> ## Documentation Index > Fetch the complete documentation index at: https://docs.outerproduct.com/llms.txt > Use this file to discover all available pages before exploring further. # GenerateTemporaryCredentials > Fails when scoped vending is unsupported; never returns a base Secret's material. ## OpenAPI ````yaml /http-api-reference/openapi.json post /outerproduct.volume.v1.VolumeService/GenerateTemporaryCredentials openapi: 3.1.0 info: title: OuterProduct Control Plane API description: >- Control-plane Connect RPCs over HTTP with ProtoJSON request and response bodies. version: v1alpha servers: - url: https://api.outerproduct.com security: - bearerAuth: [] tags: - name: ApiKey description: |- Manages the current user's application-owned personal access tokens. External sign-in is required; personal and execution tokens cannot manage keys. - name: BillingAccount description: >- How a workspace pays: its prepaid balance, topped up through the payment processor and spent by its usage. - name: Image description: >- The image registry: OCI distribution over its storage, whose formats are its own. The control plane serves it to users, admitting each only to their workspace's repository, and forwards to the OCI registry. Manifests and blobs are addressed by digest and never replaced; tags name manifests. - name: ImageBuilder description: >- Builds Images from image specs, and runs their install steps, each adding layers to its parent image, and package builds, each one pinned package's layer on its base, which install steps merge rather than install. The control plane serves `SubmitImageBuild` and `WaitImageBuild` to users, and forwards them to the scheduler's, which imports each image spec's base through the OCI registry, places each install step and package build on a node that builds, and tags the image it built in its workspace's repository. Those nodes serve the steps to the scheduler, by the scheduler's certificate, and run each in the sandbox the scheduler placed it in. - name: Policy description: >- Resource access policies evaluated by the application's Cedar authorizer. A policy belongs to the workspace of the credential that created it and governs only that workspace and what it owns; deployment-wide grants belong to the operator's policy. - name: Run description: >- Submits and observes product Runs, their Calls, and the Calls' Attempts. Every Run owns one rooted Call tree. - name: Secret - name: User description: / User crud service - name: Volume - name: Workspace description: >- The workspace a request's credential is bound to, and its members. A session starts bound to its user's workspace and may switch to another the user belongs to; an API key stays bound to the workspace it was created in. Requests act in the bound workspace. paths: /outerproduct.volume.v1.VolumeService/GenerateTemporaryCredentials: post: tags: - Volume summary: GenerateTemporaryCredentials description: >- Fails when scoped vending is unsupported; never returns a base Secret's material. operationId: outerproduct.volume.v1.VolumeService.GenerateTemporaryCredentials parameters: - name: Connect-Protocol-Version in: header description: Define the version of the Connect protocol required: true schema: $ref: '#/components/schemas/connect-protocol-version' example: 1 - name: Connect-Timeout-Ms in: header description: Define the timeout, in ms schema: $ref: '#/components/schemas/connect-timeout-header' example: 1000 requestBody: content: application/json: schema: $ref: >- #/components/schemas/outerproduct.volume.v1.GenerateTemporaryCredentialsRequest required: true responses: '200': description: Success content: application/json: schema: $ref: >- #/components/schemas/outerproduct.volume.v1.TemporaryCredentials default: description: Error content: application/json: schema: $ref: '#/components/schemas/connect.error' components: schemas: connect-protocol-version: type: number examples: - 1 title: Connect-Protocol-Version description: Define the version of the Connect protocol const: 1 connect-timeout-header: type: number examples: - 1000 title: Connect-Timeout-Ms description: Define the timeout, in ms outerproduct.volume.v1.GenerateTemporaryCredentialsRequest: type: object properties: name: type: string title: name access: allOf: - $ref: '#/components/schemas/outerproduct.volume.v1.VolumeAccess' title: access title: GenerateTemporaryCredentialsRequest additionalProperties: false outerproduct.volume.v1.TemporaryCredentials: type: object allOf: - oneOf: - required: - azureUserDelegationSas - required: - azureAad - required: - awsTempCredentials - required: - gcpOauthToken - required: - r2TempCredentials - required: - storageProxy anyOf: - type: object properties: awsTempCredentials: allOf: - $ref: >- #/components/schemas/outerproduct.volume.v1.AwsTemporaryCredentials title: aws_temp_credentials title: aws_temp_credentials - type: object properties: azureAad: allOf: - $ref: '#/components/schemas/outerproduct.volume.v1.AzureAad' title: azure_aad title: azure_aad - type: object properties: azureUserDelegationSas: allOf: - $ref: >- #/components/schemas/outerproduct.volume.v1.AzureUserDelegationSas title: azure_user_delegation_sas title: azure_user_delegation_sas - type: object properties: gcpOauthToken: allOf: - $ref: '#/components/schemas/outerproduct.volume.v1.GcpOauthToken' title: gcp_oauth_token title: gcp_oauth_token - type: object properties: r2TempCredentials: allOf: - $ref: >- #/components/schemas/outerproduct.volume.v1.R2TemporaryCredentials title: r2_temp_credentials title: r2_temp_credentials - type: object properties: storageProxy: allOf: - $ref: '#/components/schemas/google.protobuf.Empty' title: storage_proxy description: Use the authenticated storage-proxy route for this volume. title: storage_proxy unevaluatedProperties: false not: allOf: - anyOf: - required: - awsTempCredentials - required: - azureAad - required: - azureUserDelegationSas - required: - gcpOauthToken - required: - r2TempCredentials - required: - storageProxy - not: oneOf: - required: - awsTempCredentials - required: - azureAad - required: - azureUserDelegationSas - required: - gcpOauthToken - required: - r2TempCredentials - required: - storageProxy properties: expirationTime: type: string title: expiration_time format: int64 description: Expiry in Unix epoch milliseconds. Unset for storage_proxy. title: TemporaryCredentials connect.error: type: object properties: code: type: string examples: - not_found enum: - canceled - unknown - invalid_argument - deadline_exceeded - not_found - already_exists - permission_denied - resource_exhausted - failed_precondition - aborted - out_of_range - unimplemented - internal - unavailable - data_loss - unauthenticated description: >- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. message: type: string description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. details: type: array items: $ref: '#/components/schemas/connect.error_details.Any' description: >- A list of messages that carry the error details. There is no limit on the number of messages. title: Connect Error additionalProperties: true description: >- Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation outerproduct.volume.v1.VolumeAccess: type: string title: VolumeAccess enum: - VOLUME_ACCESS_UNSPECIFIED - VOLUME_ACCESS_READ - VOLUME_ACCESS_READ_WRITE outerproduct.volume.v1.AwsTemporaryCredentials: type: object properties: accessKeyId: type: string title: access_key_id secretAccessKey: type: string title: secret_access_key sessionToken: type: string title: session_token title: AwsTemporaryCredentials additionalProperties: false outerproduct.volume.v1.AzureAad: type: object properties: aadToken: type: string title: aad_token title: AzureAad additionalProperties: false outerproduct.volume.v1.AzureUserDelegationSas: type: object properties: sasToken: type: string title: sas_token title: AzureUserDelegationSas additionalProperties: false outerproduct.volume.v1.GcpOauthToken: type: object properties: oauthToken: type: string title: oauth_token title: GcpOauthToken additionalProperties: false outerproduct.volume.v1.R2TemporaryCredentials: type: object properties: accessKeyId: type: string title: access_key_id secretAccessKey: type: string title: secret_access_key sessionToken: type: string title: session_token title: R2TemporaryCredentials additionalProperties: false google.protobuf.Empty: type: object description: An empty JSON object. connect.error_details.Any: type: object properties: type: type: string description: >- A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. value: type: string format: binary description: >- The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. debug: type: object title: Debug additionalProperties: true description: >- Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. additionalProperties: true description: >- Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. securitySchemes: bearerAuth: type: http description: A user session token or personal API key. scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.