Credential Input

Credential input.
Root XML tag
<credential>
JSON example for creating a credential (POST)
1{
2externalCredential: "ecNameAws",
3authenticationProtocol: "AwsSv4",
4principalName: "principalA",
5principalType: "NamedPrincipal",
6credentials: {
7   awsAccessKeyId: {
8      value: "00000000000",
9      encrypted: false
10   },
11   awsSecretAccessKey: {
12      value: "aws-secret-value",
13      encrypted: true
14   },
15   awsRoleArn: {
16      value: "arn:partition:service:region:account-id:resource-id",
17      encrypted: false
18   }
19}
20}
JSON example for replacing a credential (PUT)
In this example. assume the credential has two values: apiKey and apiSecret. When this request body is used with PUT, apiKey is updated and apiSecret is deleted.
1{
2   authenticationProtocol: String : "Custom",
3   externalCredential: String : "medicalIntegrationExternalCredential",
4   principalName: String : "customerSupportGroup", 
5   principalType: String : "NamedPrincipal",
6   // Map<String, ConnectApi.CredentialValue>
7   credentials: { 
8       apiKey: { 
9           value: String : "00000000",
10           encrypted: Boolean : false
11       }
12   }
13}
JSON example for updating a custom credential (PATCH)
PATCH is supported only for custom credentials. Only the credentials included in the request body are updated. In this example. assume the credential has two values: apiKey and apiSecret. When this request body is used with PATCH, apiKey is updated and apiSecret remains the same.
1{
2   authenticationProtocol: String : "Custom",
3   externalCredential: String : "medicalIntegrationExternalCredential",
4   principalName: String : "customerSupportGroup", 
5   principalType: String : "NamedPrincipal",
6   // Map<String, ConnectApi.CredentialValue>
7   credentials: { 
8       apiKey: { 
9           value: String : "00000000",
10           encrypted: Boolean : false
11       }
12   }
13}
Properties
Name Type Description Required or Optional Available Version
authentication​Protocol String Authentication protocol of the external credential. Values are:
  • AwsSv4
  • Basic
  • Custom
  • Jwt
  • OAuth
Required 56.0
authentication​ProtocolVariant String Authentication protocol variant of the external credential. Values are:
  • AwsSv4_STS—AWS Signature Version 4 with Security Token Service.
  • ClientCredentialsClientSecret—OAuth 2.0 Client Credentials client secret. Client secrets are sent in the callout’s request body.
  • ClientCredentialsClientSecretBasic—OAuth 2.0 Client Credentials client secret. Client secrets are sent in the callout’s authorization header, as with Basic authentication.
  • ClientCredentialsJwtAssertion—OAuth 2.0 Client Credentials JSON Web Token assertion.
  • JwtBearer—OAuth 2.0 JSON Web Token bearer flow.
  • NoAuthentication—No authentication.
  • RolesAnywhere—AWS Signature Version 4 with Identity and Access Management (IAM) Roles Anywhere.
If specified, the authentication protocol variant must match the actual protocol variant of the external credential.
Optional 57.0
credentials Map<String, Credential Value Input> Map of protocol-specific credentials.
Authentication protocols have credential allowlists and encryption rules.
  • AwsSv4awsAccessKeyId (not encrypted), awsSecretAccessKey (encrypted), awsRoleArn (not encrypted)
  • Custom—Any credential name is valid (user sets encryption rules)
Required 56.0
externalCredential String Fully qualified developer name of the external credential. Required 56.0
principalName String Name of the external credential named principal. Required if principalType is NamedPrincipal 56.0
principalType String Type of credential principal. Values are:
  • AwsStsPrincipal
  • NamedPrincipal
  • PerUserPrincipal
Required 56.0