onboarding/reference/api/credentials.md @@ -13,7 +13,7 @@ Credentials are returned oldest first. Each entry says what connection type it i where its secret lives; read the typed endpoint for that kind to see its other fields. - **Effect:** read-only. -- **Pairs with:** `create_airflow_credentials`, `get_airflow_credentials`, `get_azure_data_factory_credentials`, `get_azure_dedicated_sql_pool_credentials`, `get_azure_sql_database_credentials`, `get_bigquery_credentials`, `get_clickhouse_credentials`, `get_databricks_metastore_sql_warehouse_credentials`, `get_databricks_sql_warehouse_credentials`, `get_db2_credentials`, `get_fivetran_credentials`, `get_gcp_dataform_credentials`, `get_informatica_v2_credentials`, `get_looker_git_clone_credentials`, `get_looker_credentials`, `get_mariadb_credentials`, `get_mulesoft_credentials`, `get_mysql_credentials`, `get_oracle_credentials`, `get_postgres_credentials`, `get_power_bi_credentials`, `get_redshift_credentials`, `get_sap_hana_credentials`, `create_aws_secrets_manager_credentials`, `validate_aws_secrets_manager_credentials`, `get_aws_secrets_manager_credentials`, `create_azure_key_vault_credentials`, `validate_azure_key_vault_credentials`, `get_azure_key_vault_credentials`, `create_env_var_credentials`, `validate_env_var_credentials`, `get_env_var_credentials`, `create_file_credentials`, `validate_file_credentials`, `get_file_credentials`, `create_gcp_secret_manager_credentials`, `validate_gcp_secret_manager_credentials`, `get_gcp_secret_manager_credentials`, `get_snowflake_credentials`, `get_sql_server_credentials`, `get_starburst_enterprise_credentials`, `get_starburst_galaxy_credentials`, `get_tableau_credentials`, `get_teradata_credentials`. +- **Pairs with:** `create_airflow_credentials`, `get_airflow_credentials`, `create_athena_credentials`, `validate_athena_credentials`, `get_athena_credentials`, `validate_athena_credentials_change`, `get_azure_data_factory_credentials`, `get_azure_dedicated_sql_pool_credentials`, `get_azure_sql_database_credentials`, `get_bigquery_credentials`, `get_clickhouse_credentials`, `get_databricks_metastore_sql_warehouse_credentials`, `get_databricks_sql_warehouse_credentials`, `get_db2_credentials`, `get_dbt_cloud_webhook_credentials`, `get_fivetran_credentials`, `get_gcp_dataform_credentials`, `create_glue_credentials`, `validate_glue_credentials`, `get_glue_credentials`, `validate_glue_credentials_change`, `get_informatica_v2_credentials`, `get_looker_git_clone_credentials`, `get_looker_credentials`, `get_mariadb_credentials`, `get_mulesoft_credentials`, `get_mysql_credentials`, `get_oracle_credentials`, `get_postgres_credentials`, `get_power_bi_credentials`, `get_redshift_credentials`, `get_salesforce_crm_credentials`, `get_sap_hana_credentials`, `create_aws_secrets_manager_credentials`, `validate_aws_secrets_manager_credentials`, `get_aws_secrets_manager_credentials`, `validate_aws_secrets_manager_credentials_change`, `create_azure_key_vault_credentials`, `validate_azure_key_vault_credentials`, `get_azure_key_vault_credentials`, `validate_azure_key_vault_credentials_change`, `create_env_var_credentials`, `validate_env_var_credentials`, `get_env_var_credentials`, `validate_env_var_credentials_change`, `create_file_credentials`, `validate_file_credentials`, `get_file_credentials`, `validate_file_credentials_change`, `create_gcp_secret_manager_credentials`, `validate_gcp_secret_manager_credentials`, `get_gcp_secret_manager_credentials`, `validate_gcp_secret_manager_credentials_change`, `get_snowflake_credentials`, `get_sql_server_credentials`, `get_starburst_enterprise_credentials`, `get_starburst_galaxy_credentials`, `get_tableau_credentials`, `get_teradata_credentials`. - **Paging:** one page per call; pass `next_cursor` back as `cursor` for the next page. ### Arguments @@ -173,6 +173,252 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `create_athena_credentials`: Create Athena credentials + +Store the IAM role Monte Carlo assumes to run Athena queries, as credentials for an athena connection. Takes `assumable_role`, the ARN of a role in the customer's AWS account that the deployment assumes, plus `external_id` when the role's trust policy requires one and `aws_region`. `catalog` and `workgroup` are optional and default to AwsDataCatalog and primary. Athena needs no secret. Then call create_connection on a data-lake warehouse, usually the one with the glue connection. Refused once the account holds its limit of credentials. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `get_athena_credentials`, `update_athena_credentials`, `delete_athena_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `assumable_role` | `str` | yes | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `catalog` | `str` | no | Athena data catalog to query. Omit it to use `AwsDataCatalog`. Between 1 and 256 characters. | +| `workgroup` | `str` | no | Athena workgroup to run queries in. Omit it to use the `primary` workgroup. The role needs permission to start queries in it. Between 1 and 256 characters. | + +### Response + +Returns the new credentials. Response fields: id, connection_type, storage_type, created_time, assumable_role, external_id, aws_region, catalog, workgroup. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `assumable_role` | ARN of the IAM role in your AWS account that the deployment assumes. Null unless set. | +| `external_id` | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Null unless set. | +| `aws_region` | AWS region to call. Null means the deployment's own region. | +| `catalog` | Athena data catalog to query. Null means `AwsDataCatalog`. | +| `workgroup` | Athena workgroup to run queries in. Null means the `primary` workgroup. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + +## `validate_athena_credentials`: Validate Athena credentials + +Check candidate Athena credentials from a deployment before creating them. Takes the create_athena_credentials fields and a `deployment_id` from list_deployments. Creates nothing. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `assumable_role` | `str` | yes | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `catalog` | `str` | no | Athena data catalog to query. Omit it to use `AwsDataCatalog`. Between 1 and 256 characters. | +| `workgroup` | `str` | no | Athena workgroup to run queries in. Omit it to use the `primary` workgroup. The role needs permission to start queries in it. Between 1 and 256 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + +## `get_athena_credentials`: Get Athena credentials + +Get one set of Athena credentials. + +An id that does not exist, belongs to another account, or names credentials of another +kind returns 404. + +- **Effect:** read-only. +- **Pairs with:** `create_athena_credentials`, `update_athena_credentials`, `delete_athena_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Response fields: id, connection_type, storage_type, created_time, assumable_role, external_id, aws_region, catalog, workgroup. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `assumable_role` | ARN of the IAM role in your AWS account that the deployment assumes. Null unless set. | +| `external_id` | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Null unless set. | +| `aws_region` | AWS region to call. Null means the deployment's own region. | +| `catalog` | Athena data catalog to query. Null means `AwsDataCatalog`. | +| `workgroup` | Athena workgroup to run queries in. Null means the `primary` workgroup. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- An unexpected error prevented the request from being processed. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. + +## `update_athena_credentials`: Update Athena credentials + +Change Athena credentials. Every connection using them picks up the change. A field set to null is cleared, except `assumable_role`, which cannot be. An empty body returns them unchanged. + +- **Effect:** updates in place; idempotent. +- **Pairs with:** `create_athena_credentials`, `get_athena_credentials`, `delete_athena_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `assumable_role` | `str` | no | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `catalog` | `str` | no | Athena data catalog to query. Omit it to use `AwsDataCatalog`. Between 1 and 256 characters. | +| `workgroup` | `str` | no | Athena workgroup to run queries in. Omit it to use the `primary` workgroup. The role needs permission to start queries in it. Between 1 and 256 characters. | + +### Response + +Returns the credentials after the change. Response fields: id, connection_type, storage_type, created_time, assumable_role, external_id, aws_region, catalog, workgroup. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `assumable_role` | ARN of the IAM role in your AWS account that the deployment assumes. Null unless set. | +| `external_id` | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Null unless set. | +| `aws_region` | AWS region to call. Null means the deployment's own region. | +| `catalog` | Athena data catalog to query. Null means `AwsDataCatalog`. | +| `workgroup` | Athena workgroup to run queries in. Null means the `primary` workgroup. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + +## `delete_athena_credentials`: Delete Athena credentials + +Delete Athena credentials no connection uses. + +- **Effect:** deletes; destructive and idempotent. +- **Pairs with:** `create_athena_credentials`, `get_athena_credentials`, `update_athena_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Returns `credentials_id` and `deleted: true` once the credentials is gone. + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. +- An unexpected error prevented the request from being processed. + +## `validate_athena_credentials_change`: Validate a change to Athena credentials + +Check a change to Athena credentials from a deployment before making it. Takes the update_athena_credentials fields and a `deployment_id`. Changes nothing. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `assumable_role` | `str` | no | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `catalog` | `str` | no | Athena data catalog to query. Omit it to use `AwsDataCatalog`. Between 1 and 256 characters. | +| `workgroup` | `str` | no | Athena workgroup to run queries in. Omit it to use the `primary` workgroup. The role needs permission to start queries in it. Between 1 and 256 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `get_azure_data_factory_credentials`: Get Azure Data Factory credentials Get one set of Azure Data Factory credentials, without the client secret. @@ -698,6 +944,71 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `get_dbt_cloud_webhook_credentials`: Get dbt Cloud webhook credentials + +Get one set of dbt Cloud webhook credentials, without the service token and the HMAC +secret. + +An id that does not exist, belongs to another account, or names credentials of another kind +returns 404. + +- **Effect:** read-only. +- **Pairs with:** `delete_dbt_cloud_webhook_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Response fields: id, connection_type, storage_type, created_time, account_id, webhook_id, base_url. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `account_id` | Your dbt Cloud account id, the number in the account's URLs. | +| `webhook_id` | Id of the dbt Cloud webhook that sends job.run.completed events to Monte Carlo. | +| `base_url` | Your dbt Cloud access URL followed by /api/v2. Null means https://cloud.getdbt.com/api/v2. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- An unexpected error prevented the request from being processed. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. + +## `delete_dbt_cloud_webhook_credentials`: Delete dbt Cloud webhook credentials + +Delete dbt Cloud webhook credentials no connection uses. Monte Carlo stops using the stored service token and HMAC secret. Delete the token and the webhook in dbt Cloud if they must be retired. + +- **Effect:** deletes; destructive and idempotent. +- **Pairs with:** `get_dbt_cloud_webhook_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Returns `credentials_id` and `deleted: true` once the credentials is gone. + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. +- An unexpected error prevented the request from being processed. + ## `get_fivetran_credentials`: Get Fivetran credentials Get one set of Fivetran credentials, without the API key and its secret. @@ -824,6 +1135,245 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `create_glue_credentials`: Create Glue credentials + +Store the IAM role Monte Carlo assumes to read a Glue catalog, as credentials for a glue connection. Takes `assumable_role`, the ARN of a role in the customer's AWS account that the deployment assumes, plus `external_id` when the role's trust policy requires one and `aws_region`. `ssl_ca_data` is optional. Glue needs no secret. Then call create_connection on a data-lake warehouse with no main connection yet. Refused once the account holds its limit of credentials. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `get_glue_credentials`, `update_glue_credentials`, `delete_glue_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `assumable_role` | `str` | yes | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `ssl_ca_data` | `str` | no | PEM text of a CA certificate to check the AWS endpoint's certificate against. Between 1 and 65536 characters. | + +### Response + +Returns the new credentials. Response fields: id, connection_type, storage_type, created_time, assumable_role, external_id, aws_region, ssl_ca_data. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `assumable_role` | ARN of the IAM role in your AWS account that the deployment assumes. Null unless set. | +| `external_id` | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Null unless set. | +| `aws_region` | AWS region to call. Null means the deployment's own region. | +| `ssl_ca_data` | PEM text of a CA certificate to check the AWS endpoint's certificate against. Null unless set. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + +## `validate_glue_credentials`: Validate Glue credentials + +Check candidate Glue credentials from a deployment before creating them. Takes the create_glue_credentials fields and a `deployment_id` from list_deployments. Creates nothing. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `assumable_role` | `str` | yes | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `ssl_ca_data` | `str` | no | PEM text of a CA certificate to check the AWS endpoint's certificate against. Between 1 and 65536 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + +## `get_glue_credentials`: Get Glue credentials + +Get one set of Glue credentials. + +An id that does not exist, belongs to another account, or names credentials of another +kind returns 404. + +- **Effect:** read-only. +- **Pairs with:** `create_glue_credentials`, `update_glue_credentials`, `delete_glue_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Response fields: id, connection_type, storage_type, created_time, assumable_role, external_id, aws_region, ssl_ca_data. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `assumable_role` | ARN of the IAM role in your AWS account that the deployment assumes. Null unless set. | +| `external_id` | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Null unless set. | +| `aws_region` | AWS region to call. Null means the deployment's own region. | +| `ssl_ca_data` | PEM text of a CA certificate to check the AWS endpoint's certificate against. Null unless set. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- An unexpected error prevented the request from being processed. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. + +## `update_glue_credentials`: Update Glue credentials + +Change Glue credentials. Every connection using them picks up the change. A field set to null is cleared, except `assumable_role`, which cannot be. An empty body returns them unchanged. + +- **Effect:** updates in place; idempotent. +- **Pairs with:** `create_glue_credentials`, `get_glue_credentials`, `delete_glue_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `assumable_role` | `str` | no | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `ssl_ca_data` | `str` | no | PEM text of a CA certificate to check the AWS endpoint's certificate against. Between 1 and 65536 characters. | + +### Response + +Returns the credentials after the change. Response fields: id, connection_type, storage_type, created_time, assumable_role, external_id, aws_region, ssl_ca_data. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `assumable_role` | ARN of the IAM role in your AWS account that the deployment assumes. Null unless set. | +| `external_id` | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Null unless set. | +| `aws_region` | AWS region to call. Null means the deployment's own region. | +| `ssl_ca_data` | PEM text of a CA certificate to check the AWS endpoint's certificate against. Null unless set. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + +## `delete_glue_credentials`: Delete Glue credentials + +Delete Glue credentials no connection uses. + +- **Effect:** deletes; destructive and idempotent. +- **Pairs with:** `create_glue_credentials`, `get_glue_credentials`, `update_glue_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Returns `credentials_id` and `deleted: true` once the credentials is gone. + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. +- An unexpected error prevented the request from being processed. + +## `validate_glue_credentials_change`: Validate a change to Glue credentials + +Check a change to Glue credentials from a deployment before making it. Takes the update_glue_credentials fields and a `deployment_id`. Changes nothing. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `assumable_role` | `str` | no | ARN of the IAM role in your AWS account that the deployment assumes. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id your role's trust policy requires, if it requires one. It is not the deployment's `aws_external_id`. Between 1 and 1224 characters. | +| `aws_region` | `str` | no | AWS region to call. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `ssl_ca_data` | `str` | no | PEM text of a CA certificate to check the AWS endpoint's certificate against. Between 1 and 65536 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `get_informatica_v2_credentials`: Get Informatica credentials Get one set of Informatica credentials, without the passwords and the client secret. @@ -1402,18 +1952,88 @@ Response fields: id, connection_type, storage_type, created_time, tenant_id, app - An unexpected error prevented the request from being processed. - Monte Carlo is busy or temporarily unavailable; try again after a moment. -## `delete_power_bi_credentials`: Delete Power BI credentials +## `delete_power_bi_credentials`: Delete Power BI credentials + +Delete Power BI credentials no connection uses. Monte Carlo stops using the stored client secret or password. Rotate it in Microsoft Entra ID if it must be retired. + +- **Effect:** deletes; destructive and idempotent. +- **Pairs with:** `get_power_bi_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned by list_credentials. | + +### Response + +Returns `credentials_id` and `deleted: true` once the credentials is gone. + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. +- An unexpected error prevented the request from being processed. + +## `get_redshift_credentials`: Get Redshift credentials + +Get one set of Redshift credentials, without the password. + +An id that does not exist, belongs to another account, or names credentials of another +kind returns 404. + +- **Effect:** read-only. +- **Pairs with:** `delete_redshift_credentials`, `list_credentials`. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | + +### Response + +Response fields: id, connection_type, storage_type, created_time, host, port, db_name, user, ssl_ca_data, ssl_disabled, ssl_verify_cert, ssl_verify_identity, ssl_skip_cert_verification. + +| Field | Description | +|---|---| +| `id` | Unique identifier of the credentials. | +| `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | +| `storage_type` | Where the secret lives. Fixed once created. | +| `created_time` | When the credentials were created. | +| `host` | Hostname of the database endpoint. | +| `port` | Port the database listens on. | +| `db_name` | Redshift database to connect to. | +| `user` | Database user Monte Carlo logs in as. | +| `ssl_ca_data` | PEM text of the CA certificate the server's certificate is checked against. Null when none is set. | +| `ssl_disabled` | Connect without TLS. Null when unset. | +| `ssl_verify_cert` | Check the server's certificate against the CA. Null when unset. | +| `ssl_verify_identity` | Check the certificate and that it names the host. Null when unset. | +| `ssl_skip_cert_verification` | Encrypt the connection without checking the server's certificate. Null when unset. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- An unexpected error prevented the request from being processed. +- Monte Carlo is busy or temporarily unavailable; try again after a moment. + +## `delete_redshift_credentials`: Delete Redshift credentials -Delete Power BI credentials no connection uses. Monte Carlo stops using the stored client secret or password. Rotate it in Microsoft Entra ID if it must be retired. +Delete Redshift credentials no connection uses. Monte Carlo stops using the stored password. Change the password in Redshift if the password itself must be retired. - **Effect:** deletes; destructive and idempotent. -- **Pairs with:** `get_power_bi_credentials`, `list_credentials`. +- **Pairs with:** `get_redshift_credentials`, `list_credentials`. ### Arguments | Argument | Type | Required | Description | |---|---|---|---| -| `credentials_id` | `str` | yes | Id of the credentials, as returned by list_credentials. | +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | ### Response @@ -1428,15 +2048,16 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. -## `get_redshift_credentials`: Get Redshift credentials +## `get_salesforce_crm_credentials`: Get Salesforce CRM credentials -Get one set of Redshift credentials, without the password. +Get one set of Salesforce CRM credentials, without the password, the security token or +the consumer secret. An id that does not exist, belongs to another account, or names credentials of another kind returns 404. - **Effect:** read-only. -- **Pairs with:** `delete_redshift_credentials`, `list_credentials`. +- **Pairs with:** `delete_salesforce_crm_credentials`, `list_credentials`. ### Arguments @@ -1446,7 +2067,7 @@ kind returns 404. ### Response -Response fields: id, connection_type, storage_type, created_time, host, port, db_name, user, ssl_ca_data, ssl_disabled, ssl_verify_cert, ssl_verify_identity, ssl_skip_cert_verification. +Response fields: id, connection_type, storage_type, created_time, auth_mode, username, consumer_key, domain. | Field | Description | |---|---| @@ -1454,15 +2075,10 @@ Response fields: id, connection_type, storage_type, created_time, host, port, db | `connection_type` | The connection type the credentials are for, such as `snowflake`. Fixed once created. | | `storage_type` | Where the secret lives. Fixed once created. | | `created_time` | When the credentials were created. | -| `host` | Hostname of the database endpoint. | -| `port` | Port the database listens on. | -| `db_name` | Redshift database to connect to. | -| `user` | Database user Monte Carlo logs in as. | -| `ssl_ca_data` | PEM text of the CA certificate the server's certificate is checked against. Null when none is set. | -| `ssl_disabled` | Connect without TLS. Null when unset. | -| `ssl_verify_cert` | Check the server's certificate against the CA. Null when unset. | -| `ssl_verify_identity` | Check the certificate and that it names the host. Null when unset. | -| `ssl_skip_cert_verification` | Encrypt the connection without checking the server's certificate. Null when unset. | +| `auth_mode` | How Monte Carlo signs in. `password` takes `username`, `password` and `security_token`. `oauth_client_credentials` takes `consumer_key`, `consumer_secret` and `domain`. | +| `username` | Salesforce user Monte Carlo signs in as, for `password`. | +| `consumer_key` | Consumer key of the connected app Monte Carlo signs in as, for `oauth_client_credentials`. | +| `domain` | My Domain of your org, such as `acme.my.salesforce.com`, for `oauth_client_credentials`. The `.salesforce.com` suffix is optional. | ### What can fail @@ -1472,12 +2088,12 @@ Response fields: id, connection_type, storage_type, created_time, host, port, db - An unexpected error prevented the request from being processed. - Monte Carlo is busy or temporarily unavailable; try again after a moment. -## `delete_redshift_credentials`: Delete Redshift credentials +## `delete_salesforce_crm_credentials`: Delete Salesforce CRM credentials -Delete Redshift credentials no connection uses. Monte Carlo stops using the stored password. Change the password in Redshift if the password itself must be retired. +Delete Salesforce CRM credentials no connection uses. Monte Carlo stops using the stored password, security token or consumer secret. Reset them in Salesforce if they must be retired. - **Effect:** deletes; destructive and idempotent. -- **Pairs with:** `get_redshift_credentials`, `list_credentials`. +- **Pairs with:** `get_salesforce_crm_credentials`, `list_credentials`. ### Arguments @@ -1639,7 +2255,7 @@ Returns the accepted request as-is. Response fields: id, status, revision, targe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. | @@ -1769,6 +2385,55 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `validate_aws_secrets_manager_credentials_change`: Validate a change to AWS Secrets Manager credentials + +Check whether a change to existing AWS Secrets Manager credentials works before making it. Takes only the fields to change, as the update does, and a deployment to run from. The stored credentials are not changed. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `bq_project_id` | `str` | no | BigQuery project the connection reads from. Only for a BigQuery connection. Between 1 and 200 characters. | +| `sql_warehouse_id` | `str` | no | Databricks SQL warehouse the connection runs queries on. Required for a `databricks-sql-warehouse` or `databricks-metastore-sql-warehouse` connection. Between 1 and 200 characters. | +| `aws_secret` | `str` | no | Name or ARN of the AWS Secrets Manager secret holding the connection's credentials. Between 1 and 2048 characters. | +| `aws_region` | `str` | no | AWS region of the secret. Omit it to use the deployment's own region. Between 1 and 200 characters. | +| `assumable_role` | `str` | no | ARN of a role the deployment assumes to read the secret. Omit it to read as itself. Between 1 and 2048 characters. | +| `external_id` | `str` | no | External id the assumed role's trust policy requires, if it requires one. Between 1 and 1224 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `create_azure_key_vault_credentials`: Create Azure Key Vault credentials Store where a connection's credentials live in Azure Key Vault: the vault and the secret's name, never the secret itself. @@ -1842,7 +2507,7 @@ Returns the accepted request as-is. Response fields: id, status, revision, targe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. | @@ -1969,6 +2634,54 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `validate_azure_key_vault_credentials_change`: Validate a change to Azure Key Vault credentials + +Check whether a change to existing Azure Key Vault credentials works before making it. Takes only the fields to change, as the update does, and a deployment to run from. The stored credentials are not changed. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `bq_project_id` | `str` | no | BigQuery project the connection reads from. Only for a BigQuery connection. Between 1 and 200 characters. | +| `sql_warehouse_id` | `str` | no | Databricks SQL warehouse the connection runs queries on. Required for a `databricks-sql-warehouse` or `databricks-metastore-sql-warehouse` connection. Between 1 and 200 characters. | +| `akv_secret` | `str` | no | Name of the Azure Key Vault secret holding the connection's credentials. Between 1 and 200 characters. | +| `akv_vault_name` | `str` | no | Name of the key vault. Send this, `akv_vault_url`, or both. Between 1 and 200 characters. | +| `akv_vault_url` | `str` | no | URL of the key vault. Send this, `akv_vault_name`, or both. Between 1 and 2048 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `create_env_var_credentials`: Create environment variable credentials Store which environment variable of the deployment holds a connection's credentials, and the KMS key that encrypts it, never the value itself. @@ -2039,7 +2752,7 @@ Returns the accepted request as-is. Response fields: id, status, revision, targe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. | @@ -2163,6 +2876,53 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `validate_env_var_credentials_change`: Validate a change to environment variable credentials + +Check whether a change to existing environment variable credentials works before making it. Takes only the fields to change, as the update does, and a deployment to run from. The stored credentials are not changed. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `bq_project_id` | `str` | no | BigQuery project the connection reads from. Only for a BigQuery connection. Between 1 and 200 characters. | +| `sql_warehouse_id` | `str` | no | Databricks SQL warehouse the connection runs queries on. Required for a `databricks-sql-warehouse` or `databricks-metastore-sql-warehouse` connection. Between 1 and 200 characters. | +| `env_var_name` | `str` | no | Name of the environment variable on the deployment that holds the connection's credentials. Must start with `MCD_`. Between 1 and 200 characters. | +| `kms_key_id` | `str` | no | AWS KMS key the variable's value is encrypted with. Omit it for a value stored in the clear. Between 1 and 200 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `create_file_credentials`: Create file credentials Store which file on the deployment holds a connection's credentials, never the contents. @@ -2230,7 +2990,7 @@ Returns the accepted request as-is. Response fields: id, status, revision, targe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. | @@ -2351,6 +3111,52 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `validate_file_credentials_change`: Validate a change to file credentials + +Check whether a change to existing file credentials works before making it. Takes only the fields to change, as the update does, and a deployment to run from. The stored credentials are not changed. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `bq_project_id` | `str` | no | BigQuery project the connection reads from. Only for a BigQuery connection. Between 1 and 200 characters. | +| `sql_warehouse_id` | `str` | no | Databricks SQL warehouse the connection runs queries on. Required for a `databricks-sql-warehouse` or `databricks-metastore-sql-warehouse` connection. Between 1 and 200 characters. | +| `file_path` | `str` | no | Path of the file on the deployment that holds the connection's credentials. Between 1 and 1024 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `create_gcp_secret_manager_credentials`: Create GCP Secret Manager credentials Store where a connection's credentials live in GCP Secret Manager: the secret's name, never the secret itself. @@ -2418,7 +3224,7 @@ Returns the accepted request as-is. Response fields: id, status, revision, targe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. | @@ -2539,6 +3345,52 @@ Returns `credentials_id` and `deleted: true` once the credentials is gone. - Monte Carlo is busy or temporarily unavailable; try again after a moment. - An unexpected error prevented the request from being processed. +## `validate_gcp_secret_manager_credentials_change`: Validate a change to GCP Secret Manager credentials + +Check whether a change to existing GCP Secret Manager credentials works before making it. Takes only the fields to change, as the update does, and a deployment to run from. The stored credentials are not changed. Returns a run that is still going: poll `get_validation_run` with its id until the status is `completed`, then read each validation's own verdict. + +- **Effect:** creates; repeating it creates again. +- **Pairs with:** `list_credentials`, `list_deployments`. +- **Runs in the background:** the response is the accepted request; poll it to completion. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `credentials_id` | `str` | yes | Id of the credentials, as returned when they are created or listed. | +| `deployment_id` | `str` | yes | Deployment that runs the validations. It has to be one `GET /deployments` lists, and it has to be able to reach the system the credentials are for. | +| `bq_project_id` | `str` | no | BigQuery project the connection reads from. Only for a BigQuery connection. Between 1 and 200 characters. | +| `sql_warehouse_id` | `str` | no | Databricks SQL warehouse the connection runs queries on. Required for a `databricks-sql-warehouse` or `databricks-metastore-sql-warehouse` connection. Between 1 and 200 characters. | +| `gcp_secret` | `str` | no | Name of the GCP Secret Manager secret holding the connection's credentials. Between 1 and 200 characters. | + +### Response + +Returns the accepted request as-is. Response fields: id, status, revision, target_type, target_id, validations_passed, validations_total, started_at, finished_at, expires_at, validations. + +| Field | Description | +|---|---| +| `id` | Identifier of the run. Poll `GET /validations/{run_id}` with it. | +| `status` | Whether the run is still going. Every validation is final once it is not. | +| `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | +| `target_type` | What the run validates. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | +| `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | +| `validations_total` | How many validations the run covers. | +| `started_at` | When the run started. | +| `finished_at` | When the run finished. Null while it is still going. | +| `expires_at` | When the run stops being readable. Measured from the start, not the finish, and never extended, so a slow run is readable for less time after it ends. | +| `validations` | The run's validations, in the order they are declared. A validation stays `pending` until it starts. It can wait on a prerequisite, or for earlier validations to finish. A read with `since` lists only the validations that changed after that revision, and may list none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The credentials does not exist, or is not visible to the caller. +- The change conflicts with the current state of the credentials. +- An argument is invalid; the error names the field. +- Monte Carlo is busy or temporarily unavailable; the tool retries once after the wait Monte Carlo asks for. +- An unexpected error prevented the request from being processed. + ## `get_snowflake_credentials`: Get Snowflake credentials Get one set of Snowflake credentials, without the key. diff --git a/skills/onboarding/reference/api/hosting.md b/skills/onboarding/reference/api/hosting.md new file mode 100644 index 0000000..0d56e86 --- /dev/null +++ b/skills/onboarding/reference/api/hosting.md @@ -0,0 +1,105 @@ +# `hosting` tools + + + +Monte Carlo REST API v2 tools of the `hosting` tag, as the Monte Carlo MCP server exposes +them. Each section is one tool; its name is the tool to call. + +## `get_hosting_domains`: Get the hosting domains + +Get the URLs your Monte Carlo instance serves. + +Some integrations need one of these URLs before they can be set up. dbt Cloud, for +example, issues a webhook secret only after you give it `dbt_cloud_webhook_url`. + +Every caller in an instance gets the same values. + +- **Effect:** read-only. + +### Arguments + +None. + +### Response + +Response fields: ui_url, integrations_url, graphql_api_url, graphql_oauth_api_url, m2m_token_url, m2m_instance_scope, dbt_cloud_webhook_url. + +| Field | Description | +|---|---| +| `ui_url` | URL of the Monte Carlo web app. | +| `integrations_url` | Base URL of the integrations gateway, which receives webhooks and other inbound requests from the tools you connect. | +| `graphql_api_url` | URL of the GraphQL API, for API keys. | +| `graphql_oauth_api_url` | URL of the GraphQL API, for OAuth clients. | +| `m2m_token_url` | URL an OAuth client requests an access token from, with the client-credentials grant. Null when the instance does not support OAuth clients. | +| `m2m_instance_scope` | Scope an OAuth client requests for its token to reach this instance. Null when the instance does not support OAuth clients. | +| `dbt_cloud_webhook_url` | URL to give dbt Cloud when you create the webhook that reports job runs to Monte Carlo. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- An unexpected error prevented the request from being processed. + +## `get_hosting_network`: Get the hosting network + +Get the public IP addresses one region of your Monte Carlo instance connects from. + +Allowlist them where Monte Carlo reaches your resources over the internet. Asking for the +secondary region of an instance without disaster recovery returns 404. + +- **Effect:** read-only. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `instance_region` | one of `primary`, `secondary` | no | The region of your Monte Carlo instance to read. `primary`, the default, is the region serving your instance, which is the recovery region during a failover. `secondary` is the disaster recovery region, and only an instance with disaster recovery has one. With disaster recovery, read both and allow both, so access keeps working after a failover. During a failover both read the recovery region, so applying your policies then drops the original primary region until you apply them again after failing back. | + +### Response + +Response fields: collection_ip_addresses, saas_ip_addresses, webhook_ip_addresses, data_platform_ip_addresses. + +| Field | Description | +|---|---| +| `collection_ip_addresses` | Addresses Monte Carlo collects from, such as when it reaches your warehouse, collection agent or data store over the internet. | +| `saas_ip_addresses` | Addresses the rest of the Monte Carlo platform connects from. | +| `webhook_ip_addresses` | Addresses Monte Carlo sends webhook notifications from. | +| `data_platform_ip_addresses` | Addresses Monte Carlo's data processing services connect from. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The hosting does not exist, or is not visible to the caller. +- An unexpected error prevented the request from being processed. + +## `get_hosting_private_link`: Get the hosting private link details + +Get how one region of your Monte Carlo instance reaches your AWS resources privately. + +Use the VPC endpoint of the region you deploy to in an `aws:SourceVpce` condition, and the +private subnet CIDRs in an allowlist. Asking for the secondary region of an instance +without disaster recovery returns 404. + +- **Effect:** read-only. + +### Arguments + +| Argument | Type | Required | Description | +|---|---|---|---| +| `instance_region` | one of `primary`, `secondary` | no | The region of your Monte Carlo instance to read. `primary`, the default, is the region serving your instance, which is the recovery region during a failover. `secondary` is the disaster recovery region, and only an instance with disaster recovery has one. With disaster recovery, read both and allow both, so access keeps working after a failover. During a failover both read the recovery region, so applying your policies then drops the original primary region until you apply them again after failing back. | + +### Response + +Response fields: aws. + +| Field | Description | +|---|---| +| `aws` | AWS private connectivity. Null when the region has none. | + +### What can fail + +- Authentication credentials are missing or invalid. +- The request was authenticated, but the caller is not allowed to perform this operation. Read `code` to tell the reasons apart: `account_frozen` means the account is paused, rather than that the caller lacks permission. +- The hosting does not exist, or is not visible to the caller. +- An unexpected error prevented the request from being processed. diff --git a/skills/onboarding/reference/api/validations.md b/skills/onboarding/reference/api/validations.md index 7a1557b..d58a6c7 100644 --- a/skills/onboarding/reference/api/validations.md +++ b/skills/onboarding/reference/api/validations.md @@ -39,7 +39,7 @@ Response fields: id, status, revision, target_type, target_id, validations_passe | `status` | Whether the run is still going. Every validation is final once it is not. | | `revision` | Moves forward every time a validation changes. Pass it as `since` on the next poll to get only the validations that changed after this response. | | `target_type` | What the run validates. | -| `target_id` | Identifier of what is being validated. Null for candidate values, which are not stored anywhere. | +| `target_id` | Identifier of what is being validated: the connection, or the credentials a change applies to. Null for candidate values, which are not stored anywhere. | | `validations_passed` | How many validations reached a passing verdict. One that was skipped or never reached a verdict is not counted here, but is still in `validations_total`. | | `validations_total` | How many validations the run covers. | | `started_at` | When the run started. |