POST /managed-services/instances/{instanceId}/credentials
Download connection credentials for a ready instance; each successful delivery is audited.
Syntax
POST https://grid-lab.zyxio.xyz/managed-services/instances/<instanceId>/credentials
x-api-key: <key>Request
| Name | Where | Required | Meaning |
|---|---|---|---|
x-api-key | header | yes, or Authorization | Your API key, or Authorization: Bearer <token> from Zyxio sign-in. |
instanceId | path | yes | The UUID returned as id when provisioning, or in the instance list. |
No request body is needed. Use POST, not GET. The instance must belong to your active account, be ready with requestedAction: "none", and have a matching active access binding granting access to the calling identity.
Response
200 OK, with cache-control: no-store. The response contains secrets; save it in a private file or secret store.
| Field | Meaning |
|---|---|
schemaVersion | Always managed-service-credentials/v1. |
instanceId | The instance UUID. |
service | postgres, mlflow, litellm or redis. |
endpoint | The instance's connection address. |
database, username | Included when present in the binding; Redis credentials also supply username. |
kind | Current credentials use postgres, http or redis. Older stored credentials may omit it. |
password | PostgreSQL or Redis password when supplied. |
caCertificate | PostgreSQL CA certificate when supplied; use it with sslmode=verify-full. |
useBrowsergridApiKey | true for MLflow and LiteLLM: authenticate to the scoped HTTPS endpoint with your own Browsergrid API key. The response does not contain that key. |
keyPrefix | Redis key and pub/sub prefix when supplied. Prefix every key and channel with it. |
token | May be present in older stored credentials. Follow that binding's authentication instructions. |
Current PostgreSQL credentials use kind: "postgres" and a password; HTTP gateway credentials use kind: "http" and useBrowsergridApiKey: true; Redis credentials use kind: "redis", a username and password. Downloads deliver the stored credential without rotating it. After a completed rotation or resumption, download it again.
Errors
| Status | Body | When | What to do |
|---|---|---|---|
401 | {"error": "unauthorized"} | Missing, revoked, expired or invalid API key. | Send a valid key. |
403 | {"error": "forbidden"} | A sign-in token has no usable account. | Use an invited account or its API key. |
403 | {"error": "managed_service_account_required"} | The caller has no active, allocated account. | Check the account used by your credential. |
503 | {"error": "accounting_unavailable"} | Authentication could not check the account database. | Retry shortly. |
403 | {"error": "account_suspended"} | The account became suspended before the operation could complete. | Restore account access. |
404 | {"error": "managed_service_not_found"} | Invalid UUID, missing instance or an instance of another account. | Check the ID and account. |
409 | {"error": "service_not_ready"} | Setup or an action is pending, the instance is not ready, or there is no binding. | Poll status; download after readiness. |
409 | {"error": "service_binding_changed"} | The access binding changed, is inactive, or does not grant access to this identity. | Use a granted identity or have the binding verified. |
503 | {"error": "managed_service_credentials_unavailable"} | Credential delivery is not configured. | Retry when service configuration is restored. |
503 | {"error": "managed_service_unavailable"} | A service dependency failed or did not answer. | Retry shortly; read current status before repeating a change. |
Account and lifecycle errors may also include a human-readable message.
Example
Use INSTANCE_ID from provisioning after it becomes ready. The subshell creates a private file without printing its contents:
(
umask 077
curl -fsS -X POST "https://grid-lab.zyxio.xyz/managed-services/instances/$INSTANCE_ID/credentials" \
-H "x-api-key: $BROWSERGRID_API_KEY" \
-o "managed-service-$INSTANCE_ID.json"
)For an MLflow instance, a response can be:
{
"schemaVersion": "managed-service-credentials/v1",
"instanceId": "7be7d0d2-4eb8-4f38-9490-3fd25b8eb5bd",
"service": "mlflow",
"endpoint": "https://grid-lab.zyxio.xyz/managed-services/7be7d0d2-4eb8-4f38-9490-3fd25b8eb5bd/mlflow",
"kind": "http",
"useBrowsergridApiKey": true
}Always use the returned endpoint; an access binding's ID need not equal the instance ID. PostgreSQL and Redis clients running as analytical jobs need "networkProfile": "managed-services" for their private TCP endpoints.
Billing
Free, including repeated downloads. An active instance continues to accrue its plan charge whether or not credentials are downloaded. See Managed services.
See also
GET /managed-services/instances/{instanceId}, POST /managed-services/instances/{instanceId}/actions, Managed services.