> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.sigmacomputing.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server.

# Get an API credential

GET https://api.sigmacomputing.com/v2/api-credentials/{apiCredentialId}

This endpoint returns nonsensitive details for a single API credential. For more information on API credentials, see [Configure API credentials and connectors in Sigma](https://help.sigmacomputing.com/docs/configure-api-credentials-and-connectors-in-sigma).

### Usage notes
- The user making this request must be assigned an account type with the **Manage API connectors** permission enabled and have at least **Can view** access on the credential.
- Retrieve the **apiCredentialId** by calling the [/v2/api-credentials](https://help.sigmacomputing.com/reference/list-api-credentials) endpoint.
- Secret fields (passwords, tokens, client secrets, secret access keys) are never returned.

### Usage scenarios
- **Credential inspection:** Retrieve the configuration of a credential to verify its settings before using it with a connector.

Reference: https://help.sigmacomputing.com/reference/get-api-credential

## Authentication

- OAuth2 — send the obtained token as `Authorization: Bearer <token>`

## Servers

- `https://api.sigmacomputing.com` (Server for GCP (US) hosted organizations, default)
- `https://api.sa.gcp.sigmacomputing.com` (Server for GCP (KSA) hosted organizations)
- `https://aws-api.sigmacomputing.com` (Server for AWS US (West) hosted organizations)
- `https://api.us-a.aws.sigmacomputing.com` (Server for AWS US (East) hosted organizations)
- `https://api.ca.aws.sigmacomputing.com` (Server for AWS Canada hosted organizations)
- `https://api.eu.aws.sigmacomputing.com` (Server for AWS Europe hosted organizations)
- `https://api.au.aws.sigmacomputing.com` (Server for AWS Australia and APAC hosted organizations)
- `https://api.uk.aws.sigmacomputing.com` (Server for AWS UK hosted organizations)
- `https://api.us.azure.sigmacomputing.com` (Server for Azure US hosted organizations)
- `https://api.eu.azure.sigmacomputing.com` (Server for Azure Europe hosted organizations)
- `https://api.ca.azure.sigmacomputing.com` (Server for Azure Canada hosted organizations)
- `https://api.uk.azure.sigmacomputing.com` (Server for Azure United Kingdom hosted organizations)
- `https://api.au.azure.sigmacomputing.com` (Server for Azure Australia hosted organizations)

## Request

### Path parameters

- `apiCredentialId` (string, required)

## Response

### 200

The response body.

- `apiCredentialId` (string, required) — Unique identifier of the API credential.
- `name` (string, required) — Display name of the credential.
- `authMethod` (enum, required) — Authentication method the credential uses.
  - Allowed values: `basic`, `bearer`, `apiKey`, `oAuthClientCredentials`, `oAuthAuthorizationCode`, `oAuthPasswordCredentials`, `awsSigV4`
- `allowlist` (list of string, required) — Hostname glob patterns (e.g. `*.example.com`) that the credential is authorized to be used against.
- `credential` (object or object or object or object or object or object or object, required) — Nonsensitive projection of the credential, discriminated by `authMethod`. Secret fields (password, token, clientSecret, secretAccessKey) are never returned.
  - Basic
    - `authMethod` (enum, required)
      - Allowed values: `basic`
    - `basic` (object, optional)
      - `username` (string, required) — Username for Basic authentication.
  - Bearer
    - `authMethod` (enum, required)
      - Allowed values: `bearer`
  - API key
    - `authMethod` (enum, required)
      - Allowed values: `apiKey`
    - `apiKey` (object, optional)
      - `key` (string, required) — Header or query parameter name carrying the API key.
      - `isQueryParam` (boolean, required) — Whether the key is sent as a query parameter; if false, it is sent as a header.
  - OAuth client credentials
    - `authMethod` (enum, required)
      - Allowed values: `oAuthClientCredentials`
    - `oAuthClientCredentials` (object, optional)
      - `clientId` (string, required) — OAuth client ID.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes requested at token exchange.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
  - OAuth authorization code
    - `authMethod` (enum, required)
      - Allowed values: `oAuthAuthorizationCode`
    - `oAuthAuthorizationCode` (object, optional)
      - `clientId` (string, required) — OAuth client ID.
      - `authorizationUrl` (string, required) — OAuth authorization endpoint URL.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
  - OAuth password credentials
    - `authMethod` (enum, required)
      - Allowed values: `oAuthPasswordCredentials`
    - `oAuthPasswordCredentials` (object, optional)
      - `username` (string, required) — OAuth resource-owner username.
      - `accessTokenUrl` (string, required) — OAuth token endpoint URL.
      - `scopes` (list of string, required) — OAuth scopes.
      - `accessTokenAuthMethod` (enum, required) — How client credentials are presented to the token endpoint.
        - Allowed values: `httpBasic`, `requestBody`
      - `clientId` (string, optional) — OAuth client ID.
  - AWS SigV4
    - `authMethod` (enum, required)
      - Allowed values: `awsSigV4`
    - `awsSigV4` (object, optional)
      - `accessKeyId` (string, required) — AWS access key ID.
      - `region` (string, optional) — AWS region for SigV4 signing.
      - `service` (string, optional) — AWS service name for SigV4 signing (e.g. `s3`, `execute-api`).
      - `temporaryCredentialsUrl` (string, optional) — URL that vends temporary credentials (e.g. STS AssumeRole endpoint).
      - `temporaryCredentialsResponseMapping` (object, optional)
        - `accessKeyField` (string, optional)
        - `secretKeyField` (string, optional)
        - `sessionTokenField` (string, optional)
        - `expirationField` (string, optional)
      - `temporaryCredentialsRequestParams` (list of object, optional) — Additional parameters sent on the temporary-credentials swap request, each tagged with `sendIn` (`header` | `body` | `queryParam`).
        - `key` (string, required)
        - `value` (string, required)
        - `sendIn` (enum, required)
          - Allowed values: `queryParam`, `body`, `header`
- `createdBy` (string, required) — The identifier of the user who created this object.
- `updatedBy` (string, required) — The identifier of the user or process that last updated this object.
- `createdAt` (datetime, required) — When the object was created.
- `updatedAt` (datetime, required) — When the object was last updated.
- `description` (string, optional) — Human-readable description.

## Examples

**Response**

```json
{
  "apiCredentialId": "string",
  "name": "string",
  "authMethod": "basic",
  "allowlist": [
    "string"
  ],
  "credential": {
    "authMethod": "basic",
    "basic": {
      "username": "string"
    }
  },
  "createdBy": "string",
  "updatedBy": "string",
  "createdAt": "2024-01-15T09:30:00Z",
  "updatedAt": "2024-01-15T09:30:00Z",
  "description": "string"
}
```

**SDK Code**

```python
import requests

url = "https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId"

headers = {"Authorization": "<token>."}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId';
const options = {method: 'GET', headers: {Authorization: '<token>.'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<token>.")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<token>.'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId")
  .header("Authorization", "<token>.")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId', [
  'headers' => [
    'Authorization' => '<token>.',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "<token>.");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["Authorization": "<token>."]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.sigmacomputing.com/v2/api-credentials/apiCredentialId")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```